DORA Register of Information — MFSA filing guide (2027 cycle)

Malta is a primary MiCA licensing hub, so many MFSA-authorised firms carry a double load: the DORA Register of Information and MiCA market-abuse obligations — often on a small team. This guide covers the MFSA deadline, the format, and the checks that matter.

Filing deadline — MFSA (Malta)

Not yet announced

MFSA's 2026 cycle deadline was 21 March — ten days ahead of the EU-wide 31 March backstop. MFSA has not yet announced its 2027 date as of August 2026; check MFSA's page before you plan around a specific date.

Format required

EBA XBRL-CSV is required — the structured format MFSA's systems ingest. Spreadsheet submissions are rejected.

Reference date

31 December 2026.

What CleanDesk checks against MFSA’s requirements

LEI checksums against GLEIF on every provider
Reconciled cross-references between the ESA tables
Exit-strategy and audit clauses on critical/important providers

Common errors that get flagged

Missing exit strategies on critical providers
Invalid LEIs
Gaps in fourth-party chains for outsourced crypto infrastructure

Who's in scope

Crypto-asset service providers (CASPs) — many Malta-licensed
Investment firms, payment institutions and insurers under MFSA

The double obligation

Most Malta CASPs owe both the DORA Register of Information and MiCA Article 92 market-abuse monitoring. CleanDesk handles both today — the Register of Information and MiCA Article 92 market-abuse surveillance — one place for both, sized for a lean team.

Not sure if MFSA's 2027 deadline is 31 March or earlier? Register check, nothing uploaded.

Check your register →

No signup · nothing uploaded · runs in your browser

DORA filing guides by regulator

This guide is general information, not legal advice, and deadlines and formats can change — always confirm the current requirement directly with the Malta Financial Services Authority (MFSA) before you file.