Learn
If you own the outsourcing register at a bank, payment or e-money institution or investment firm, this guide gives you the exact field list the EBA's 2026 third-party risk guidelines require, which fields are new, which ones the EBA minimum no longer lists but the Central Bank of Ireland still asks for, and how the register sits beside your DORA register of information. It ends with a template you can copy into a spreadsheet and fill in for one arrangement, with the EBA paragraph and the Central Bank template column for every field.
The short answer: paragraphs 58 to 64 of EBA/GL/2026/09 require an up-to-date register of every third-party arrangement for non-ICT services, at individual and, where relevant, consolidated level. Nine items are required for every arrangement (paragraph 61) and eight more for arrangements supporting critical or important functions (paragraph 62). The register should be consistent with the DORA register of information and may be combined with it; it goes to the supervisor on request, in a processable electronic form. Until the EBA confirms the application date, the 2019 register in EBA/GL/2019/02 remains the applicable EBA standard.
| Question | Answer | Paragraph |
|---|---|---|
| Which arrangements go in? | Every third-party arrangement in scope of the Guidelines, critical or not, plus ICT subcontractors that effectively underpin a non-ICT service supporting a critical function | 58 |
| What about ended arrangements? | They stay in the register, with their documents, for an appropriate period | 59 |
| Can a group keep one register? | Yes, centrally at the highest level of consolidation, as long as each entity can obtain its own register without undue delay | 60, 28(d) |
| Must it match the DORA register? | It should be consistent to the extent possible, and the two may be combined | 61 |
| Who receives it? | The competent authority, on request, in full or by section | 63 |
What must the outsourcing register contain under EBA/GL/2026/09?
The table lists every field in paragraphs 61 and 62, with the DORA register of information template that carries the equivalent data point for ICT arrangements. The DORA template codes come from Implementing Regulation (EU) 2024/2956, which sets 15 templates from B_01.01 to B_99.01.
| Field | Applies to | Paragraph | DORA template with the equivalent |
|---|---|---|---|
| Reference number and type of arrangement: standalone, overarching, or subsequent or associated (with the overarching reference) | Every arrangement | 61(a) | B_02.01 |
| Start date, next renewal date, end date and the reason for ending | Every arrangement | 61(b) | B_02.02 |
| Entities in the prudential consolidation or IPS that use the provider | Every arrangement, where applicable | 61(c) | B_04.01 |
| Whether the provider or subcontractor is part of the group or IPS | Every arrangement | 61(d) | B_02.03 |
| Brief description of the functions provided | Every arrangement | 61(e) | B_06.01 |
| Critical or important, yes or no, with a brief summary of the reasons | Every arrangement | 61(f) | B_06.01 |
| A category per function, from your own internal categorisation | Every arrangement | 61(g) | B_06.01 |
| Provider name, LEI or EUID or another identifier, registration number, registered address, contacts, ultimate parent and its identifier | Every arrangement | 61(h) | B_05.01 |
| Countries where a critical or important function is performed | Arrangements supporting such a function | 61(i) | B_02.02 |
| Governing law | Critical or important | 62(a) | B_02.02 |
| Dates of the most recent audits | Critical or important | 62(b) | B_07.01 |
| Subcontractors of material parts: name, country of registration, identifier, type of function, rank in the chain, location of performance | Critical or important | 62(c) | B_05.02 |
| Substitutability outcome and date: easy, medium, highly complex or impossible | Critical or important | 62(d) | B_07.01 |
| Summary and date of the reintegration or discontinuation assessment, with the function's recovery time and recovery point objectives | Critical or important | 62(e) | B_06.01, B_07.01 |
| Exit plan exists, yes or no | Critical or important | 62(f) | B_07.01 |
| Alternative providers, where possible | Critical or important | 62(g) | B_07.01 |
| Estimated annual budget cost for the past year, with the currency | Critical or important | 62(h) | B_02.01 |
Two scope points are easy to miss. Where a non-ICT provider of a critical function uses ICT subcontractors that effectively underpin the service, record them in this register (paragraph 58). And the country field in paragraph 61(i) is limited to critical or important functions, where the 2019 register asked for the country of every outsourced service.
Which fields are new, and which are no longer in the EBA minimum?
The 2026 register borrows its new fields from the DORA templates. It also leaves out nine fields that the 2019 Guidelines required. The minimum lists in paragraphs 61 and 62 say "at least", so you may keep those nine, and in Ireland you will need them.
| Change | Fields | 2019 reference |
|---|---|---|
| New in 2026 | Type of contractual arrangement; reason for ending; LEI or EUID and the ultimate parent's identifier; subcontractor identifier, type of function and rank in the chain; four-point substitutability scale with a date; reintegration summary with date, recovery time objective and recovery point objective; exit plan flag; past-year cost with currency; ICT subcontractors underpinning non-ICT critical services | No equivalent |
| Moved to every arrangement | Group entities using the provider; intragroup flag | Paragraph 55(a) and (b), critical only |
| Narrowed | Countries of performance, now only for critical or important functions | Paragraph 54(f), every arrangement |
| No longer in the EBA minimum | Notice periods; data outsourced and the personal data flag; data location; cloud service and deployment models; date of the last criticality assessment; date and summary of the last risk assessment; approving individual or body; next scheduled audit; time-critical flag | Paragraphs 54(b), (c), (f), (h), (i) and 55(c), (d), (f), (j) |
Cloud fields went because cloud is an ICT service and now sits in the DORA register. The others were simply not carried over. Keep them anyway if you use them to run the programme: notice periods drive renegotiation, the time-critical flag drives continuity testing, and the approver is the first thing an internal auditor asks for.
How does it differ from the DORA register of information?
The two registers share a data model and diverge on reach and reporting.
| Topic | DORA register of information | EBA non-ICT register |
|---|---|---|
| Legal basis | Article 28(3) of Regulation (EU) 2022/2554 | Paragraphs 58 to 64 of EBA/GL/2026/09 |
| Arrangements | All contractual arrangements for ICT services | All third-party arrangements for non-ICT services in scope |
| Format | Prescribed: 15 templates in Implementing Regulation (EU) 2024/2956 | A processable electronic form; the DORA format may be used |
| Reporting | At least yearly reporting to the competent authority, and the full register on request | On request, in full or by section |
| Substitutability | Not substitutable, highly complex, medium complexity or easily substitutable | Easy, medium, highly complex or impossible |
| Reintegration | Easy, difficult or highly complex | A summary and date, with the recovery objectives |
| Combining | Not addressed | Allowed; discrepancies to be avoided |
If you combine them, add a service-type flag, ICT or non-ICT, to every arrangement, and keep one criticality methodology for both. Keep the evidence per arrangement: the assessment behind a cloud contract does not speak for an outsourced collections team. Our guides to the 15 DORA templates, to building a DORA vendor register and to why registers of information get rejected cover the ICT side.
Who actually collects the register?
At EU level the non-ICT register is produced on request. National supervisors decide whether to collect it, and two do so on a cycle.
| Collector | Who files | When | Basis |
|---|---|---|---|
| Your competent authority | Every firm in scope | On request | Paragraph 63 of EBA/GL/2026/09 |
| ECB Banking Supervision | The banks it supervises | Every year since 2022, as the ECB reported in February 2024, on the 2019 Guidelines' fields | ECB Supervision Newsletter, 21 February 2024 |
| Central Bank of Ireland | Firms with a PRISM impact rating of Medium Low or above; in the next cycle, those that filed in 2024 | Next deadline 28 February 2027, reference date 31 December 2026 | Cross-Industry Guidance Part B s. 10.2; submission page |
| DORA register of information | All DORA financial entities, for ICT arrangements | At least yearly reporting under Article 28(3) | Regulation (EU) 2022/2554 |
The Central Bank's February 2027 collection uses the same template as before. Firms that also file the DORA register "may either leave in, or remove data which has already been submitted" in it; the Central Bank says it is "not seeking to collect DORA ROI information twice".
What do supervisors find in outsourcing registers?
The ECB's February 2024 newsletter is the clearest published read-out. From the registers of the banks it supervises it found that:
- more than 30% of the significant banks' total outsourcing budget was concentrated on ten providers, most headquartered outside the EU;
- 73 significant institutions used critical services provided from non-EU countries, and about 22% of outsourced critical and extra-group services were provided from outside the EU;
- 70% of outsourcing contracts involved the processing of personal data;
- of contracts covering critical functions, about 50% concerned time-critical activities, around 20% could not be reintegrated and around 5% could not be substituted;
- more than 10% of contracts covering critical functions were not compliant with the relevant regulations, and over the previous three years 20% of those had no proper risk assessment and 60% had not been audited.
Every one of those findings was read straight from register fields: budget, location, personal data, time-criticality, reintegration and substitutability. That is why accuracy in the register gets tested before anything else.
How should substitutability be recorded?
Substitutability is the field where scales differ most. The 2019 Guidelines used three values: easy, difficult or impossible. The 2026 Guidelines use four: easy, medium, highly complex or impossible, with the date of the assessment (paragraph 62(d)). The DORA templates use four values worded differently, from not substitutable to easily substitutable. The Central Bank of Ireland template, column 470, accepts only "Easy", "Difficult" or "Impossible", and its validation is case-sensitive. The register in the Central Bank's draft CP173 guidance moves to the four-point DORA wording.
Record the four-point value with its date and reasoning as your master data, and keep a documented mapping for the Irish return while it still uses three values, for example medium and highly complex both reported as "Difficult". The mapping is your own choice, so write it into the register procedure.
Should you keep one register or two?
The EBA leaves it to you. One combined register means one provider record, one identifier, one criticality method and one reconciliation, and the DORA format is already built. Two registers can be simpler where ICT and non-ICT providers are managed by different teams, but you then have to prove they agree. Paragraph 61 asks you to avoid discrepancies either way, and the Central Bank's February 2027 return lets you leave DORA data in or take it out. Whichever you choose, write the decision and the reason into the register procedure so an auditor can see it was a choice.
What the other results get wrong
Page one for this query is mostly pages written for the 2019 Guidelines. Four points are wrong or out of date.
A software vendor's guide from September 2020, still ranking, lists the 2019 fields as the requirement, including cloud service models and data storage locations, and does not mention DORA. Under the 2026 Guidelines cloud is an ICT service, its fields belong in the DORA register, and the non-ICT minimum no longer lists them.
A law-firm note on the Central Bank's templates, from August 2022, says the deadline "from 2024 onwards will be end-February of each year". The Central Bank paused the domestic collection in 2025 while firms filed their first DORA registers, and resumes it with a deadline of 28 February 2027, limited in that cycle to firms that filed in 2024.
A payments law page from October 2025 says terminated arrangements must stay in the register for up to five years. That was the consultation draft, which said "at least 5 years". The final paragraph 59 says "for an appropriate period".
A law-firm note from October 2026 says the register must include "both the non-ICT third-party arrangements and those required under DORA". Paragraph 61 makes combining a possibility, and the duty is a non-ICT register consistent with the DORA one.
Outsourcing register template: fill it in for one arrangement
Copy this table into a spreadsheet, one row per field and one column per arrangement. "Not in the EBA minimum" marks the nine 2019 fields you may keep; the Central Bank column tells Irish firms where each one goes in the template. For a non-critical arrangement the Central Bank template expects columns 330 to 510 to be left blank.
| Field | EBA paragraph | Central Bank template column | Your entry |
|---|---|---|---|
| Reference number and type of arrangement | 61(a) | 010 | |
| Start, next renewal and end date, and reason for ending | 61(b) | 170, 180, 190 | |
| Notice periods for the firm and the provider | Not in the EBA minimum | 200, 210 | |
| Group entities using the provider | 61(c) | 050 to 070 | |
| Intragroup provider, yes or no | 61(d) | 130 | |
| Description of the function | 61(e) | 230 | |
| Data outsourced and personal data, yes or no | Not in the EBA minimum | 240 | |
| Critical or important, yes or no, and reasons | 61(f) | 270, 280 | |
| Category of the function | 61(g) | 220, 221 | |
| Provider name, identifier, registration number, address, contacts | 61(h) | 080 to 120 | |
| Ultimate parent and its identifier | 61(h) | 150, 160 | |
| Provider's regulator | Not in the EBA list | 140 | |
| Countries where a critical function is performed | 61(i) | 260 | |
| Data location | Not in the EBA minimum | 250 | |
| Date of the last criticality assessment | Not in the EBA minimum | 290 | |
| Governing law | 62(a) | 380 | |
| Date of the most recent audit | 62(b) | 390 | |
| Date of the next audit | Not in the EBA minimum | 400 | |
| Material subcontractors, with identifier, type, rank and location | 62(c) | 011, 420 to 460 | |
| Substitutability and date | 62(d) | 470 | |
| Reintegration or discontinuation summary, date, RTO and RPO | 62(e) | 480, 490 | |
| Exit plan exists, yes or no | 62(f) | No column; dates of exit tests in IE060, IE070 | |
| Alternative providers | 62(g) | 500 | |
| Estimated annual cost for the past year and currency | 62(h) | 340 | |
| Date and summary of the last risk assessment | Not in the EBA minimum | 350, 360 | |
| Approving individual or body | Not in the EBA minimum | 370 | |
| Time-critical, yes or no | Not in the EBA minimum | 510 |
How do you keep the register and its evidence in one place?
A register in a spreadsheet goes stale between returns, and the evidence behind each field (the criticality decision, the risk assessment, the exit plan, the last audit) lives in other folders and inboxes. In Venvera the provider record sits in the vendor register you already keep for DORA, and the Outsourcing (EBA) framework links the register duties in paragraphs 58 to 64 to their owners, tasks and evidence. The annual register reconciliation and, for Irish firms, the Central Bank return sit on the compliance calendar with a due date. Venvera manages the register and its evidence; the submission itself stays with your team through the Central Bank Portal.
For the full picture of the Guidelines, from scope to exit plans, read our guide to the EBA third-party risk guidelines, and for the Irish layer our guide to Central Bank of Ireland outsourcing guidance. A free compliance check gives you a baseline, and a demo shows the register on your own suppliers.
Frequently asked questions
What is an outsourcing register?
A record of a firm's arrangements with third-party providers, with the data a supervisor needs to see dependencies and concentration. Under the 2026 EBA Guidelines it covers every third-party arrangement for non-ICT services, with more fields for those supporting critical or important functions (paragraphs 58 to 62).
Is there an official EBA outsourcing register template?
No. The EBA sets the minimum content and lets firms supply it in a processable electronic form, which may follow the DORA register format (paragraph 63). National supervisors that collect registers publish their own templates, such as the Central Bank of Ireland's sector templates.
Do non-critical arrangements need to be in the register?
Yes. Every arrangement in scope goes in with the nine items in paragraph 61. The eight items in paragraph 62 are only required for arrangements supporting critical or important functions.
Can the outsourcing register and the DORA register of information be one register?
Yes. Paragraph 61 gives firms the possibility to combine both in one single register and asks them to avoid discrepancies if they keep two. Add a field that says whether each arrangement is ICT or non-ICT.
How long must ended arrangements stay in the register?
For an appropriate period, with the supporting documents (paragraph 59). The consultation draft had proposed at least five years; the final text sets no number, so define the period in your record-keeping policy.
Do intragroup arrangements go in the register?
Yes. The register covers intragroup providers, and paragraph 61(d) requires a flag for providers and subcontractors that belong to the group or IPS. Groups may keep the register centrally if each entity can obtain its own extract without undue delay.
Do we need to record our provider's subcontractors?
For critical or important functions, yes: the subcontractors to which material parts are subcontracted, with country, identifier, type of function, rank in the chain and location (paragraph 62(c)). ICT subcontractors that effectively underpin a non-ICT critical service also go in (paragraph 58).
When is the next Central Bank of Ireland register deadline?
28 February 2027, for a reference date of 31 December 2026, using the same template as previous collections. In that cycle it applies to firms that submitted in the 2024 cycle; the Central Bank said it would contact firms in scope in Q4 2026.
Does the ECB still collect outsourcing registers?
Its February 2024 newsletter says the ECB has collected the outsourcing registers of all the banks it supervises every year since 2022, based on the 2019 Guidelines. Check your joint supervisory team's current request, as the format follows the applicable EBA text.
Primary sources
Register fields are from paragraphs 58 to 64 of the EBA final report, EBA/GL/2026/09 (18 September 2026) and paragraphs 52 to 55 of EBA/GL/2019/02; the draft retention period from the consultation paper EBA/CP/2025/12. DORA template codes are from Implementing Regulation (EU) 2024/2956 and the reporting duty from Article 28(3) of Regulation (EU) 2022/2554. Central Bank of Ireland columns and validation rules are from its guidance note on the payments and e-money template, and the 2027 collection from its outsourcing register submission page, checked on 19 October 2026; the CP173 register from its draft guidance. Supervisory findings are from the ECB Supervision Newsletter of 21 February 2024.
