S.L. 330.20 Art. 4Competent authority.

(1) In terms of the relevant provisions of Article 46 of the DORA Regulation, the Authority shall be the designated competent authority in Malta for the purposes of implementing the relevant provisions of the DORA Regulation and for ensuring compliance therewith and, without prejudice to sub-regulation (2), any reference in these regulations to the competent authority shall be read and construed accordingly.

(2) The designation of the Authority as the competent authority under sub-regulation (1) shall be without prejudice to:

(a) the European Central Bank (ECB) as the designated competent authority for credit institutions classified as significant in accordance with Article 6(4) of Regulation

(EU) No 1024/2013, as referred to in Article 46(a) of the DORA Regulation; and

(b) the European Securities and Markets Authority

(ESMA) as the designated competent authority for:

(i) trade repositories in accordance with Article 22 of Regulation (EU) No 648/2012, as referred to in Article 46(h) of the DORA Regulation;

(ii) credit rating agencies in accordance with Article 21 of Regulation (EC) No 1060/2009, as referred to in Article 46(n) of the DORA Regulation; and

(iii) administrators of critical benchmarks in accordance with Articles 40 and 41 of Regulation (EU) 2016/1011, as referred to in Article 46(o) of the DORA Regulation.

(3) The Authority shall exercise all the functions, obligations and powers, and shall satisfy all the requirements imposed on competent authorities by the DORA Regulation, including the (DIGITAL OPERATIONAL RESILIENCE ACT (DORA))

receiving of any reports of any major ICT-related incidents reports and any voluntary notifications of significant cyber threats, in accordance with Article 19 of the DORA Regulation.

(4) For the purposes of Article 32(5) of the DORA Regulation, the Authority shall be the relevant competent authority whose staff member shall be the high-level representative for the purposes of Article 32(4)(b) of the DORA Regulation.

(5) Without prejudice to sub-regulation (1) and to any other power conferred on the Authority under any other relevant law, the Authority may, for the better implementation of the DORA Regulation, exercise any of the powers conferred to it under the Act.

(6) In terms of Article 26(10) of the DORA Regulation, without prejudice to the power to identify the financial entities that are required to perform Threat-Led Penetration Testing, the Authority may delegate the exercise of some or all of the tasks referred to in Articles 26 and 27 of the DORA Regulation to another national authority in the financial sector, and any delegation so made shall be published on the Authority’s official website without undue delay.