Supervisory Engagements and Digital Operational Resilience 2025 General Observations Report

For compliance teams, this is a clear signal that the regulator expects board-level attention to ICT and operational resilience, not just policy documentation. Firms should expect scrutiny of governance, risk identification, incident reporting, resilience testing and third-party ICT arrangements. The letter is particularly relevant to entities subject to DORA-style expectations and to firms with complex outsourcing or digital delivery models.

Compliance leaders should map the observations against their current control environment, identify gaps, and prepare a remediation plan with clear ownership and timelines. Senior management should review the findings and ensure that resilience risks are reflected in the risk appetite and operational planning. There is no indication of a new standalone deadline in the notice, but the supervisory tone suggests firms should act promptly rather than wait for further guidance.

The business impact is significant because resilience weaknesses can affect service continuity, customer outcomes, regulatory confidence and cross-border operations. Firms that respond proactively can use the observations to strengthen oversight, improve incident readiness and demonstrate credible governance to the MFSA.