Final EBA guidelines on third-party risk regarding non-ICT services

 

Current status quo and objectives

On 18 September 2026, the European Banking Authority (EBA) published its final Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09). The consultation period ran until 8 October 2025. By that date, the EBA had received 72 responses.

The EBA’s Guidelines on the management of third-party risk (EBA TPRM Guidelines) replace the previous EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) and have been adapted to the regulatory framework established by DORA. National supervisory authorities now have to incorporate them into their supervisory practices.

Background and context

The EBA’s Guidelines on the management of third-party risk are based on the assumption that the use of third-party services may give rise to a risk for institutions – regardless of whether they are ICT services (within the meaning of DORA), current outsourcing arrangements (within the meaning of national rules implementing the EBA’s Guidelines on outsourcing arrangements, such as German regulator Bafin’s Minimum Requirements for Risk Management (MaRisk)) or non-ICT services.

The EBA therefore distinguishes between ICT services and non-ICT services. Both categories may also encompass outsourcing arrangements as currently understood. In its TPRM Guidelines, outsourcing arrangements no longer constitute a separate category with its own legal consequences. Instead, the rules cover third-party risks associated with non-ICT services and place particular emphasis on services that support critical or important functions. By aligning them with DORA, the EBA makes it clear that institutions should adopt a holistic approach to managing their third-party risks encompassing both ICT and non-ICT services.

Scope and delimitation

The guidelines apply to all non-ICT contractual arrangements with third parties entered into by firms falling within their scope, such as CRR institutions or payment institutions and investment firms. Where mixed services are involved, i.e. contracts containing both ICT and non-ICT components, the assessment should be based on the predominant component: if the ICT component predominates, DORA applies; if the non-ICT component predominates, the EBA’s new guidelines apply. When distinguishing between ICT and non-ICT services, the EBA leaves the power to decide this up to the institutions: it is up to each financial entity itself to determine whether use of an ICT service is essential for provision of a service under the third-party arrangement and thus triggers the application of the DORA framework. Moreover, mere purchases of goods (e.g. plastic cards, card readers, office supplies, computers or furniture) fall outside the scope of application.

Given this, the material scope of application extends to a wide variety of non-ICT services. However, paragraph 33 contains an extended list of exemptions. This mainly includes regulated financial services, market information services such as Bloomberg and S&P, payment network infrastructures such as Visa, MasterCard or WERO and services with no material impact on risk exposure or operational resilience, such as printing, cleaning and legal advice.

Governance and risk management requirements

The basic concept of the requirements is closely modelled on the existing guidelines on outsourcing. Institutions have to establish an appropriate governance framework covering the entire lifecycle of the third-party relationship. When doing so, they can build on their DORA structures: the policy may be merged with the policy foreseen under Article 28(10) of DORA (paragraph 49), and the monitoring function with the function under Article 5(3) (paragraph 44(c), footnote 46).

The assessment of criticality (“critical or important functions”) is more closely aligned with DORA in the final version (from paragraph 34; see also its Article 3(22)). The provisions in paragraphs 34 to 37 have been revised and provide additional clarity on the identification of these functions. Irrespective of this, practice shows that many institutions do indeed find it difficult to determine which functions are critical or important and which third-party services support them. This will continue to be the case under the TPRM Guidelines.

Apart from this, institutions will have to maintain an information register for non-ICT contracts as well (from paragraph 61). The contents of this register should be consistent with the register required under DORA and where feasible it should be possible to maintain it jointly or integrate it with the DORA register to avoid redundant structures (paragraph 63).

Deadlines and transitional provisions

The TPRM Guidelines apply from their date of application to all third-party arrangements entered into, reviewed or amended on or after that date (paragraph 18). Existing arrangements must also be reviewed and amended accordingly (paragraph 19). For arrangements supporting critical or important functions, a transitional period of two years applies from the date of application. If the review and documentation are not finalised by then, the institution is required to inform the competent supervisory authority and set out the measures planned to complete the review and documentation or a possible exit strategy (paragraph 20). Arrangements supporting non-critical or important functions only have to be reviewed and documented the next time they are renewed (paragraph 21). This represents a significant relaxation compared with the consultation draft, which still provided for a fixed two-year deadline for all arrangements.

Minimum contractual requirements

Although the EBA adopts key contractual standards from DORA (from paragraph 84), the resulting provisions are not entirely identical. Minimum contractual provisions include, for example:

• clear service level descriptions and monitoring,
• audit rights for institutions and supervisory authorities,
• provisions on the use of subcontractors (including timely notification of changes with the right to approve or object; paragraphs 90 to 93),
• information obligations in the event of incidents, and
• exit provisions.

In the final version, the contractual duties to monitor and exit strategies no longer apply across the board to all contracts covered and instead relate to arrangements supporting critical or important functions. In terms of content, the requirements are largely already familiar from the current EBA Guidelines. The points of contention under DORA regarding providers’ participation in training organised by a financial entity or in threat-led penetration tests are absent from the EBA’s TPRM Guidelines.

Relationship to other regimes

The new guidelines form part of a broader European trend towards the harmonisation of third-party risk management.

In parallel with the EBA, ESMA has also published a paper setting out 13 (non-binding) principles for supervising third-party risks at investment firms and market operators. This gives the impression that the supervisory authorities intend to address the issue of third-party risk in a comprehensive and harmonised manner in future.

Other significant changes compared to consultation draft

• The definition of a third-party arrangement has been expanded to include the time criterion “on a recurrent basis or an ongoing basis”, bringing it into line with DORA.
• With regard to subcontracting, only subcontractors who perform critical or important functions (“effectively underpin”) are now covered, rather than all subcontractors in the chain across the board.
• The obligation to carry out a business impact analysis for the exit strategy provided for in the consultation draft has been removed.
• The provisions governing EU branches of third-country banks (third-country branches) have been made more detailed and proportionate. In particular, the guidelines clarify that service level agreements or policies are sufficient in place of a written contract.
• Annex I, containing an illustrative list of services that may be provided by third-party service providers (TPSPs) has been deleted.

Bottom line

The focus on outsourcing arrangements in the current sense continues to diminish, as under the new framework they merely constitute a sub-category of ICT or non-ICT third-party arrangements. The EBA’s Guidelines on third-party risk management are clearly geared towards alignment with DORA and a more proportionate, risk-based approach to third-party arrangements. This may make some things simpler for institutions. At the same time, they will need to bring their contracts and processes up to the new standards through “remediation projects”, with less risk-relevant agreements benefiting from more flexible transitional provisions. The DORA assessment and the DORA templates developed for this purpose provide a good starting point. The main focus should then be on identifying those contracts that were not classified as ICT services in the assessment.

The guidelines were published on 18 September 2026. When exactly they will come into force has not been determined yet, since they first have to be translated into the official languages of the EU. National supervisory authorities will then have two months to state whether they will apply the guidelines or, if not, to explain why (“comply or explain”). We will keep you informed of any updates.