DORA LEI Malta: Requirements for ICT Suppliers

A DORA LEI Malta request from a financial-entity client does not, by itself, mean your ICT business has a direct legal duty to obtain an LEI. Financial entities must identify ICT providers that are legal persons in their register of information using a valid and active LEI or a European Unique Identifier (EUID), and both where available; a provider not established in the Union must be identified by an LEI.

What this means in Malta

The Malta Financial Services Authority (MFSA) has set a national timetable for authorised persons in scope of DORA. Under its MFSA – RoI Reporting Timelines for the Year 2026 and Onwards, they submit the register of information each Reporting Year by 21 March or the next working day. The reference date is 31 December of the previous year, and submission is through the MFSA LH Portal.

For Reporting Year 2026, the reference date was 31 December 2025. The MFSA deadline is for the authorised person submitting the register, not a universal deadline for a supplier to send an identifier to its client. An ICT supplier should ask its Malta-based client when the client needs its details so the client can prepare its submission.

Consider a Sliema software firm supporting an iGaming payment institution. Its practical task when asked for register details is to confirm the identity of the legal person providing the service and which identifier is available for that person. A US cloud provider serving a Malta insurer illustrates a different identification question: a legal person not established in the Union must be identified by LEI, rather than EUID.

The same MFSA timetable will apply to the next Reporting Year: the reference date will be 31 December 2026, and the submission deadline will be 21 March or the next working day. The MFSA reports to the European Supervisory Authorities (ESAs) by the end of March. Suppliers should obtain their client’s collection deadline rather than work backwards from the MFSA reporting date.

DORA LEI Malta: key points

• DORA has applied since 17 January 2025. The register obligation rests with financial entities.
• An ICT provider that is a legal person is identified by a valid and active LEI or an EUID, and both where available. For a provider not established in the Union, only an LEI may be used.
• Relevant subcontractors recorded in the register may also need to provide identifiers when they effectively underpin an ICT service supporting a critical or important function.
• The MFSA submission timetable is distinct from the earlier date a financial-entity client may set for collecting supplier information.

Why clients request ICT supplier details

Regulation (EU) 2022/2554 (DORA), Article 28(3), requires financial entities to maintain and update a register covering their contractual arrangements for ICT services from ICT third-party service providers. It forms part of their ICT risk management framework and is maintained at entity, sub-consolidated and consolidated levels.

Financial entities make the full register, or requested sections, available to their competent authority on request and report at least yearly on new arrangements. This explains why a supplier may receive an identification request even though the legal requirement to maintain the register belongs to the financial entity. The ESAs also use the registers to designate critical ICT third-party service providers; AFM DORA update 7 (August 2026) reported that nineteen had been designated based on the registers.

Which identifier belongs in the register?

Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024, published in the Official Journal on 2 December 2024, sets the standard register templates. Article 3(5) requires financial entities to identify ICT providers that are legal persons with a valid and active LEI or the EUID referred to in Article 16 of Directive (EU) 2017/1132, and both where available. Individuals acting in a business capacity are excepted.

The Annex limits providers that are legal persons to those identifiers; alternative codes are reserved for individuals acting in a business capacity. Only an LEI may be used for a legal person not established in the Union. An EUID is therefore an option for an eligible Union-established provider, not a replacement for the LEI of a non-Union provider.

Article 3(6) also covers a relevant subcontracting chain. When a direct provider’s service supports a critical or important function, the financial entity must ensure through that provider that subcontractors recorded in the register which effectively underpin the service use a valid and active LEI or provide an EUID, and both where available. The exception for individuals acting in a business capacity also applies here.

The financial entity’s own identification rule is different. The ESAs RoI reporting FAQ (28 March 2025) confirms that templates B_01.01 and B_01.02 identify a financial entity only by its LEI. An LEI is a 20-character alphanumeric code based on ISO 17442; the EUID option for eligible suppliers does not extend to these financial-entity fields.

Check LEI status, not just the code

Article 3(5) specifies a valid and active LEI. The ESAs say they check LEIs against the GLEIF database and EUIDs against BRIS reference data. Their FAQ also says each ICT provider’s ultimate parent must be identified in the register. A supplier should check the details it sends, including whether an existing LEI is active.

The FAQ’s question 44 said strict LEI-status checks would not be enforced during initial reporting stages, particularly in 2025, but did not specify how long that approach would continue. Question 40 addresses a separate processing issue: if a third-country provider has no available LEI, another identifier may be reported without rejection of the file, but the entry is flagged as a data-quality issue. That guidance does not change the Annex rule requiring an LEI for a provider not established in the Union.

If your company needs a code, you can apply for an LEI. If its existing code has lapsed, you can renew an LEI before passing its details to a client.

Reporting dates and supplier action

For the wider reporting cycle, the ESAs FAQ says the reference date from 2026 onwards is 31 December of the previous year. Competent authorities report registers to the ESAs by 31 March each year and set earlier deadlines for financial entities. The EBA – Preparations for reporting of DORA registers of information page collects the templates, data model, validation rules and FAQ.

Cycle	Reference date	ESA reporting deadline for competent authorities	MFSA submission timetable
2026	31 December 2025	31 March 2026	21 March or the next working day
Next cycle	31 December 2026	31 March 2027	Will be 21 March or the next working day

Before replying to a client’s request:

1. Confirm the contracting legal person and whether it is established in the Union.
2. Check whether it has an LEI, an EUID or both, and verify the status of any LEI.
3. If the service supports a critical or important function, ask the client which subcontractors must be recorded, then collect their applicable identifiers.
4. Confirm the information needed to identify the provider’s ultimate parent and ask for the client’s supplier-data collection deadline.

Other identification rules should not be assumed to work the same way; the guide to LEIs in Malta customer identification under AMLR covers a different use case. The LEIFast regulation updates cover related topics. For this register request, confirm the contracting entity, its eligible identifier and the client’s deadline; if the arrangement raises a specific scope question, check with your regulator or adviser.