Last updated: 25.10.2026

The European Banking Authority (EBA) published new guidelines on the sound management of third-party risk related to non-ICT services on 18 September 2026.[1] The EBA has developed these guidelines in accordance with its mandate coming from Capital Requirements Directive (Directive 2013/36/EU) and it also took account of Article 11 of PSD2 (Directive (EU) 2015/2366), Article 26 of the Investment Firms Directive (Directive (EU) 2019/2034), Article 16 of MiFID II (Directive 2014/65/EU), Article 34 of the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114).

Over recent years, financial entities have been increasingly interested in using third-party service providers (TPSPs) to access specialised expertise, reduce costs, improve scalability and efficiency, and focus on core activities. However, as emphasized in the EBA’s final report on the new guidelines, from a risk perspective, reliance on third parties may also increase risks and may expose financial entities, their customers and, in some cases, the wider financial system to significant harm.

Business continuity and compliance risks are the key factors that financial entities may encounter while using TPSPs and these may bring huge operational losses and legal fines in case a breach occurs, but the other most important risk is the loss of reputation that the entities should always consider.

Table of Contents:

1.       Close Alignment with DORA to Ensure a Holistic Approach

2.       From Outsourcing to A Broader Framework – Third Party Arrangements

3.       Which Entities are Addressed by these Guidelines

4.       Two-Tier Regime for Critical and Non-Critical Functions

5.       Implications for In-Scope Entities

6.       Implementation and Transitional Period

Close Alignment with DORA to Ensure a Holistic Approach

Following the entry into force of the Digital Operational Resilience Act (DORA), ICT services provided by TPSPs to financial entities have been covered within DORA’s scope of application. With these new guidelines, the EBA aims to bridge the gap and enable financial entities to have sound risk management for non-ICT services as well, with a particular focus on critical or important functions.

Until now, the conditions for the management of third-party risk and the use of TPSPs for the provision of non-ICT services to financial entities have not been harmonised to the same extent as those for financial entities subject to DORA with regard to ICT services. Close alignment between both frameworks for the management of third-party risk could ensure a level playing field, foster supervisory convergence and enable financial entities to have a holistic approach to third-party risk management, including risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies.

With the DORA regulation, the aim was to mitigate any severe operational disruption and strengthen IT security in the EU financial sector due to the increased digitalisation of financial services and rising cybersecurity threats, including both resisting threats and recovering from any incidents that may occur.

Following the good progress made in managing ICT third-party risks in the financial ecosystem, it is now time to bring non-ICT-related services supporting important and critical functions into scope and monitor them.

From Outsourcing to A Broader Framework – Third Party Arrangements

The previous outsourcing definition has been abandoned, and the EBA has introduced a broader third-party lens similar to that under DORA and wider operational resilience frameworks being developed by regulators.

These guidelines widen the governed perimeter beyond outsourcing, which remains a subset, to non-ICT third-party arrangements within the defined scope. While financial entities must manage all their risks, the guidelines specify stricter provisions for managing the risks that concern critical or important functions compared with other third-party arrangements that are not deemed critical or important.

While defining this wider scope, the Guidelines provide for some exclusions, such as services legally required to be performed by a third party (for example, the statutory audit), trading venues including regulated market, market information services, payment network infrastructures (e.g. Visa, MasterCard), correspondent banking services and the purchase of goods or utilities.

Where an arrangement with a TPSP covers multiple functions, financial entities should consider all aspects of the arrangement within their assessment, e.g. if the third-party service provided includes the provision of operational tasks related to risk management and prudential reporting, both aspects should be considered together.

Which Entities are Addressed by these Guidelines

The addressee list is broader than that of the outsourcing guidelines it replaces. In addition to the entities already covered by the outsourcing guidelines, the scope also includes investment firms under Investment Firms Directive (IFD), issuers of asset-referenced tokens under MiCAR, certain mortgage-credit creditors under Directive 2014/17/EU that are financial institutions, and financial holding companies and mixed financial holding companies approved under Article 21a(1) of the CRD.

Two-Tier Regime for Critical and Non-Critical Functions

The Guidelines introduce a two-tier regime that places particular focus on critical or important functions, while non-critical functions are managed and monitored on a risk-based approach.

Contractual Baseline Requirements; Arrangements supporting critical or important functions attract the full weight of the Guidelines: stricter contract content, subcontracting controls, audit rights and exit planning. Other non-ICT arrangements are still managed, but on a risk-based footing proportionate to the firm.

In addition to the provisions apply to all agreements, for arrangements supporting critical or important functions, the written agreement has to specify quantitative or qualitative service levels, notice periods and reporting obligations, business contingency requirements, monitoring and audit rights, and an exit strategy with a mandatory transition period long enough for the firm to move to another provider or bring the service back in-house.

Subcontracting & Oversight; Among subcontractors, financial entities should notably focus continuously on those that effectively underpin the non-ICT related service supporting a critical or important functions.

The contract must state whether subcontracting of a critical or important function, or a material part of it, is permitted and under what conditions. The provider must notify the firm of new subcontracting or material changes within the defined notice period, so that it has a reasonable time to approve or object. The guidelines also impose termination triggers where a provider subcontracts a critical service without approval or against an objection. 

Access & Audit Rights; For critical or important functions, the firm and its competent and resolution authorities need access to premises, the right to take copies, and unrestricted inspection and audit rights. The firm cannot lean solely on the provider’s certifications or pooled audit reports to discharge those duties. For services that are not critical, the firm decides on a risk-based view whether to include access and audit rights, keeping in mind that a service can become critical over time.

For providers located outside the EU, the guidelines expect firms to make sure that EU legal and regulatory requirements, from professional secrecy to access to information and data protection under General Data Protection Regulation (GDPR), are met, and that the competent authority can still supervise the firm effectively.

If non-ICT services supporting critical or important functions are provided by TPSPs, stricter provisions apply to these third-party arrangements than to other third-party arrangements.

Implications for In-Scope Entities

Financial entities must first define criteria or establish a methodology to determine whether the function to be supported by a TPSP is considered critical or important. Once the Guidelines apply, in-scope firms will have a two-year window to build or extend a register of those arrangements that aligns with the register already maintained under DORA, and re-paper the contracts covering critical services.

The Guidelines will trigger some implementation costs, but these are expected to be limited: For initial addressees (i.e. credit institutions and investment firms subject to the CRD, payment institutions and e-money institutions, and third-country branches), a detailed framework already existed under the previous EBA Guidelines on outsourcing. Therefore, the additional costs triggered by the Guidelines should be limited overall. For new addressees (i.e. investment firms under IFD, and ARTs issuers) considering that the sectoral directives already establish a set of requirements for outsourcing that is quite detailed, the additional costs should be limited as well. In any case, all addressees are also already subject to DORA requirements.

Implementation and Transitional Period

The EBA has provided a two-year transitional period for reviewing and documenting existing arrangements supporting critical or important functions.

If this work is not completed by the end of the transitional period, the financial entity should inform its competent authority and explain the measures planned to complete the review or implement a possible exit strategy.

For arrangements supporting functions that are not critical or important, the review and documentation may be completed when the arrangement is renewed.

The calendar:

• 18 September 2026: The EBA published the final guidelines, EBA/GL/2026/09.

• Date of application: The guidelines are final but are awaiting translation into EU official languages.

• Two-year period: The point by which the review and documentation of arrangements supporting critical or important functions should be completed. The clock has not yet started. The two-year period must be counted from the EBA’s stated date of application, not from the publication date of 18 September 2026.

References:

[1] The EBA publishes its final Guidelines on the management of third-party risk, delivering a more proportionate and consistent framework aligned with DORA | European Banking Authority