EBA publishes final Guidelines on non-ICT third-party risk management

On September 18, 2026, the EBA published final Guidelines on the management of third-party risk related to non-information and communication technology (non-ICT) services. The Guidelines replace the EBA’s 2019 Guidelines on outsourcing and establish a broader, risk-based framework for managing arrangements with third-party service providers, with particular emphasis on services supporting critical or important functions.

The Guidelines apply to credit institutions and certain third-country branches, Class 1 minus and Class 2 investment firms, payment and electronic money institutions, issuers of asset-referenced tokens, certain mortgage creditors, and approved financial or mixed financial holding companies. Small and non-interconnected investment firms and account information service providers that provide only account information services are excluded from the scope.

The Guidelines establish requirements for governance and responsibility, pre-contractual risk assessments, written contracts, subcontracting, regulatory notifications, ongoing monitoring, and exit planning. Management bodies must approve and regularly review a third-party-risk strategy and ensure that sufficient resources, expertise, and internal controls are available. Financial entities remain fully responsible for complying with their regulatory obligations and must retain sufficient substance to avoid becoming an “empty shell”.

Before entering into an arrangement, entities must assess whether the service supports a critical or important function and evaluate the associated operational, legal, reputational, data-protection, concentration, and other relevant risks. They must also conduct proportionate due diligence on the provider, identify potential conflicts of interest, and consider substitutability, reintegration, subcontracting chains, and the countries from which services are provided.

Written contracts must clearly define the services, locations, governing law, data-processing arrangements, service levels, cooperation with authorities, termination rights, and data access and recovery arrangements. Contracts supporting critical or important functions are subject to additional requirements concerning performance targets, incident reporting, business continuity, audit and access rights, subcontracting, and support during termination or transfer. Entities must also assess subcontracting risks and ensure that contracts allow them to object to material subcontracting changes or terminate arrangements where such changes materially increase risk.

Entities must maintain an up-to-date register of all non-ICT third-party arrangements within scope, distinguishing those supporting critical or important functions. They may maintain a separate register or combine it with the register required under the Digital Operational Resilience Act (DORA), provided that the information remains consistent. Competent authorities must be notified in a timely manner of planned arrangements concerning critical or important functions, as well as material changes or severe events that could affect continued operations.

Ongoing monitoring must cover provider performance, controls, independent reviews, and business continuity information. Entities must also maintain documented and, where appropriate, tested exit plans for arrangements supporting critical or important functions, enabling services and data to be transferred to another provider or brought back in-house without undue disruption.

Intragroup arrangements remain subject to the Guidelines, although entities may take account of the degree of control exercised over the provider. Third-country arrangements must preserve compliance with EU requirements and must not prevent competent authorities from obtaining information, accessing relevant premises or personnel, or exercising effective supervision. Competent authorities must assess third-party risk through the Supervisory Review and Evaluation Process or other relevant supervisory procedures, paying particular attention to concentration risk, common providers across the financial sector, third-country arrangements, and entities’ resources and decision-making capacity. Where serious deficiencies arise, authorities may restrict the use of a provider or require an entity to exit an arrangement.

Following feedback received during the corresponding consultation in June 2025, the EBA strengthened proportionality, clarified its focus on critical or important functions, and provided greater flexibility to align the non-ICT register with the DORA register. It also introduced a two-year transitional period for reviewing and documenting existing arrangements supporting critical or important functions. Other existing arrangements may generally be reviewed when renewed.

Following publication of the final Guidelines, theBVI and the Luxembourg Bankers’ Association (ABBL) highlighted changes made in response to consultation feedback. The BVI emphasised the reduced scope and simplified documentation requirements, while ABBL highlighted the possibility of combining the non-ICT register with the DORA register, more targeted subcontracting requirements, the removal of the proposed fixed five-year record-retention period, and the limitation of exit strategies to arrangements supporting critical or important functions.

The application date, compliance-notification deadline, and end of the transitional period have not yet been specified.

Recommendation

In-scope financial entities, including banks, certain investment firms, payment and electronic money institutions, and issuers of asset-referenced tokens, should take note of the Guidelines and assess whether their existing third-party-risk frameworks, registers, contracts, and exit plans adequately cover non-ICT services, particularly those supporting critical or important functions. They should also monitor the publication of the translated Guidelines, which will establish the application date and corresponding transitional deadline.