EBA Third-Party Risk Guidelines 2026 Explained

If you run outsourcing, vendor management or operational risk at an EU bank, payment or e-money institution or investment firm, the EBA's new third-party risk guidelines decide how much of your supplier book you have to document, re-paper and report. This guide gives you the answers in the order you will need them: who is in scope, which suppliers now count, what the register and the contracts must hold, when your supervisor has to hear from you, and what to do while the application date is still open. Every statement is tied to a paragraph of the final report the EBA published on 18 September 2026, so you can lift it straight into a gap analysis or a board paper.

In one paragraph: EBA/GL/2026/09, the Guidelines on the sound management of third-party risk regarding non-ICT services, will replace the 2019 Guidelines on outsourcing arrangements (EBA/GL/2019/02). They widen the object from outsourcing to every third-party arrangement that supports a function on a recurrent or ongoing basis, keep outsourcing as a subset of it, and leave ICT services to DORA. The full regime of enhanced due diligence, mandatory contract terms, subcontracting controls, audit rights and a tested exit plan applies to arrangements that support critical or important functions; everything else is managed proportionately. The application date, the end of the two-year transition and the date the 2019 Guidelines are repealed are still to be confirmed by the EBA: the final report prints all three as placeholders.

What are the EBA third-party risk guidelines?

They are guidelines issued under Article 16 of the EBA Regulation, Regulation (EU) No 1093/2010, which means they work on a comply or explain basis. Competent authorities and financial institutions "must make every effort to comply" (paragraph 1), and each competent authority must tell the EBA whether it complies or intends to comply, or explain why it does not (paragraph 3). In practice, a national supervisor folds the Guidelines into its supervisory expectations and reviews firms against them.

The legal hook is Article 74 of the Capital Requirements Directive, which requires institutions to have robust governance and to manage all their risks, with Article 11 of PSD2, Article 26 of the Investment Firms Directive, Article 16 of MiFID II and Article 34 of MiCAR taken into account for the other addressees. The EBA consulted on a draft, EBA/CP/2025/12, from 8 July to 8 October 2025, received 72 responses, and published the final report on 18 September 2026. Its stated aim is one holistic third-party framework: DORA for ICT services, these Guidelines for everything else, with the definitions, the register and the policy aligned so that a firm can run the two as one programme.

The text has 128 paragraphs. Paragraphs 18 to 22 deal with implementation, Titles I to IV (paragraphs 23 to 116) tell firms what to do, and Title V (paragraphs 117 to 128) tells supervisors how to review it, including how to spot concentration on the same providers across firms.

When do the EBA third-party risk guidelines apply?

Nobody can give you the date yet. Paragraph 18 says the Guidelines apply "from [date]" to all third-party arrangements entered into, reviewed or amended on or after that date. On 19 October 2026 the EBA's own publication page listed the Guidelines as "final and awaiting translation into the EU official languages", the final report as "not yet applicable", and left the application date and the compliance deadline blank. The press release of 18 September 2026 confirms only that "a two-year transitional period will support a smooth and proportionate implementation". Until the date arrives, the 2019 outsourcing Guidelines remain the applicable EBA text.

Read paragraph 20 carefully. The two years are a window to finish the review of critical arrangements, and the duty that bites at the end of the window is a notification: a firm that cannot re-paper a critical contract in time is expected to tell its supervisor, with the measures it plans or its possible exit strategy. Knowing early which contracts will not make it lets you open that conversation on your own terms.

Who has to comply with the EBA third-party risk guidelines?

Paragraph 9 lists the firms the Guidelines address, and paragraphs 13 to 15 say at which level each applies them. The comparison with 2019 matters, because one widely read summary gets it wrong: payment and e-money institutions were already addressees of the 2019 Guidelines and simply stay in scope.

Outside the list: small and non-interconnected investment firms, account information service providers registered only for that service (paragraph 11), and credit intermediaries. The EBA's consultation feedback adds two clarifications. Central securities depositories are outside the scope. UCITS management companies and AIFMs are not addressees either; where they sit in a banking or investment-firm group, the Guidelines reach them through consolidated and sub-consolidated application under Article 109(2) CRD. Insurers are outside the addressee list altogether; their outsourcing rules come from Solvency II, covered below.

Which arrangements do the Guidelines cover?

A third-party arrangement is "an arrangement of any form between a financial entity and a third-party service provider, including intragroup third-party service providers, for the support of one or more functions to the financial entity on a recurrent basis or an ongoing basis" (paragraph 17). Outsourcing, where the provider performs a function the firm would otherwise undertake itself, is expressly a subset. A function is "any process, service or activity, or part of it". Your provider's own arrangements with its suppliers count as subcontracting (footnote 34).

Paragraph 31 turns the definition into three questions for every supplier relationship: is the service non-ICT, does the provider support a function at least on a recurrent or ongoing basis, and is that function critical or important? Paragraph 32 adds two rules. Where one arrangement covers several functions, assess them together. Where a non-ICT service also involves an ICT service, the firm decides whether the ICT element is material to the service, and if it is, DORA applies. The EBA's feedback points firms to two of the European Supervisory Authorities' DORA questions and answers for that call: DORA030 on what counts as an ICT service and DORA095 on non-ICT arrangements whose ICT support comes from subcontractors.

Paragraph 33 then excludes, "as a general principle", the following services. Footnote 41 adds that excluded services still have to be risk managed.

What changes from the 2019 outsourcing guidelines?

Much of the method survives: criticality drives the effort, the management body keeps the responsibility, and the life cycle runs from pre-contract analysis to exit. What moves is the perimeter, the level of detail and the alignment with DORA. The table compares the two texts paragraph by paragraph.

What changed between the July 2025 draft and the final text?

If your team built its gap analysis on the consultation draft, six points are now lighter or different. The EBA's summary of the consultation says the Guidelines were "reviewed to provide more proportionality", with more clarity on scope, the focus on critical or important functions and the alignment with DORA.

How do you decide whether a function is critical or important?

Everything stricter in the Guidelines keys off this one classification. A critical or important function is one "the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law" (paragraph 17). That is the DORA Article 3(22) definition, word for word in substance, so one methodology can serve both regimes. The EBA notes that it differs from the resolution concept of "critical functions" in BRRD but encompasses it.

Record the criteria, the outcome, the reasons and the date. The register needs the yes or no answer with a brief summary of reasons for every arrangement (paragraph 61(f)), and paragraph 110 requires a fresh assessment whenever the risk, nature or scale of a function changes materially. Supervisors will test the classification before anything else: a wrong "no" removes an arrangement from every enhanced duty.

What must the management body do?

The opening principle of Title III is that using a provider "cannot result in the delegation of the management body's responsibilities" (paragraph 41). The table lists the duties a reviewer will look for, with the evidence that usually answers them.

What must the third-party risk policy cover?

Paragraph 47 requires a written policy on the use of non-ICT services supporting critical or important functions, approved by the management body, reviewed "at least once a year" and updated where relevant, with changes carried into the affected contracts "in a timely manner and as soon as it is possible". Paragraph 48 says what it covers, phase by phase: the management body's involvement; the roles of business lines and control functions; the senior manager responsible and the reporting lines; planning (scoping, business requirements, criticality criteria, risk assessment, due diligence, conflicts of interest, business continuity and the approval process); implementation and monitoring, including how the firm is told about changes at a provider; documentation; and exit strategies with a documented exit plan for every critical function.

Paragraph 49 lets you merge the policy with the one DORA requires under Article 28(10), on one condition: the merged policy must still separate ICT from non-ICT services, authorised from unauthorised providers, intragroup from external arrangements, and providers in a Member State from those in third countries. Paragraph 50 then asks the policy to weigh four impacts in every decision: the risk profile, the ability to oversee the provider, business continuity and business performance.

What has to happen before you sign?

Paragraph 68 sets a five-step gate. Before entering any third-party arrangement, a firm should assess whether it concerns a critical or important function, check the supervisory conditions for contracting, identify and assess the risks, perform due diligence on the provider, and identify the conflicts of interest it may cause. Record each step and the approval: the 2019 register asked for the approver, and the Central Bank of Ireland's template still does.

Supervisory conditions

Where the provider will perform banking activities, payment services, ART issuance or investment services to an extent that needs authorisation, it must itself be authorised or registered, or otherwise allowed to do it under national law (paragraph 69). A provider in a third country must also be authorised and supervised there, under a cooperation agreement between the two supervisors that gives your authority information, access to data, documents, premises and staff, and enforcement cooperation (paragraph 70).

Risk assessment

Paragraphs 71 to 76 ask for an assessment of operational, reputational, legal and entity-level concentration risk, including the impact on your ability to manage risks and comply with the law, the impact on clients, the risk of scaling up without revising the contract, substitutability and the time and cost of a transfer, reintegration, and data protection. Include scenarios of possible risk events, including high-severity ones. Weigh concentration on one provider or closely connected providers, the aggregated use of providers across the firm and, for significant institutions, step-in risk (paragraph 74). Assess the subcontracting chain (paragraph 75) and the political, legal and insolvency risks of every country involved (paragraph 76).

Due diligence

Paragraphs 77 to 82 set the depth by criticality. Every provider gets a check of its business model, financial soundness, ownership and group structure, capability and track record, and supervision status. Providers of critical functions get more: reputation and capacity, internal controls, the management of their own supply chain and geographic dependencies, business continuity and disaster recovery plans, any authorisation they need, and arrangements that make onsite audits by you and your supervisor possible (paragraphs 79 and 80). Add the provider's data protection measures (paragraph 81) and, for providers in third countries, their conduct on ethics, human rights and the environment (paragraph 82).

The supervisory record shows why the gate matters. When the ECB analysed the outsourcing registers of the banks it supervises, its February 2024 newsletter reported that more than 10% of contracts covering critical functions were not compliant with the relevant regulations, and that over the previous three years 20% of those contracts had not had a proper risk assessment and 60% had not been audited. For the assessment method itself, see our guide on how to perform a third-party risk assessment.

What must the contract contain?

Rights and obligations go in a written contract (paragraph 83). Paragraph 84 is new in one important respect: its minimum list applies to every third-party arrangement, critical or not. Paragraph 85 adds the terms for arrangements supporting critical or important functions.

Four more clauses sit elsewhere in the text. Paragraph 86 requires the provider to protect confidential and personal data and to respect banking secrecy where it applies. Paragraphs 96 and 97 require internal audit access and, for CRD institutions in every contract regardless of criticality, a reference to the information and investigatory powers in BRRD Article 63(1)(a) and CRD Article 65(3). Paragraph 108 lists the situations in which you must be able to terminate: a significant breach of law or contract, circumstances found in monitoring that could alter the service, material changes such as new subcontractors, evidenced weaknesses in risk management or data security, and a supervisor that can no longer supervise you effectively because of the arrangement. Paragraph 109 asks critical contracts to set out the provider's duties on transfer, an appropriate transition period after termination, and its support for an orderly handover.

How do the subcontracting rules work?

For arrangements supporting critical or important functions, the contract must say whether subcontracting of the function, or material parts of it, is allowed and on what conditions (paragraph 87). The firm should keep a holistic view of the chain and focus on the subcontractors that "effectively underpin" the service, and record those in the register (paragraph 88). Where subcontracting is allowed, the contract must cover the points in paragraph 89: excluded activities, conditions, the provider's duty to manage location risks and to monitor its subcontractors, reporting, flow-down of monitoring and reporting duties, continuity across the chain if a subcontractor fails, the same access and audit rights for you and your authorities, and timely implementation of contract changes by the subcontractor.

Then comes the procedure. The provider notifies new subcontracting or material changes "well in time" (paragraph 90). The contract sets a reasonable notice period in which you approve or object (paragraph 91). The provider may proceed only after you approve or the period ends without objection (paragraph 92). Where the change exceeds your risk tolerance, you inform the provider, object and request modifications before the period ends (paragraph 93). The contract must let the provider's subcontract be terminated if the provider goes ahead despite your objection, acts before the notice period ends without your approval, or subcontracts a critical service the contract does not permit (paragraph 95).

Silence counts as consent at the end of the notice period, so the practical control is an intake route: provider notices must reach the risk owner on the day they arrive, with the deadline in front of them.

What access and audit rights do you need?

For critical or important functions, the provider must give you, your competent and resolution authorities and anyone they appoint access to all relevant premises, the right to take copies of relevant documents, and unrestricted rights of inspection and audit (paragraph 98). For other arrangements, you decide on a risk-based approach whether to include the same rights, bearing in mind that functions can become critical over time (paragraph 99). No contract may impede those rights (paragraph 100), and you must actually use them, setting audit frequency and areas on a risk-based approach (paragraph 101).

Pooled audits and the provider's certifications or audit reports are allowed (paragraph 102), but for critical functions you must check they are adequate and you must not rely on them alone over time (paragraph 103). Paragraph 104 sets eight conditions for relying on a certification or report:

Give the provider reasonable notice before an onsite visit unless an emergency or the audit's effectiveness rules it out (paragraph 105), protect other clients in shared environments (paragraph 106), and make sure whoever audits a complex arrangement has the skills to do it (paragraph 107). Questionnaires are a first filter; our guide to vendor security questionnaires shows how to make the answers usable as evidence.

What must the register contain?

Paragraph 58 requires an up-to-date register of every third-party arrangement in scope, at individual and, where relevant, sub-consolidated and consolidated level, that distinguishes critical arrangements from the rest. Where a non-ICT provider of a critical function relies on ICT subcontractors that effectively underpin the service, those go in too. Ended arrangements stay in the register with their documents for an appropriate period (paragraph 59), and groups may keep it centrally (paragraph 60).

Paragraph 61 asks for consistency with the DORA register of information "to the extent possible", encourages firms to avoid discrepancies between the two, and gives them "the possibility to combine both in one single register". The register goes to the competent authority on request, in a processable electronic form that may follow the DORA format (paragraph 63). There is no periodic EU-level return for the non-ICT register, although national supervisors may collect it: the Central Bank of Ireland does, and in February 2024 the ECB reported that it had collected the outsourcing registers of all the banks it supervises every year since 2022.

Nine fields the 2019 register required are not in this minimum: notice periods, the data outsourced and the personal data flag, the data location, cloud service and deployment models, the date of the last criticality assessment, the date and summary of the last risk assessment, the approver, the next scheduled audit and the time-critical flag. The lists say "at least", so you may keep them, and firms regulated in Ireland will need them for the Central Bank's template. Our field-by-field guide to the EBA outsourcing register maps every field to the Central Bank template and the DORA templates, with a fill-in version.

The same ECB newsletter shows what supervisors read in these registers: more than 30% of the significant banks' outsourcing budget sat with ten providers, 73 significant banks used critical services provided from outside the EU, and among contracts covering critical functions about 50% concerned time-critical activities, around 20% could not be reintegrated and around 5% could not be substituted.

When do you have to tell the supervisor?

Two duties run all the time, and a third applies once at the end of the transition.

The EBA text sets no number of days, so national practice decides what "timely" means. For payment and e-money institutions, paragraph 65 also serves the outsourcing notification in Article 19(6) of PSD2. Where the same event is an ICT incident, DORA's incident clock runs separately; this notification is about the arrangement. In Ireland, the Central Bank expects notifications before commencement and early enough for supervisory consideration, and for insurers at least six weeks ahead, as the Irish section below explains.

What does ongoing monitoring involve?

Paragraph 110 asks for risk-based monitoring of all providers and ongoing monitoring of critical arrangements, regular updates to each risk assessment, a periodic report to the management body on the risks in critical arrangements, and a fresh criticality assessment whenever a function changes materially. Paragraph 111 adds concentration: monitor and manage the internal concentration your arrangements create, including through subcontractors.

For critical arrangements, paragraph 112 lists the tools: reports from the provider, key performance and key control indicators, service delivery reports, self-certifications, independent reviews and the provider's business continuity test results. Where you find a shortcoming, paragraph 113 requires corrective or remedial action, or termination. Write the review cycle into the policy and keep the dated record of each review; the Guidelines leave the frequency to you, and a quarterly service review is a sensible default for critical providers.

What must an exit strategy cover?

Every service supporting a critical or important function needs a documented exit strategy, aligned with the third-party strategy and the business continuity plans, that covers at least six possibilities (paragraph 114): termination of the arrangement; failure of the provider; concentration and the possibility of a difficult exit; deterioration of the service and the disruption it causes; material risks to the continuous performance of the function; and a significant breach of law, regulation or contract by the provider.

Paragraph 115 asks for exit plans that are realistic, feasible and based on plausible scenarios, comprehensive, documented and, where appropriate, sufficiently tested, for example through an analysis of the costs, impacts, resources and timing of moving the service. You need identified alternatives and a transition plan that gets functions and data out to another provider or back in-house. Paragraph 116 sets the design: link the plan to the risk assessment and its scenarios, define the objectives, assign roles and resources, define success criteria for moving the service and the data, and define the monitoring indicators, including unacceptable service levels, that trigger the exit.

How do the EBA Guidelines fit with DORA?

They are written as two halves of one framework, and the EBA aligned the vocabulary on purpose. DORA governs ICT services provided by third parties for all financial entities, through Chapter V; the Guidelines govern the non-ICT services of the firms they address. The table shows where the two meet.

The shared vocabulary lets you run one register, one policy, one accountable role and one criticality method. The evidence still belongs to the arrangement: a DORA assessment of a cloud provider says nothing about a cash-in-transit firm or an outsourced collections team. Where one provider delivers a separate ICT service and a separate non-ICT service, often under one master agreement, the same provider due diligence or financial review can be attached to the DORA requirement and to the EBA requirement. Our guides to the DORA requirements and the register of information templates cover the ICT side.

Do the EBA third-party risk guidelines apply to insurers?

No. Insurance and reinsurance undertakings are not in the addressee list in paragraph 9. Their outsourcing rules come from Article 49 of the Solvency II Directive, which keeps the undertaking "fully responsible", bars outsourcing of critical or important functions that would materially impair the system of governance, unduly increase operational risk, impair supervision or undermine service to policyholders, and requires the supervisor to be notified "in a timely manner" before such outsourcing. Article 274 of Delegated Regulation (EU) 2015/35 adds the policy and the contract terms, covered in our guide to Solvency II governance requirements, and DORA governs insurers' ICT providers, as our guide to DORA for insurers explains.

In Ireland, the Central Bank's notification guidance for (re)insurers expects the notice at least six weeks before a critical or important outsourcing takes effect, and confirms that supervisory pre-approval is not required. Insurers are also one of the sectors the Central Bank's proposed third-party guidance is written for, because their sectoral rules carry only high-level duties.

What changes for firms regulated in Ireland?

Irish firms have a domestic layer on top of the EBA text. The Central Bank's Cross-Industry Guidance on Outsourcing of December 2021 still applies to every regulated firm that outsources, proportionately, as a statement of good practice. On 8 October 2026 the Central Bank published Consultation Paper CP173 with draft Guidance on Good Practices for the Sound Management of Third-Party Risks, which would replace the 2021 Guidance. The consultation closes on 3 December 2026, the Central Bank anticipates publishing the final guidance in Q1 2027, and the 2021 Guidance is withdrawn when it does.

CP173 says that a credit institution or payment institution complying with DORA for ICT and with the EBA Guidelines for the rest "may find that this Guidance provides only limited additional insight". The register return is a separate matter and does not change: firms with a PRISM impact rating of Medium Low or above that filed in the 2024 cycle submit the Central Bank's template by 28 February 2027, for a reference date of 31 December 2026. Our guide to Central Bank of Ireland outsourcing guidance covers the notification items, the return and what CP173 would change.

What should you do before the application date?

The date is unknown, the transition is two years, and contract renegotiation is the slow part. Front-load the work that decides everything else.

What the other results get wrong

We read the pages that rank for this query, from law firms, consultancies and software vendors, against the final report. Six points are wrong or out of date.

The first is scope. A consultancy briefing dated March 2026, still on page one, says the new Guidelines extend the 2019 scope to payment and electronic money institutions. Both were addressees in 2019: paragraph 7 of EBA/GL/2019/02 names institutions, payment institutions and electronic money institutions, and the EBA's impact assessment counts them among the initial addressees. The firms the EBA itself calls new are Class 1 minus and Class 2 investment firms and ART issuers, with mortgage creditors, third-country branches and holding companies now named in paragraph 9.

The second is the register. A law-firm note from October 2026 says firms must keep a register covering "both the non-ICT third-party arrangements and those required under DORA". Paragraph 61 asks for a non-ICT register consistent with the DORA one and gives firms "the possibility to combine both in one single register". Combining is the firm's choice.

The third is the perimeter. A consulting firm's blog from September 2026 says relationships that were "one-off engagements" are now caught. The definition in paragraph 17 covers support "on a recurrent basis or an ongoing basis", and paragraph 31(b) makes recurrence one of the three scoping questions. A genuine one-off engagement stays outside.

The fourth is subcontracting. A software vendor's comparison table says the 2019 sub-outsourcing rules were principle-based and that notice, objection and termination triggers are new. Paragraph 78(e) to (g) of the 2019 Guidelines already required notice of planned sub-outsourcing, a right to object where appropriate and a right to terminate for undue sub-outsourcing. The new elements are the standstill in paragraph 92, a reasonable notice period in every critical contract, termination rights written into the provider's own subcontract (paragraph 95) and the register entry for underpinning subcontractors (paragraph 88).

The fifth is draft text presented as final. A payments law page from October 2025, written about the consultation draft and still ranking, says ended arrangements stay in the register for up to five years and that services are categorised against an annex of the Guidelines. The final text says "for an appropriate period" (paragraph 59) and leaves the categories to the firm (paragraph 61(g)). A law-firm page from February 2026 says the final version "is expected by April 2026"; it was published on 18 September 2026.

The sixth is an omission everywhere. Every page we reviewed lists what the new register adds; none lists the nine 2019 fields that are no longer in the EBA minimum. That gap matters most in Ireland, where the Central Bank's template, and the register in its draft CP173 guidance, still ask for all nine.

Where do you stand?

Answer these for your firm. A blank row is a gap, and the paragraph tells you where to start.

How do you keep this programme in one place?

Most outsourcing programmes run on a register spreadsheet, a contract folder, a calendar of reminders and a long chain of emails with business owners. In Venvera the work sits in one dashboard. The Outsourcing (EBA) framework carries 72 requirements, 53 from EBA/GL/2026/09 and 19 from the Central Bank of Ireland's guidance, each with an owner, a status and the evidence that answers it. A 39-question gap assessment across eight areas gives you a starting score. Twelve recurring obligations, from the annual policy review to the quarterly performance review of critical providers and the exit plan test, sit on the compliance calendar with owners and due dates. Nine policy templates, including the critical or important function methodology, the contract minimum terms standard and the exit plan template, give you a first draft to adapt. Firms outside Ireland mark the Central Bank requirements not applicable with one recorded reason.

Providers sit in the vendor register you already keep for DORA, and the requirements tell you which further fields the Guidelines expect for non-ICT arrangements. Venvera manages the programme and its evidence; negotiating contracts, reviewing a provider's accounts and sending notifications stay with your team, recorded against the requirement each one answers.

Start with a free compliance check for a baseline, see the plans, or start a 14-day Professional trial with no credit card. If you would rather see the register, calendar and gap assessment on your own suppliers, book a demo.

Frequently asked questions

What is EBA/GL/2026/09?

It is the reference of the EBA Guidelines on the sound management of third-party risk regarding non-ICT services, published as a final report on 18 September 2026. They set how banks, investment firms, payment and e-money institutions, ART issuers and some mortgage creditors manage third-party arrangements that are not ICT services, with the strictest rules for those supporting critical or important functions.

When do the EBA third-party risk guidelines apply?

The date has not been set. The final report prints it as a placeholder, and on 19 October 2026 the EBA listed the Guidelines as final and awaiting translation, with no application date. Once it is set, new, reviewed or amended arrangements must comply from that date, and existing critical or important arrangements have two years to be reviewed and documented.

Do the new guidelines replace the 2019 outsourcing guidelines?

Yes. Paragraph 22 repeals EBA/GL/2019/02 with effect from a date that is also still to be confirmed. Until then the 2019 Guidelines remain the applicable EBA text, including their register and notification rules.

Are EBA guidelines legally binding?

They are issued under Article 16 of the EBA Regulation and work on a comply or explain basis. Firms and competent authorities must make every effort to comply, and each authority tells the EBA whether it complies or intends to. In practice supervisors adopt them as their expectations and review firms against them.

Do the guidelines cover ICT and cloud services?

No. ICT services provided by third parties are governed by DORA, so they are excluded (paragraphs 5 and 7). Where a non-ICT service relies on an ICT element that is material to it, the firm decides whether DORA applies (paragraph 32). Cloud services, covered by the 2019 Guidelines, now sit under DORA.

What counts as a third-party arrangement?

Any arrangement, including with a group company, under which a provider supports one or more of your functions on a recurrent or ongoing basis (paragraph 17). Outsourcing is a subset. One-off purchases, goods, utilities and the services listed in paragraph 33 are outside.

Is outsourcing still a separate concept?

It remains defined, as a provider performing a function you would otherwise perform yourself, but it no longer decides whether the Guidelines apply. The trigger is now any recurrent or ongoing support of a function, and the effort follows the criticality of that function.

What is a critical or important function?

A function whose disruption would materially impair your financial performance, the soundness or continuity of your services, or your compliance with your authorisation and financial services law. The definition matches DORA Article 3(22). Operational tasks of internal control functions count unless your assessment shows otherwise (paragraph 35), and banking, payment or ART activities that need authorisation are automatically critical or important (paragraph 36).

Do payment and e-money institutions have to comply?

Yes, on an individual basis (paragraph 14), as they did under the 2019 Guidelines. Paragraph 65 also serves their outsourcing notification under Article 19(6) of PSD2. Account information service providers registered only for that service are excluded (paragraph 11).

Do the guidelines apply to insurers?

No. Insurers follow Article 49 of Solvency II and Article 274 of Delegated Regulation (EU) 2015/35 for outsourcing, and DORA for ICT providers. In Ireland the Central Bank expects notice of a critical or important outsourcing at least six weeks before it takes effect.

Do they apply to UCITS management companies and AIFMs?

They are not addressees. Where they belong to a banking or investment-firm group, the EBA says the Guidelines reach them through consolidated and sub-consolidated application under Article 109(2) CRD, without prejudice to the UCITS and AIFMD delegation rules.

Are intragroup arrangements covered?

Yes. The definition includes intragroup providers, the management body keeps full responsibility for them (paragraph 27), and services supporting critical functions must be priced objectively, with the provider viable on a stand-alone basis (paragraph 53).

Is a market data service in scope?

Market information services are excluded by paragraph 33, an exclusion the EBA added after the consultation. Record the exclusion and the reasoning; footnote 41 reminds firms that excluded services still need appropriate risk management.

Can we combine the register with the DORA register of information?

Yes. Paragraph 61 asks for consistency with the DORA register to the extent possible and gives firms the possibility to combine both in one register. Keeping them separate is also allowed, as long as they do not contradict each other.

Do non-critical arrangements need contract clauses?

Yes. Paragraph 84 sets a minimum list for every third-party arrangement, including the service description, locations, governing law, data provisions, service levels, cooperation with authorities and termination rights. Paragraph 85 adds the further terms for critical or important functions.

How long is the transition period?

Two years from the application date for reviewing and documenting existing arrangements that support critical or important functions (paragraph 20). Other existing arrangements can be reviewed and documented when they are next renewed (paragraph 21).

What if we cannot finish re-papering critical contracts in time?

Inform your competent authority before the end of the two years, with the measures you plan to complete the review or your possible exit strategy (paragraph 20). Identify those contracts early so the notice is a plan.

Do we have to notify the supervisor before signing?

For a critical or important function, yes: paragraph 65 requires timely information about any planned arrangement, with at least the register fields, and the same when a function already provided by a third party becomes critical or important. The EBA text sets no number of days.

Can we rely on a provider's certifications or audit reports?

For critical functions, only under the eight conditions in paragraph 104, including scope, currency, the auditor's standing and a test of operating effectiveness, and never solely over time (paragraph 103). You keep the contractual right to audit the provider yourself.

How often must the third-party risk policy be reviewed?

At least once a year, by the management body, with changes implemented in the affected contracts in a timely manner (paragraph 47). The 2019 Guidelines only said regularly.

What about providers outside the EU?

Paragraph 70 requires a licensable function provided from a third country to come from a provider authorised and supervised there, under a cooperation agreement between the supervisors. Paragraphs 76 and 86 add country risk analysis and contractual protection of data and banking secrecy.

Primary sources

Paragraph numbers are those of the EBA final report on the Guidelines on the sound management of third-party risk related to non-ICT services, EBA/GL/2026/09 (18 September 2026). Status and dates are from the EBA press release of 18 September 2026 and the EBA publication page, checked on 19 October 2026. Comparisons use EBA/GL/2019/02 and the consultation paper EBA/CP/2025/12. DORA references are to Regulation (EU) 2022/2554 and Implementing Regulation (EU) 2024/2956; insurance references to Article 49 of Directive 2009/138/EC and the Central Bank's Solvency II outsourcing notification guidance. Irish material is from the Cross-Industry Guidance on Outsourcing, Consultation Paper CP173 and the outsourcing register submission page. Supervisory statistics are from the ECB Supervision Newsletter of 21 February 2024. Requirements are summarised; read the full text before relying on a specific paragraph.