Outsourcing rules for EU banks, investment firms and payment and e-money institutions are moving from the 2019 EBA Guidelines to EBA/GL/2026/09, which cover every recurrent non-ICT third-party arrangement while DORA keeps the ICT ones. The EBA has still to confirm the application date, so the useful work now is classification: which suppliers are in scope, which support critical or important functions, and what the register and the contracts must hold. Firms regulated in Ireland add the Central Bank layer, which its CP173 consultation proposes to rewrite in 2027.
3 pages on Outsourcing (EBA), in the order the work happens. Jump to the stage you are at, or read straight through.
Know who is in scope, which arrangements count, what changes from the 2019 outsourcing guidelines and what to do before the application date.
Build a register that meets paragraphs 58 to 64 and stays consistent with the DORA register of information.
Meet the Central Bank's notification and register expectations, file the February 2027 return and plan for CP173.
These sit under another subject but bear directly on Outsourcing (EBA).
The free compliance check runs the Outsourcing (EBA) gap assessment in about five minutes and gives you a scored report you can take to a board meeting.
14-day free trial · no credit card · unlimited users