Third-party risk management: EBA finalises guidelines for non-ICT services

09 10月 2026

Quick read

The European Banking Authority (EBA) has published a final report containing its guidelines on the sound management of third-party risk regarding non-information and communication technology (non-ICT) services (Guidelines).

The Guidelines will replace the current EBA outsourcing guidelines, dated February 2019 (Outsourcing Guidelines). The scope of the Guidelines is broader than that of the Outsourcing Guidelines.

Purpose and content of the Guidelines

The Guidelines track the full lifecycle of third-party arrangements. They detail the internal governance arrangements and risk management framework for financial institutions to implement in respect of their use of third-party service providers (TPSPs) to provide non-ICT services supporting functions. There is a particular focus on non-ICT services that support critical or important functions. More extensive provisions apply in relation to these third-party arrangements, on the basis they have the potential to materially impact a firm’s risk profile. However, the EBA has made clear that firms must map all their third-party dependencies.

Under their risk management framework, firms will need to establish whether an arrangement with a TPSP (including outsourcing, subcontracting and intragroup arrangements) amounts to a third-party arrangement, as defined in the Guidelines. They must also determine whether the function to be supported by a TPSP is critical or important.

The Guidelines are subject to the principle of proportionality, to which firms and competent authorities must have regard when applying their provisions and complying or supervising compliance. Essentially, this approach aims to ensure consistency between a firm's governance arrangements (including its third-party risk management framework) with its size and internal organisation, and the nature, scope and complexity of its activities.

Interaction with DORA

A key consideration for firms is how the Guidelines interact with the requirements under the EU Digital Operational Resilience Act (DORA). In summary, the framework for the management of ICT risk and the use of TPSPs to provide ICT services is set out in DORA, while the Guidelines cover the use of TPSPs to provide non-ICT services and the management of third-party risks in relation to non-ICT services.

The EBA has sought throughout the Guidelines to maintain consistency with DORA. It states that the Guidelines “bridge the gap”, enabling financial entities to take a holistic approach to third-party risk management in respect of both ICT and non-ICT services provided by TPSPs.

Application date and compliance

The application date of the Guidelines has not yet been specified as they must first be translated into the official languages of the EU. There is no prescribed timescale for this process, but once it has been completed, all the official EU language versions of the Guidelines will be published on the EBA website.

The application date of the Guidelines will be specified in these versions, together with the date on which the Outsourcing Guidelines will be repealed.

The Guidelines will apply to all third-party arrangements for non-ICT services entered into, reviewed or amended on or after the application date. Firms will need to review and amend existing third-party arrangements to ensure compliance with the Guidelines. There is a two-year transitional period in respect of third-party arrangements supporting critical or important functions; the review and documentation of other third-party arrangements may be carried out by firms at the point of renewal.

Background

The EBA consulted on a draft version of the Guidelines (Draft Guidelines) in 2025, noting the context of an increased reliance by financial institutions on TPSPs, a shift which, it noted, “requires an evolution of the traditional notion of outsourcing to the broader scope of TPSP arrangement”.

The EBA also drew attention to the need to update the Outsourcing Guidelines following DORA’s entry into force, and highlighted the overarching aim of establishing a more harmonised framework on the sound management of third-party risk.

Our previous blog post provides an overview of the EBA consultation on the Draft Guidelines.

Application and scope

The scope of the Guidelines is broader than that of the Outsourcing Guidelines (which apply to credit institutions, some investment firms, payment service providers and e-money institutions).

Financial institutions in scope of the Guidelines are:

All EU regulated banks/credit institutions and investment firms (including third-country branches), holding companies approved under Article 21a(1) of the CRD IV Directive, payment services institutions and e-money institutions currently subject to the Outsourcing Guidelines; plus
Smaller investment firms (i.e. not CRD/CRR-regulated, but excluding small and non-interconnected investment firms under the Investment Firms Regulation (IFR)), MiCAR-authorised issuers of asset reference tokens (ARTs) and non-bank creditors under the Mortgage Credit Directive (MCD).

In line with the Capital Requirements Regulation (CRR), the Guidelines apply on a consolidated and sub-consolidated basis, taking into account the prudential scope of consolidation.

The Guidelines are also addressed to competent authorities, which have responsibility for supervising firms’ third-party arrangements, with a particular focus on non-ICT services supporting critical or important functions.

In applying the Guidelines, firms must take into account the complexity of the functions supported by TPSPs, the risks arising from the third party arrangements, the criticality or importance of the function supported by TPSPs, and the potential impact of the arrangements on the continuity of their activities.

The management of ICT risk and the use of TPSPs to provide ICT services, including when supporting critical or important functions, are outside the scope of the Guidelines since they are within the scope of DORA. The EBA has confirmed that it is for firms to determine what falls under ICT services and non-ICT services.

From a practical perspective, the boundary between ICT services and non-ICT services is not always straightforward. Many modern service arrangements involve a blend of both. For example, a managed payroll service that relies heavily on cloud-based platforms, or a facilities management contract with integrated building management systems. Firms will need to develop robust internal methodologies for classifying services, and should expect that regulators will scrutinise the rigour of that classification process. Getting this wrong could result in a service arrangement falling between two regulatory stools, with neither DORA nor the Guidelines being properly applied.

Content of the Guidelines

The Guidelines require firms to put in place internal governance measures and a risk management framework around third-party arrangements. These internal measures must be robust, with effective processes that enable the identification, management, monitoring and reporting of risks.

In broad terms, the Guidelines break this down into the following main areas:

Assessment of third-party arrangements. This involves sound management of third-party risk under a holistic risk management framework that extends across all business lines and internal units, together with consideration and identification of critical or important functions.
Governance framework, encompassing (in broad terms):
- effective day-to-day management of third-party risks by the management body (management function and senior management); and
- effective oversight by the management body (supervisory function).
A written policy on the use of non-ICT services supporting critical or important functions provided by TPSPs, covering the principal phases of the lifecycle for the contractual arrangements with TPSPs.
The identification, assessment and management of conflicts of interests regarding firms’ third-party arrangements.
Business continuity plans (BCPs) aimed at ensuring the continuity of firms’ critical or important functions provided by TPSPs. Firms must conduct a business impact analysis of their exposures to severe business disruptions.
Internal audit function (or internal audit review), which must cover the independent review of functions provided by TPSPs. Firms’ audit plans and programmes must include third-party arrangements supporting critical or important functions.
Documentation requirements. Firms are required to maintain an updated register of information on all third-party arrangements within the scope of the Guidelines (at individual and, where applicable, at sub-consolidated and consolidated levels), and appropriately document all third-party arrangements, distinguishing between arrangements supporting critical or important functions and other third-party arrangements.
The third-party arrangement process. This covers two stages:
- before entering into third-party arrangements (i.e. pre-contractual analysis; supervisory conditions for contracting with TPSPs; risk assessment - relevant risks include operational, reputational, legal and concentration; and due diligence); and
- the contractual phase (i.e. allocation of the rights and obligations of the firm and the TPSP - to be set out in a written agreement containing certain prescribed elements as a minimum, with additional contractual provisions required in respect of third-party arrangements for the use of services supporting critical or important functions; subcontracting of critical or important functions; access, information and audit rights; and termination rights).
Monitoring, including the performance of TPSPs providing services under third-party arrangements; third-party arrangements supporting critical or important functions; and internal concentration risks caused by third-party arrangements (including any use of subcontractors to support critical or important functions). Firms should use the outcome of the monitoring process to regularly update their risk assessment.
Exit strategy for third-party arrangements supporting critical or important functions. This must be documented and aligned with firms’ strategy on third-party risk management and BCPs.
Effective supervision by competent authorities. Notably, this includes identifying and monitoring the concentration risk (at both the firm level and the sectoral level) of third-party arrangements with TPSPs providing services supporting critical or important functions; and ensuring that firms are not operating as 'empty shells', lacking the substance to remain authorised, as a result of their use of TPSPs.

From a commercial standpoint, the requirement to map all third-party dependencies, not just those supporting critical or important functions, represents a significant operational undertaking. Many firms will find that their existing vendor management systems and procurement records are not sufficiently granular to support the level of documentation and ongoing monitoring the Guidelines envisage. This is likely to require investment in systems and processes, and may also necessitate extensive conversations with existing TPSPs about enhanced information-sharing, audit rights and contractual amendments, particularly where those TPSPs have significant bargaining power. Firms should also be mindful that the concentration risk monitoring obligations (at both firm and sectoral level) may, in practice, limit the pool of available service providers for certain functions, with potential cost implications.

Key changes following the consultation on the Draft Guidelines

The EBA has changed the title of the Guidelines: the title of the Draft Guidelines did not explicitly refer to non-ICT services, whereas the title of the Guidelines does.

The content of the Guidelines also incorporates suggestions and comments made in consultation responses. In summary, the EBA has made amendments to introduce the following changes:

Greater proportionality.
More clarity on (i) scope; (ii) the focus on critical or important functions; and (iii) alignment with the DORA framework.
Increased flexibility in relation to the transitional period and the register for non-ICT services.

The EBA considers that, overall, these changes should reduce the administrative costs of applying the Guidelines and allow for a more proportionate approach.

In the table below, we identify certain definitions and provisions in the Guidelines and briefly summarise the changes and any comments made by the EBA in the light of consultation responses.

Definition/provision	Brief description of relevant definition/provision	Changes/comments (based on consultation responses and EBA consultation feedback)
Third party arrangement	Defined as an arrangement of any form between a financial entity and a TPSP (including intragroup TPSPs) for the support of one or more functions to the financial entity on a recurrent basis or an ongoing basis.	Consistent with DORA, the Guidelines cover all third-party arrangements (although the focus is on third party arrangements supporting a critical or important function).
Outsourcing arrangement	Defined as an arrangement of any form between a financial entity and a TPSP, including intragroup TPSPs, by which the TPSP performs, on a recurrent or an ongoing basis, a function that would otherwise be undertaken by the financial entity itself.	Under the Guidelines, outsourcing is a sub-set of third-party arrangements.
Function	Defined as any process, service or activity, or part of it.	The EBA has clarified references throughout the Guidelines for consistency with DORA.
Critical or important function	A function will be critical or important in the following circumstances, where its disruption, discontinuity, defect or failure in its performance would materially impair: the firm’s continuing compliance with the conditions and obligations of its authorisation or other obligations under applicable financial services law; the firm’s financial performance; or the soundness or continuity of the firm’s services and activities.	The definition in the Guidelines is aligned with DORA. It is also in line with the MiFID II Directive and Commission Delegated Regulation (EU) 2017/565, and is different to, but encompasses, the “critical functions” definition under the Bank Resolution and Recovery Directive (BRRD).
Sound management of third-party risk	A firm must establish whether an arrangement with a TPSP falls under the definition of third-party arrangement. This assessment involves considering whether: the services the firm relies on/plans to rely on are non-ICT services; the TPSP is providing non-ICT services supporting a function at least on a recurrent or ongoing basis; and the function being supported is critical or important (this is a matter for the firm to determine).	Where an arrangement with a TPSP covers multiple functions, the firm should consider all aspects of the arrangement within its assessment. If an arrangement with a TPSP in relation to the provision of a non-ICT service also implies the use of ICT services, the firm must determine whether the use of an ICT service is material for the provision of the services under the third-party arrangement, which would mean that DORA applies.
Exclusions	The Guidelines include a list of third-party services that are, as a general principle, excluded from the Guidelines’ scope of application.	The exclusions are consistent with the Financial Stability Board (FSB) toolkit on third-party risk management. In the light of consultation responses, the EBA has amended, expanded and clarified this list.
Mandatory non-exhaustive list of TPSP functions	N/A	The Draft Guidelines included a proposed Annex I: ‘Non exhaustive list of functions that could be provided by a third-party service provider’. In the light of consultation feedback, the EBA has deleted Annex I. It notes that the vast majority of respondents considered the proposed list of TPSP functions was too broad.
Sound governance arrangements and third-party risk	Firms’ management bodies must define, approve and regularly review a strategy on the sound management of third-party risks. This must include a written policy on contractual arrangements for use of non-ICT services supporting critical or important functions provided by TPSPs. This policy may be merged with the policy under Article 28(10) of DORA, provided there is appropriate differentiation between different services and TPSP arrangements. Firms must clearly assign responsibility for the documentation, management, and monitoring of third-party arrangements.	These requirements are consistent with DORA.
Documentation requirements/register	Firms must: maintain an updated register with information on all third-party arrangements within the scope of the Guidelines; and appropriately document all current third-party arrangements (distinguishing between those that support critical or important functions and those that do not).	The Guidelines provide for sufficient flexibility to allow firms to: combine the register for non-ICT arrangements with the register under DORA (for ICT arrangements); or separately maintain a more proportionate register of non-ICT arrangements, while maintaining consistency between the two registers.
Subcontracting	Defined as a situation where a TPSP has entered into an arrangement with another service provider to further transfer a function, in whole or in part. Third-party arrangements on the use of services supporting critical or important function by TPSPs must specify whether the subcontracting of critical or important functions (or material parts of such functions): is permitted; and when permitted, the conditions that apply.	Where subcontractors provide services supporting critical or important functions, firms should especially focus continuously on subcontractors that effectively underpin the non-ICT related service supporting a critical or important function. Here, the EBA has added the words “effectively underpin”, to align with the wording of DORA. It is for firms to determine whether a subcontractor effectively underpins the non-ICT related service supporting the critical or important function. Where this is the case, the firm should include the subcontractor within the scope of its monitoring and on the register.
Termination rights	A firm must be able to terminate third-party arrangements, in accordance with applicable law, including in the situations specified in the Guidelines	In the light of consultation responses, the EBA has made certain amendments to further clarify and align this provision with DORA.

In practice, the subcontracting provisions are likely to present particular challenges in negotiations with TPSPs. Many service providers, especially those operating at scale, rely on extensive subcontracting chains, and may resist contractual terms that give firms granular visibility over, or approval rights in respect of, subcontractors that "effectively underpin" critical or important functions. Firms should anticipate that achieving compliance with these provisions may require a recalibration of existing commercial relationships, and that TPSPs may seek to pass through the costs of enhanced transparency and reporting obligations.

Similarly, the termination rights provisions, while aligned with DORA, may prove commercially sensitive: firms will need to balance the regulatory imperative for robust exit options against the commercial reality that overly broad termination rights can deter TPSPs from entering into arrangements or lead to less favourable pricing.

Next steps

Following publication, the Guidelines must now be translated into the official languages of the EU. There is no prescribed timescale for this process, but once it has been completed, all the official EU language versions will be published on the EBA website. This will trigger the start of the two-month ‘comply or explain’ period during which competent authorities must inform the EBA whether they comply or intend to comply with the Guidelines, or give reasons for non-compliance.

The EBA will specify the application date of the Guidelines in the translations, together with the date on which the Outsourcing Guidelines will be repealed. The Guidelines will apply to all third-party arrangements entered into, reviewed or amended on or after the application date.

Firms will need to review and amend existing third-party arrangements to ensure compliance with the Guidelines. Firms should note that:

There is a two-year transitional period for this process in respect of third-party arrangements supporting critical or important functions. The EBA considers this to be an adequate timeframe to allow for a smooth and proportionate implementation. However, if the review and documentation process is not finalised by the end of the transitional period, firms must notify their competent authority and explain either their plans to complete the process or the possible exit strategy in relation to these arrangements.
Following consultation feedback, the EBA has introduced greater flexibility regarding the review and documentation of third-party arrangements supporting non-critical or non-important functions: this process may be carried out at the point these arrangements are to be renewed.

From a strategic perspective, the two-year transitional period for existing arrangements supporting critical or important functions, and the additional flexibility for non-critical or non-important arrangements, provides a window for firms to take a phased and prioritised approach. Firms that engage early with their key TPSPs to renegotiate contractual terms are likely to be better positioned than those that leave this exercise until closer to the deadline, when TPSPs may face a surge of renegotiation requests and have less capacity (or willingness) to accommodate bespoke requirements. Early engagement also allows firms to identify arrangements where a change of provider may be necessary, giving sufficient lead time for an orderly transition.

Actions for firms

Firms can plan ahead by:

Identifying any third-party arrangements for non-ICT services supporting critical or important functions.
Reviewing their governance and risk management framework covering third-party arrangements for ICT services/non-ICT services, with a view to assessing how it can be streamlined to avoid or limit duplication between DORA requirements and the Guidelines. For example: to what extent do firms want or need integrated (or, alternatively, separate) documentation and record-keeping processes?
Considering the allocation of responsibilities across their management body for documenting, managing, and monitoring third-party arrangements within the scope of the Guidelines.
Assessing the budgetary and resourcing implications of compliance, including any investment needed in vendor management systems, contract management platforms and internal training to support the enhanced governance and documentation requirements.
Engaging proactively with key TPSPs to discuss the anticipated contractual and operational changes, with a view to agreeing a realistic timetable for renegotiation and implementation well in advance of the application date.
Considering whether early engagement with their competent authority would be beneficial, particularly in relation to the classification of services as ICT or non-ICT and the identification of critical or important functions, where there may be scope for divergent interpretations.

Please contact our team if you would like to discuss the Guidelines or any other developments relating to third-party arrangements, risk management and governance.

Article tags

risk management EBA outsourcing third party arrangements operational resilience critical or important functions non ICT services governance TPSPs

Related categories

Regulatory EU Outsourcing Operational Resilience

Key contacts

Marina Reason

Partner, London

Kelesi Blundell

Partner, London

Nick Pantlin

Partner, London

Dr Ioannis Asimakopoulos

Senior Associate, London, Brussels and Greece group

Terence Lau

Of Counsel, London

Claire Wiseman

Knowledge Lawyer, London

Catriona de Jongh

Knowledge Lawyer, London

Disclaimer

The articles published on this website, current at the dates of publication set out above, are for reference purposes only. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking any action.