Outsourcing (EBA) compliance software
Organise the EBA third-party risk guidelines and Irish outsourcing guidance beside your vendor register. Keep contracts, exit plans and evidence in view.
14-day Professional trial · no credit card required
A practical way to move forward
One workspace for the requirements, the people doing the work and the records behind your next review.
Work through the EBA Guidelines by paragraph and the Central Bank guidance by section. Firms outside Ireland mark the Irish requirements not applicable with one recorded reason.
Keep providers in the vendor register beside the DORA Register of Information, with the further fields the Guidelines expect for non-ICT arrangements listed against each register requirement. Record criticality decisions, contract clauses and exit plans against the requirements.
Schedule recurring work such as the policy review, register reconciliation and exit plan tests, with owners and dates. Record supervisory notifications against the requirements that call for them.
The detail behind the dashboard
Move from a progress summary to the records that support it. Keep the next conversation focused on the work that needs attention.
Screens show example data. Shared platform features and availability depend on your plan.
See it with our team
Start with the right scope
EBA/GL/2026/09 covers third-party arrangements for non-ICT services at credit institutions, investment firms, payment institutions and e-money institutions; ICT services fall under DORA. The application date is still to be confirmed by the EBA. Firms regulated in Ireland also follow the Central Bank’s outsourcing guidance.
EBA: Guidelines on third-party risk (EBA/GL/2026/09) (opens in a new tab)EBA/GL/2026/09 paragraph by paragraph: scope, criticality, the register, contracts, subcontracting, exit plans and the two-year transition.
Paragraphs 58 to 64 field by field, mapped to the DORA templates and the Central Bank of Ireland return, with a template to fill in.
The 2021 Cross-Industry Guidance, the CP173 proposals and the register return due on 28 February 2027.
Before you get started
Want to discuss your framework and current process?
Talk it through with usThe final report leaves the application date as a placeholder, so it is still to be confirmed by the EBA. The Guidelines apply to arrangements entered into, reviewed or amended from that date, and existing arrangements are reviewed within a two-year transitional period. The 2019 outsourcing guidelines are repealed when the new ones apply.
No. ICT services fall under DORA and are tracked in the DORA module. This module covers non-ICT arrangements. Both start from the same vendor register; the non-ICT arrangement details the Guidelines expect are tracked against this module's register requirements.
Only if the Central Bank of Ireland regulates your firm. Its Cross-Industry Guidance on Outsourcing adds expectations such as board ownership, sub-outsourcing conditions and the outsourcing register return. Other firms mark those requirements not applicable with one recorded reason.
Yes. Bring your policies and supporting evidence into Venvera and link them to the relevant controls. Cross-framework mappings help you identify reusable work; your team still reviews whether the evidence meets each requirement.
The 14-day Professional trial includes up to five frameworks and unlimited users, with no credit card required. You can explore the controls, assess gaps and organise your compliance work. Framework modules are on paid plans; compare plans for feature availability.
Outsourcing (EBA) by Venvera
14-day Professional trial · no credit card required · up to 5 frameworks · unlimited users