MFSA Rules, DORA, and the EBA Guidelines
Abstract:
Outsourcing has become a commercial reality for financial institutions of all sizes. Whether it is a core banking platform, a compliance function, or an API integration with a payments provider, the regulatory framework governing these arrangements is extensive and, since January 2025, considerably more demanding. This article sets out the key questions institutions should be asking, drawing on the MFSA rules (FIR/01 and FIR/03), DORA, and the EBA Guidelines on Outsourcing.
1. What is Critical, Important, or Material Outsourcing?
Not all outsourcing arrangements are treated equally. The threshold concept across all three frameworks is whether a disruption to the outsourced function would materially affect the institution's ability to operate, meet its obligations, or remain compliant. Classic examples include core banking systems, payment processing, and key IT infrastructure.
