New EBA Guidelines on Third-Party Risk Management for Non-ICT Services

On 18 September 2026, the EBA published its Final Report on the Guidelines on Third-Party Risk Management (EBA/GL/2026/09).

The eagerly awaited new EBA Guidelines on third-party risk management for non-ICT services will replace the existing EBA Guidelines on Outsourcing (EBA/GL/2019/02) as of their date of application, which has not yet been fixed. DORA harmonised third-party risk management for ICT services but left the management of contractual relationships with third parties outside the ICT area to the older EBA Guidelines on Outsourcing, which led to inconsistent requirements in the details.

Addressees

The new EBA Guidelines on third-party risk management apply to a considerably wider group of addressees than the existing EBA Guidelines on Outsourcing. The addressees now include:

Financial institutions within the meaning of the CRD and their third-country branches, investment firms – with the exception of small and non-interconnected firms within the meaning of the IFR –, payment institutions (with the exception of registered account information service providers), electronic money institutions, issuers of asset-referenced tokens within the meaning of MiCAR, and creditors within the meaning of the MCD that qualify as financial institutions, as well as financial holding companies or mixed financial holding companies authorised under the CRD.

Scope of Application

The scope of application of the new EBA Guidelines on third-party risk management no longer covers only outsourcing agreements but arrangements with third-party providers (third-party arrangements), with outsourcing arrangements expressly forming merely a subset of these. The aim is for institutions to manage the risks arising from arrangements with third parties in a holistic manner.

In para. 33, the EBA Guidelines on third-party risk management continue to contain a list of services that are excluded from the scope of the Guidelines. Compared with the EBA Guidelines on Outsourcing, the list has been clarified and expanded.

As some arrangements combine ICT and non-ICT elements, the Guidelines place responsibility for the classification on the institution itself: where a non-ICT arrangement also involves the use of ICT services, it is for the institution to decide whether the ICT element is “material enough” to trigger the application of DORA (para. 32). See the DORA Q&A for guidance on the delimitation. According to it, the definition of ICT services under DORA is to be interpreted broadly. It is nevertheless to be expected that the delimitation and its documentation may remain a practical challenge in individual cases.

Register of All Third-Party Arrangements

The previous outsourcing register under the EBA Guidelines on Outsourcing becomes a register of all third-party arrangements (para. 58 et seq.). The register is to be aligned as far as possible with the register of information under DORA. Any discrepancies between the two registers are to be avoided. It is also possible to combine both in a single register (para. 61).

One point to note: where third-party providers of non-ICT services in turn use ICT subcontractors that effectively underpin such non-ICT services supporting critical or important functions within the meaning of DORA (effectively underpinning), these ICT subcontractors are to be documented in the register (para. 58).

Alignment with Contractual DORA Requirements

The minimum contractual content has been visibly aligned with the requirements known from DORA (para. 83 et seq.). A distinction continues to be made between minimum content that is to be included in all third-party arrangements and further content for third-party arrangements that support critical or important functions.

No “Empty Shells”

For all the extensive possibilities of outsourcing and procuring services from third parties, it must not be forgotten that institutions must not become letterbox companies / empty shells. The EBA Guidelines on third-party risk management stress this, as the EBA Guidelines on Outsourcing did before them (para. 45 et seq.).

Implementation and Transitional Period

The EBA Guidelines on third-party risk management apply to all arrangements with third-party providers that are entered into, reviewed or amended on or after the date of application (para. 18).

Existing arrangements with third-party providers must be reviewed and brought into line with the requirements, unless they fall under the exclusions in para. 33.

The consultation draft still contained, in Annex I, a non-exhaustive catalogue of examples of services that may be provided by a third-party provider and would generally fall within the scope of the EBA Guidelines. Although this Annex I has now been dropped from the final Guidelines, it still illustrates well the service-based scope of application of the EBA Guidelines on third-party risk management.

The review and documentation of arrangements that support critical or important functions must be completed within two years of the date of application. Otherwise, the institution must inform its competent supervisory authority and communicate the planned measures for completion or the possible exit strategy (para. 20).

For arrangements that support neither critical nor important functions, the review and documentation may be postponed until the next contract renewal (para. 21).

The starting point is therefore the update of the risk assessment already carried out under the previous Outsourcing Guidelines or, for non-outsourcing arrangements, its first-time performance. The risk assessment must determine whether or not the service supports critical or important functions.

Where a non-ICT outsourcing of critical or important functions existed under the previous EBA Guidelines on Outsourcing, it will in all likelihood continue to be regarded as supporting critical or important functions. Further service arrangements previously treated as “other external procurement” (non-outsourcing) may be added, to the extent that they support critical or important functions.