Malta: filing with the Malta Financial Services Authority

xbrl-csv-only

FAQ: « RoIs are expected to be in XBRL-CSV format and reported to the Authority in a zipped (.zip) file. This is according to the specification provided by the ESAs, including within the EBA XBRL Filing Rules document. Submissions through LH Portal in any other format, such as Excel, will automatically be rejected. » The MFSA « is not an XBRL Provider » and will not convert or correct files; no Excel template or conversion tool is provided by the ESAs or the MFSA (« Financial Entities carry the responsibility of implementing a solution to create, and maintain, an RoI template aligned with the ITS ... and conversion tool »). Circulars call the format DORA-compliant « plain-csv ». Current EBA Reporting Framework: 4.0.

source high confidence

Licence Holder Portal (LH Portal) – project « Register of Information (ICT Third-Party Providers) » on the File Uploads page

url https://lhportal.mfsa.mt/

login prerequisites An LH Portal account linked to the Authorised Person is required. « Access to the RoI submission page on LH Portal is automatically granted to all Compliance Officers with an LH Portal account. If someone other than a Compliance Officer intends to submit the RoI, they must first create an LH Portal account and then request access to the RoI submission system by emailing roi@mfsa.mt. » The access request must include: Authorised Person's name; name and surname of the individual; designation (e.g. Compliance Officer, CEO); e-mail address as in the LH Portal account. Entities must keep their LH Portal corporate profile updated with their LEI code.

source high confidence

ReportSubject.CON/.IND_CountryCode_DORA010100_DORA_ReferenceDate_CreationTimestamp.zip — « [To be modified] ReportSubject refers to the LEI code of a reporting financial entity; [To be modified] CON/IND is the indication whether the file is being reported at the consolidated (CON) or individual entity level (IND); [To be modified] CountryCode refers to the two-letter ISO code of the country of an entity (eg. MT); [Not to be modified] DORA010100 refers to the Framework Code Module Version; [Not to be modified] DORA refers to the Module Version; [To be modified] Reference Date is YYYY-12-31 (eg. ''2025-12-31'' for the reporting in 2026 / ''2026-12-31'' for the reporting in 2027); [Not to be modified] CreationTimestamp refers to the timestamp that will be generated by the LH Portal upon submission of the RoI. The timestamp of when the reporting file was created should be removed. » « Please do not include any text other than the one specified above in the naming convention. Naming conventions of submissions not following the above format will be automatically rejected by the system. »

Example <LEI>.IND_MT_DORA010100_DORA_2025-12-31.zip (2026 cycle, individual level) — reading of the guide: the filer removes its own creation timestamp and the LH Portal appends its own on submission; MFSA gives no fully worked example, so confirm the exact expectation with roi@mfsa.mt. Also stated: « the Authority will always accept submissions that are in alignment with the ESAs most recent and valid technical package ».

Notes The root folder inside the zip must carry the same name as the zip without the .zip extension.

source high confidence

root folder must equal zip name yes

meta inf location Inside the root folder: « One (1) reports folder with: One (1) 'report.json' file; All other files in plain '.csv' format. One (1) META-INF folder. » (User Guide §2.2)

timestamp uniqueness CreationTimestamp is generated by the LH Portal on submission; the filer's own timestamp « should be removed ». « Any previously submitted Zip file with the same name will be considered superseded. »

other rules

• « For each AP the User is expected to upload one (1) Zip File. » « The Zip file should contain: one (1) root folder with the same name as the .zip file (File naming convention without the .zip extension). »
• « File structures of submissions not following the above format will be automatically rejected by the system. »
• A template csv may be omitted from the reports folder only if it contains no mandatory or key data to report (FAQ).
• Primary-key fields may not be empty: report 'Not Applicable' where a key value cannot be provided; other mandatory fields may be left blank (flagged as data-quality issues) unless ESA Q&A 140-147 say otherwise (FAQ).
• parameters.csv header must be Name then value, and the report subject must be sent as rs: (not lei:); FilingIndicators.csv template IDs in capitals and 'reported' only 'true' (FAQ, XBRL-CSV package checks).
• Resubmissions must contain the complete RoI (all files), not only corrected templates.

source high confidence

Notes Circular 3/11/2025: « Submit the RoI within the Reporting Period, which is between 01 January, or the next working day, and 21 March, or the next working day (both days included) of every Reporting Year » using « 31 December of the calendar year preceding the Reporting Period as the Reference Date (e.g., 31 December 2025 for Reporting Year 2026) ». Reminder 28/01/2026: « between 01 January 2026 and 21 March 2026, using the date of 31 December 2025 as the Reference Date ». Applies to all entities authorised up to the reference date. Circular 5/03/2026: ESAs ran additional data-quality checks in April 2026; entities failing them were contacted « with an expectation for resubmission, without undue delay, by 30 April 2026 », even if the LH Portal status was 'Accepted'. Rejected submissions must be re-filed within the reporting period. No extension found. (2025 first cycle for comparison: window 1–8 April 2025, reference 31 March 2025.)

reference date 2025-12-31

opens 2026-01-01

deadline 2026-03-21

corrections until 2026-04-30

source high confidence

reference date 2026-12-31

esa transmission deadline 2027-03-31

announced yes

opens 2027-01-01

deadline 2027-03-21

changes Standing rule from the 3/11/2025 circular (« for the Year 2026 and Onwards »): window 1 January (or next working day) to 21 March (or next working day) of every reporting year; the FAQ gives « 31 December 2026 when reporting in 2027 » and the naming example « ''2026-12-31'' for the reporting in 2027 ». 21 March 2027 falls on a Sunday, so the next-working-day rule would move the close to Monday 22 March 2027 (my calendar computation; not stated by the MFSA). Taxonomy: « The current EBA Reporting Framework is 4.0. This is anticipated to change to Reporting Framework 4.4 for the 2028 Annual RoI Reporting (reference date 31 December 2027) » – i.e. 4.0 is expected to remain for 2027, unless amended. No 2027-specific reminder circular had been issued as of 2026-10-31 (circulars list checked; latest SIRC circulars 30/09/2026 'Cyber Reporting Updates' and 01/10/2026 'SIRC Webpage and Key Updates', neither titled for the RoI).

source high confidence

No RoI test environment or dry-run window is mentioned in the MFSA circulars, user guide or FAQs read; a rejected upload within the window can simply be corrected and re-uploaded. (A separate MFSA circular on 'Test XBRL-CSV Files via the LH Portal' exists for credit institutions' supervisory reporting; its scope was not checked for the RoI.)

source medium confidence

No maker/checker or second-approver step is described; the Upload File(s) button triggers validation directly.

roles A single User « acting for and on behalf of an AP » uploads the file; « Typically, the User is expected to be the approved Compliance Officer of the AP ». Other persons need an LH Portal account plus project access granted by SIRC (roi@mfsa.mt).

source high confidence

format « The file will be submitted to a queuing system and via an automatic email the User is informed accordingly if the file upload was successful or not. » FAQ: the submission receipt e-mail indicates whether the file has been Rejected or is awaiting further validations at ESA level; status updated automatically on LH Portal; « An Accepted status will be displayed if the file successfully passes both the Authority's and the ESAs' checks »; detailed « XT Portal Feedback and/or ESA Feedback Reports » are available under « File Uploads > User Logs ». Guide screenshots: 'MFSA File Upload Result – Successful Upload (Pending Final Validation)', 'ESA Validation Result – Successful Validation – No Issues Found', 'MFSA File Upload Result – Rejected', 'ESA Validation Result – Rejected – Errors Found'.

timing Automated technical and business checks run immediately on upload; ESA-level validation follows (no fixed number of days stated). Additional ESA data-quality checks after the window (April in 2026) can trigger a resubmission request even after 'Accepted'.

resubmission « If an AP is required to resubmit the RoI, the process explained in Section 2 ... must be followed again ... Any previously submitted Zip file with the same name will be considered superseded. All files stipulated by the guidelines must be present in the resubmission, even if some were not updated » (e.g. 7 reports, 3 wrong: resubmit all 7). Rejected files must be re-submitted by the end of the annual reporting period; « A RoI submission is only considered DORA compliant once it attains the status of 'Accepted' on the LH Portal ».

source high confidence

true

Circular 6/11/2024: « financial entities must acquire and maintain a Legal Entity Identified (LEI) by the date of applicability of the DORA Regulation (17 January 2025). Financial entities should also ensure that their corporate profile within the LH portal is kept updated with the financial entity's LEI code. » FAQ: « Financial Entities are to exclusively use their LEI code to identify themselves in the RoI »; ICT TPPs may be identified by LEI, EUID (preferred), CRN, VAT, PNR or NIN. No procedure is given for a reporting entity without an LEI (the zip name requires it).

source high confidence

All Authorised Persons / financial entities authorised by the MFSA that fall within the scope of Regulation (EU) 2022/2554 (cross-sectoral: credit institutions other than ECB-supervised SIs, financial institutions, investment firms, fund managers, insurance, pensions, CASPs/VFA, CSDs, trading venues, crowdfunding, etc.); Excluded: credit institutions classified as significant under Art. 6(4) Reg. (EU) 1024/2013 – guided by the ECB for RoI submission; Included even if under the simplified ICT risk framework (Art. 16) or classified as microenterprises

source high confidence