knowledge 16 October 2026 |

Beyond Outsourcing: Navigating the EBA’s New Third-Party Risk Framework

Why this matters

On 18 September 2026, the EBA published its final Guidelines on the sound management of third-party risk related to non-ICT services. These will replace the EBA’s 2019 Guidelines on outsourcing arrangements, which have shaped how firms manage outsourcing since September 2019.

The key takeaways are:

• the rules now cover all third-party arrangements, not just outsourcing;
• more types of firms are in scope;
• the strictest requirements still apply where a supplier supports a critical or important function;
• the guidelines are designed to sit alongside the Digital Operational Resilience Act (“DORA”), which governs ICT suppliers; and
• firms will have a two-year transition period to bring existing arrangements into line.

Who is affected?

The guidelines apply to:

• credit institutions, and EU branches of non-EU banks (on a proportionate basis);
• investment firms, other than small and non-interconnected firms;
• payment institutions and e-money institutions;
• issuers of asset-referenced tokens under the EU’s crypto-assets regime (a new addition);
• mortgage lenders that are financial institutions (also new); and
• approved and mixed financial holding companies.

Fund management companies within a banking or investment firm group may also be affected indirectly, because the guidelines apply on a group-wide basis. Crypto-asset service providers are not in scope.

What has changed?

From outsourcing to third-party arrangements

The guidelines now capture any arrangement under which a third-party provider, including a group company, supports one or more of a firm’s functions on a recurrent or ongoing basis. Outsourcing becomes a subset of this wider category, so relationships that previously fell outside the outsourcing rules may now be caught. Some services are excluded, including market information services and regulated services that must by law be performed by another regulated financial entity.

A clear dividing line with DORA

Technology services covered by DORA fall outside the guidelines. Where a non-ICT service also has a technology element, firms must decide whether that element is significant enough to bring the arrangement under DORA. The EBA expects firms to take a joined-up approach across both regimes.

Stronger governance

The board must approve a strategy on third-party risk, supported by a written policy on non-ICT services supporting critical or important functions, reviewed at least annually. Firms need a dedicated monitoring function or an accountable senior manager, which can be the same person or role used for DORA.

A new register

Firms must keep a register of all in-scope third-party arrangements, with more detail for those supporting critical or important functions. It should be consistent with, and may be integrated into, the DORA register, while requiring fewer data points.

What stays the same?

The board remains responsible

Using third-party providers does not reduce the board's responsibility, and must not leave a firm without the operational substance it needs to keep its authorisation.

Group arrangements are treated like external ones

A firm’s enhanced level of control over a group service provider may be taken into account as part of its risk assessment.

Audit and access rights

Unrestricted audit and access rights are still required for arrangements supporting critical or important functions, although pooled audits and certifications are permitted subject to safeguards.

Non-EU suppliers

Firms must ensure that EU requirements such as confidentiality, access to information and data protection are met, and that their regulator can effectively supervise the arrangement.

The bigger picture

These guidelines are part of a clear direction of regulatory travel across Europe and in Ireland: supervisors increasingly view reliance on suppliers as a firm-wide risk issue, not a narrow outsourcing compliance exercise. In Ireland, the Central Bank of Ireland has recently launched a consultation on updating its cross-industry outsourcing guidance in its consultation on Guidance on Good Practices for the Sound Management of Third-Party Risks. Irish firms should expect domestic and EU expectations to converge around the same themes: strong board oversight, complete registers, and resilience across the supply chain.

Key dates

• In relation to the EBA’s guidelines, national regulators are required to confirm their compliance with the guidelines within two months of the publication of the translated versions.
• The date from which the guidelines apply has not yet been confirmed. From that date, they will apply to all arrangements entered into, reviewed or amended, and the 2019 outsourcing guidelines will be repealed.
• Firms will have two years from that date to review and document existing arrangements supporting critical or important functions. Where this deadline cannot be met, firms must notify their regulator and set out their plan to complete the review or terminate the arrangement.
• Other arrangements can be reviewed and documented when they are next renewed.

What should be done now?

• Map existing supplier arrangements against the broader scope to identify relationships not previously classified as outsourcing.
• Work out which arrangements fall under DORA and which fall under the new guidelines, particularly where a service mixes technology and non-ICT elements.
• Review governance frameworks to ensure third-party risk is incorporated into overall risk management and supported by a board-approved strategy and policy.
• Check that registers are complete and consider whether to combine them with the DORA register.
• Start planning early to review and, where needed, renegotiate your contracts for critical or important arrangements as renegotiation can take time.
• Keep an eye out for the confirmed application date and the outcome of the Central Bank of Ireland’s consultation.

How can McCann FitzGerald LLP help?

Our Financial Regulation team regularly advises regulated entities on outsourcing, third-party risk and DORA. For further information on any of the matters discussed in this briefing or for assistance in understanding how best to implement the new requirements, please contact any of the key contacts below or your usual contact at McCann FitzGerald LLP.