Learn
If you run outsourcing or third-party risk at a firm regulated by the Central Bank of Ireland, this guide tells you what the Central Bank expects of you today, what its new consultation would change, and the three dates that matter this winter: 3 December 2026, when CP173 closes; 28 February 2027, when the outsourcing register return is due; and Q1 2027, when the Central Bank expects to publish its final third-party guidance. It also shows how the Irish layer sits on top of DORA, the EBA's third-party risk guidelines and, for insurers, Solvency II, so you know which text sets the bar for your firm.
The short answer: the Cross-Industry Guidance on Outsourcing of December 2021 still applies to every regulated firm that outsources, proportionately, as the Central Bank's statement of good practice. It adds Irish increments to the EBA text, including a board-approved outsourcing strategy, annual policy approval, pre-notification of critical or important outsourcing with a set list of data items, an outsourcing register in the Central Bank's template and an annual review of key providers' financial health. On 8 October 2026 the Central Bank published CP173, draft Guidance on Good Practices for the Sound Management of Third-Party Risks, which would replace the 2021 Guidance on publication of the final text.
| Question | Answer |
|---|---|
| What applies today? | The Cross-Industry Guidance on Outsourcing, December 2021, applied proportionately to every regulated firm that outsources |
| Is it binding? | It is a guide to good practice; sectoral legislation prevails, and where that legislation is silent the Central Bank expects firms to refer to the Guidance |
| What is changing? | CP173 proposes outcomes-based guidance covering all third-party arrangements; it closes on 3 December 2026 and the final text is anticipated in Q1 2027 |
| What happens to the 2021 Guidance? | It is withdrawn when the new guidance is published |
| When is the next register return? | 28 February 2027, reference date 31 December 2026, for firms that filed in the 2024 cycle |
| How early must you notify? | Before commencement and in time for supervisory consideration; no fixed number of days, except at least six weeks for (re)insurers |
What does the 2021 Cross-Industry Guidance on Outsourcing require?
The Guidance has two parts. Part A sets out its context, scope, proportionality and status. Part B sets the expectations in ten sections, and its measures apply to critical or important outsourcing unless a section says it covers all arrangements. The table shows each section with the points that go beyond the EBA text.
| Part B section | What the Central Bank expects beyond the EBA text |
|---|---|
| 1. Criticality or importance | A documented methodology with criteria and rationale, re-run before signing, at scheduled reviews, on scale-up and when the provider's ownership or finances change; Appendix 2 sets the minimum criteria |
| 2. Intragroup arrangements | The same rigour as external outsourcing; the Irish entity must be able to influence the group provider and must check that group policies work for it |
| 3. Outsourcing and delegation | Delegation, the term used in fund management, is treated as outsourcing |
| 4. Governance | A board-approved outsourcing strategy; a policy reviewed and approved by the board at least annually; a designated individual, function or committee for outsourcing risk; care with pre-approval controlled functions and controlled functions |
| 5. Risk assessment and management | Outsourcing risk in the firm-wide risk register; sub-outsourcing appetite set in the policy; a data management strategy; concentration including sectoral and chain exposure; a board decision and country risk assessment for offshoring |
| 6. Due diligence | Wider criteria than the EBA list and a review of key providers' financial health at least once a year |
| 7. Contracts and SLAs | Resolution-resilient contracts; locations to town or city level; KPIs in the SLA; support for exit testing; no termination because the firm enters recovery or resolution; termination on the Central Bank's instruction |
| 8. Monitoring and challenge | Three lines of defence with documented assurance frequency; an internal audit programme with a set list of areas |
| 9. Business continuity and exit | Providers test their continuity plans at least annually; coordinated testing reported to both boards; exit strategies tested, at minimum by a detailed walkthrough challenged by the board |
| 10. Information to the Central Bank | Pre-notification of critical or important outsourcing with items (a) to (s); reports of adverse events; the outsourcing register and its return |
Is the Central Bank's outsourcing guidance binding?
Part A section 5 calls the Guidance "a guide to good practice". It does not replace or override legal requirements, the legislation prevails if they conflict, and where sectoral legislation, regulations or guidance "is less prescriptive or is silent on certain matters", the Central Bank expects firms to refer to the supervisory expectations in the Guidance. Firms may adopt different practices, but must be able to explain why on request. CP173 keeps the same status: its draft says the new guidance uses "should" to give the Central Bank's "opinion and advice", that it will inform supervision, and that the Central Bank "may require firms to demonstrate appropriate consideration" of its topics and will intervene where the risks are high enough.
What must you notify, and when?
Part B section 10.1.1 asks firms to notify the Central Bank of planned critical or important outsourcing and of material changes to existing arrangements. The triggers include authorisation applications that involve such outsourcing, new arrangements and new sub-outsourcing, existing arrangements redefined as critical or important, a change of provider or location, terminations, and the continuation or termination of arrangements when recovery or resolution is activated. The notification carries the data items listed in (a) to (s), broadly the register fields.
No fixed number of days is set. The Central Bank expects the notification before commencement and early enough for supervisory consideration, and its feedback statement says notification is not a pre-approval process, although the Central Bank may ask for more information, improvements, a delay or contract changes. Offshoring of a critical or important function, and any case where supervisibility could be constrained, should be raised before the firm commits. Section 10.1.3 adds reports of adverse events: a significant change to the outsourcing aspects of the business model, a material event affecting a critical provider, or a material breach of contract or SLA that affects regulated services or customers.
| Firm | Notification rule | Timing |
|---|---|---|
| Credit institutions, investment firms, payment and e-money institutions | Central Bank Part B s. 10.1.1, plus paragraphs 65 and 66 of the EBA Guidelines once they apply (until then paragraphs 58 and 59 of the 2019 Guidelines); PSD2 Article 19(6) for payment firms | Before commencement, in sufficient time; no fixed number of days |
| (Re)insurance undertakings | Regulation 51(3) of the European Union (Insurance and Reinsurance) Regulations 2015, transposing Solvency II Article 49(3) | At least six weeks before the outsourcing takes effect; no pre-approval |
| All regulated firms | Adverse events under Part B s. 10.1.3 | When the event occurs, under your escalation procedure |
What is the outsourcing register return?
Part B section 10.2 expects every regulated firm to keep an outsourcing register in the Central Bank's sector template. Firms with a PRISM impact rating of Medium Low or above, and others the Central Bank designates, submit it through the Central Bank Portal; all other firms keep the register in the template format and must be ready to provide it on request. For payment and e-money institutions the template has nine worksheets, from the cover sheet and the R01 summary to service providers, functions, sub-contractors, alternative providers and additional general information, and the file name follows the pattern CXXXXXX_YYYYMMDD_POR.
The Central Bank paused its domestic collection in 2025 while firms prepared their first DORA registers of information. It resumes in February 2027, with a deadline of 28 February 2027 and a reference date of 31 December 2026, limited in that cycle to firms that submitted in the 2024 cycle, on the same template. Firms in scope of DORA may leave in or remove data already filed in their DORA register of information. The Portal validates the file, so watch the details: case-sensitive values, ISO country codes, the 01/01/4444 and 01/01/6666 date conventions for not applicable and not available, and summaries of at most 300 characters. Our guide to the EBA outsourcing register maps every template column to the EBA fields.
What does CP173 propose?
CP173 reframes the Central Bank's expectations as outcomes with good practices attached. The draft covers "material third-party arrangements that create a reliance or dependency", including outsourcing and intragroup services, cloud providers, partnerships and joint ventures, technology vendors and data processors. It follows the life cycle in five blocks and sixteen outcomes, and it splits its practices into foundational ones and supporting ones, so a smaller firm can start with the foundations. Like the 2021 Guidance, it applies the practices to critical or important arrangements unless it says otherwise.
| Block | Outcomes |
|---|---|
| A. Governance and organisational context | 1 Accountability; 2 Decision making (strategy and policy); 3 Roles and responsibilities; 4 Critical or important functions |
| B. Due diligence and risk assessment | 5 Initial risk management; 6 Initial due diligence |
| C. Contracting | 7 Clearly defined third-party agreements; 8 Contractual provisions and termination rights |
| D. Ongoing risk management and monitoring | 9 Record keeping; 10 Ongoing risk management; 11 Management of key risks (sub-outsourcing, intragroup, concentration, offshoring); 12 Monitoring |
| E. Incident and termination management | 13 Termination risks; 14 Disaster recovery and business continuity; 15 Testing of incident and termination plans; 16 Data stewardship |
Three points stand out for practitioners. The draft register (outcome D1) adopts the 2026 EBA and DORA fields, including the type of contractual arrangement, the four-point substitutability scale and recovery objectives, while keeping the Irish fields such as notice periods, the personal data flag, the approver and continuity test dates. On dominant providers that offer standard terms, the Central Bank expects firms to document their efforts to secure protections, assess the residual risk and apply compensating controls. And the draft points firms to the Central Bank's website for when and how to notify, so the notification detail moves out of the guidance itself.
How would CP173 change the 2021 guidance?
| Topic | 2021 Cross-Industry Guidance | CP173 draft guidance |
|---|---|---|
| Scope | Outsourcing, with other third-party arrangements as optional good practice | All third-party arrangements that create reliance or dependency |
| Format | Expectations set out section by section | Sixteen outcomes with foundational and supporting good practices |
| Status | Guide to good practice, non-binding | Non-binding opinion and advice that informs supervision |
| Firms on DORA and the EBA Guidelines | Full guidance applies proportionately | May find it provides only limited additional insight |
| Notifications | Detailed in Part B s. 10.1.1 and 10.1.3 | Consult the Central Bank's website on when and how to notify |
| Register | Appendix 3 fields; three-point substitutability | EBA 2026 and DORA fields plus Irish fields; four-point substitutability |
| Few or dominant providers | Keep the ability to negotiate robust terms where providers are few (Part B s. 5.4) | Document efforts to secure terms, assess residual risk, apply compensating controls |
| Effective date | In effect since publication in December 2021 | On publication of the final guidance, anticipated in Q1 2027 |
The Central Bank describes the change as limited in its incremental impact: both texts are non-binding, many firms already apply the 2021 practices, and firms already subject to European Supervisory Authority guidelines "will find significant alignment". The firms most affected are those whose framework still covers only traditional outsourcing, because they will have to identify and assess a wider set of dependencies.
Which text sets the bar for your firm?
CP173 is explicit that the Central Bank's guidance is most useful where the European framework is thin. It names insurance undertakings and retail credit firms as examples of firms whose sectoral rules contain "high-level obligations to manage risks", and says a credit institution or payment institution complying with DORA and the EBA Guidelines may get only limited additional insight from it. For the European layers, see our guides to the DORA requirements, to DORA for insurers and to Solvency II governance requirements, which covers the Article 274 outsourcing terms.
| Firm | ICT providers | Non-ICT providers | Central Bank guidance |
|---|---|---|---|
| Credit institution, investment firm, payment or e-money institution | DORA Chapter V | EBA third-party risk guidelines once they apply; the 2019 outsourcing guidelines until then | Applies proportionately; CP173 says it adds limited insight |
| (Re)insurance undertaking | DORA Chapter V | Solvency II Article 49 and Delegated Regulation Article 274 | Applies; the main source of practical detail, with six weeks' notice of critical outsourcing |
| Other Central Bank-regulated firms | Depends on whether the firm is a DORA financial entity | Sectoral rules | Applies; the practical reference where sectoral rules are high-level |
What should Irish firms do now?
| When | Action | Why |
|---|---|---|
| Before 3 December 2026 | Read the draft against your framework; answer the 13 consultation questions if you have evidence to give, by email to [email protected] | The Central Bank asks for quantitative and qualitative evidence on costs, scope and proportionality |
| Q4 2026 | Expect contact from the Central Bank if you are in scope of the register collection; rebuild the 31 December 2026 register extract | The return uses the same template as before |
| By 28 February 2027 | Validate and submit the register through the Portal; decide whether to leave DORA data in or take it out | The Portal rejects files that fail validation |
| Q1 2027 | Map your framework to the final guidance when it is published, and retire references to the 2021 Guidance in policies | The 2021 Guidance is withdrawn on publication |
| When the EBA sets its date | Banks, investment firms and payment firms: start the two-year review of critical arrangements | Paragraph 20 of EBA/GL/2026/09 |
What the other results get wrong
Page one for this query is mostly analysis written in 2021 and 2022. Three points no longer hold.
The top-ranking factsheet, from June 2022, still tells firms to prepare their first outsourcing register return, due by 31 July 2022, and never mentions DORA, the 2025 pause or the 28 February 2027 deadline. The current collection is described on the Central Bank's submission page, which is the page to work from.
A law-firm note on the register templates, from August 2022, says the deadline "from 2024 onwards will be end-February of each year". There was no 2025 domestic collection: the Central Bank paused it while firms prepared their DORA registers, and resumes it in February 2027 for firms that filed in 2024.
Every page we reviewed treats the 2021 Guidance as the settled Irish text. Since 8 October 2026 it has a proposed successor, and the Central Bank intends to withdraw it when the final guidance is published, anticipated in Q1 2027. Frameworks built on the 2021 section numbers will need re-mapping.
Where do you stand?
| Question | Your answer | Reference |
|---|---|---|
| Is your outsourcing strategy board-approved, and was the policy approved by the board in the last twelve months? | Part B s. 4.1, 4.2 | |
| Does your criticality methodology say when it is re-run, and is each assessment dated? | Part B s. 1 | |
| Who decides on and sends notifications, and does each one carry items (a) to (s)? | Part B s. 10.1.1 | |
| Is your PRISM rating Medium Low or above, and did you file in the 2024 cycle? | Submission page | |
| Has the 31 December 2026 register extract been validated against the template rules? | Part B s. 10.2 | |
| Did each key provider of a critical service have a financial health review this year? | Part B s. 6.2 | |
| When was each exit strategy last tested, and did the board challenge the result? | Part B s. 9.1 | |
| Which third-party arrangements outside traditional outsourcing would CP173 bring into your framework? | CP173 s. 3.1.1 |
How do you keep the Irish layer in one place?
Irish firms run the EBA and Central Bank expectations side by side, which usually means two checklists, a register spreadsheet and a calendar of reminders. In Venvera the Outsourcing (EBA) framework carries the 19 Central Bank requirements next to the 53 EBA ones, each with an owner, status and evidence, so a board approval, a notification or a register reconciliation is filed once against the requirement it answers. The register return, the annual policy approval, the providers' financial health reviews and the exit tests sit on the compliance calendar with due dates. Venvera manages the programme and its evidence; notifications and the Portal submission stay with your team.
For the EBA side of the same programme, read our guide to the EBA third-party risk guidelines. To see the framework on your own suppliers, book a demo, or start with a free compliance check.
Frequently asked questions
What is the Central Bank of Ireland's Cross-Industry Guidance on Outsourcing?
It is the Central Bank's statement of supervisory expectations and good practice on outsourcing risk, published in December 2021 after consultation CP138. It applies, proportionately, to every regulated firm that uses outsourcing, and it builds on the EBA's 2019 outsourcing guidelines with Irish increments.
What is CP173?
Consultation Paper 173, published on 8 October 2026, which proposes Guidance on Good Practices for the Sound Management of Third-Party Risks. It would cover all third-party arrangements that create a reliance or dependency, in sixteen outcomes, and replace the 2021 Guidance. Responses are due by 3 December 2026.
When will the new guidance apply?
The Central Bank anticipates publishing the final guidance in Q1 2027, effective on publication, and the 2021 Guidance will be withdrawn at that point. Until then the 2021 Guidance applies.
Do I have to notify the Central Bank before outsourcing?
For critical or important arrangements, yes: before commencement and in time for supervisory consideration, with the items in Part B s. 10.1.1. The Central Bank does not pre-approve the arrangement, though it may ask for changes or a delay. Insurers should notify at least six weeks ahead.
Who has to submit the outsourcing register?
Firms with a PRISM impact rating of Medium Low or above and others the Central Bank designates. In the February 2027 collection the scope is limited to firms that submitted in the 2024 cycle. Every other firm keeps the register in the template format for supervisors to request.
Can we leave DORA data in the register return?
Yes. For the 2027 collection, firms that also file the DORA register of information may leave in or remove data already submitted there. The Central Bank has no preference and says it is not seeking to collect the DORA data twice.
Does the Central Bank guidance apply to insurers?
Yes. It applies to every regulated firm that outsources, and CP173 names insurance undertakings among the firms whose sectoral rules contain only high-level obligations. Insurers also follow Solvency II Article 49 and the Central Bank's six-week notification expectation.
Does the guidance apply to payment and e-money institutions that follow the EBA Guidelines?
Yes, proportionately. CP173 notes that a payment or credit institution complying with DORA and the EBA Guidelines may find the new guidance gives only limited additional insight; the register return and notifications still apply.
How often must the outsourcing policy be approved?
The 2021 Guidance expects the board to review and approve the outsourcing policy at least annually, which matches the annual review in paragraph 47 of the EBA's 2026 Guidelines.
Primary sources
Expectations are from the Central Bank's Cross-Industry Guidance on Outsourcing (December 2021) and its feedback statement on CP138. Proposals are from Consultation Paper CP173 and its draft guidance (October 2026), with dates from the CP173 page. The 2027 register collection is from the outsourcing register submission page and template rules from the payments and e-money guidance note, checked on 19 October 2026. Insurance notification timing is from the Central Bank's Solvency II outsourcing notification guidance and Article 49 of Directive 2009/138/EC. EBA references are to the final report on EBA/GL/2026/09.
