EBA Third-Party Risk Guidelines 2026: Managing non-ICT third-party providers under DORA logic

Financial entities rely ever more heavily on third-party service providers (TPSPs) — and in doing so increase the risks to themselves, their clients and, in individual cases, the financial system (p. 4). The EBA draws two conclusions: outsourcing becomes a subset of the broader third-party arrangement (para. 17), and the gap to DORA is closed — DORA governs ICT third-party risk, the Guidelines govern non-ICT third-party risk, with the expectation of a holistic approach spanning both worlds (para. 7; Background section para. 11).

The legal basis lies in the governance mandates of the sectoral legal acts: Art. 74(3) CRD, Art. 26 IFD, Art. 34 MiCAR and Art. 11 PSD2 (Background section para. 15; Feedback p. 67). Formally, these are guidelines under Art. 16 of Regulation (EU) No 1093/2010: competent authorities and financial entities must make every effort to comply with them, and each competent authority declares within two months whether it applies the Guidelines (paras. 1–3; Feedback p. 68).

Internationally, the EBA builds on the FSB toolkit of 4 December 2023 and the BCBS Principles for the sound management of third-party risk of 10 December 2025, which the definition of the third-party arrangement follows (pp. 55, 59; Feedback p. 75); the ESMA Principles on third-party risks of 12 June 2025 are addressed to national competent authorities only (Feedback p. 66).

The consultation on EBA/CP/2025/12 ran from 8 July to 8 October 2025 and drew 72 responses (Feedback p. 65). The EBA rejected criticism of its mandate and allegations of double regulation (pp. 67–68); on proportionality it gave ground — a focus on critical or important functions, a leaner register, proportionality criteria in Title I (pp. 68–69). It answered the call for a lead time of nine to eighteen months with the two-year transitional period; those who cannot complete in time inform the competent authority (p. 78; para. 20).

The date of application is a placeholder in the Final Report: the Guidelines apply from a date set upon publication of the translations to all arrangements entered into, reviewed or amended on or after that day (para. 18); existing arrangements must be reviewed and adapted (para. 19).

The subject matter is the governance arrangements that apply where third-party service providers deliver non-ICT services in support of functions — with a focus on critical or important functions (para. 5); “support” includes the full performance of the function (fn. 20). ICT services under Art. 3(21) DORA are excluded because they fall under Chapter V DORA (para. 7). Competent authorities review the arrangements in the SREP under Art. 97 CRD and its counterparts in the IFD, PSD2, EMD and MiCAR (para. 6).

What is not captured: the exclusions in para. 33

• Services that must by law be provided by a third party — such as the statutory audit
• Regulated financial services that are required by law to be provided by another financial entity regulated under EU law, for example custody or trading venues
• Market information services — added at the request of consultation respondents (Feedback p. 79)
• Financial transactions between financial institutions as counterparties and with central banks
• Payment network infrastructures such as Visa, Mastercard, Wero or GIE CB, as well as clearing and settlement arrangements between clearing houses, central counterparties, settlement institutions and their members
• Global financial messaging infrastructures under regulatory oversight, such as SWIFT, as well as correspondent banking
• Services with no material impact on risk or resilience: architects, printing, legal opinions, legal representation, PR, cleaning, building maintenance, medical services, fleet management, catering, canteen, office, travel, postal and reception services
• Procurement of goods (plastic cards, card readers, office supplies, PCs, furniture) and utilities (electricity, gas, water, telephone)

It is the service that is excluded, not the provider: a supervised financial entity that delivers other services is a TPSP like any other; its supervised status feeds into proportionality and the risk analysis (pp. 69–71). Nor do the exclusions dispense with risk management — appropriate steps remain expected (fn. 41).

Intra-group service providers and central service providers of an institutional protection scheme (IPS) are TPSPs — with no special regime, since intra-group arrangements are not per se lower-risk (Background section para. 19; Feedback p. 71); flexibility comes from centralised functions under paras. 26–30. An intra-group TPSP located in a third country is to be treated as a third-country TPSP in the risk analysis (Feedback p. 75).

The test belongs within holistic risk management across all business lines and internal units (para. 31). It is run before every engagement (para. 68 a) and must be anchored in the policy as a planning step (para. 48 d).

1. 1
   Step 1Is this a non-ICT service?

   If the service is an ICT service under Art. 3(21) DORA, or if its ICT component is material to its provision, DORA applies (paras. 31 a, 32). Everything else stays in the test.

2. 2
   Step 2Is a function supported on a recurrent or ongoing basis?

   A function is any process, service or activity — or part thereof (para. 17). One-off purchases are not a third-party arrangement (para. 31 b). Then check the exclusions under para. 33.

3. 3
   Step 3Is the function critical or important?

   Only then do the policy (para. 47), the additional register fields (para. 62), enhanced due diligence (para. 79), enhanced contractual clauses (para. 85), unrestricted audit rights (para. 98) and the exit plan (para. 114) apply. All other arrangements are subject to the basic regime (para. 31 c).

A function is critical or important where its disruption would materially impair the financial performance of the financial entity, the soundness or continuity of its services and activities, or its continuing compliance with the conditions of its authorisation and other obligations under financial services law (para. 17). The wording corresponds to Art. 3(22) DORA (Background section para. 13). It is not identical to the “critical functions” under Art. 2(1)(35) BRRD, but encompasses them (fn. 35; Background section para. 13).

An arrangement covering several functions — for instance operational tasks of risk management and regulatory reporting — must be assessed jointly in all its aspects (para. 32).

The management body defines, approves and regularly reviews a third-party risk strategy that includes the policy under Section 6 and complements operational risk management and operational resilience; integrated or separate strategies for ICT and non-ICT are permitted (para. 38; Feedback p. 83). The use of TPSPs never results in a delegation of responsibility (para. 41) and lowers neither the suitability requirements for the management body and senior management nor the need for competent resources (para. 43). Para. 42 a–h lists what the management body remains responsible for at all times — from the conditions of authorisation through strategies, risk appetite and conflict-of-interest policies to the oversight of all third-party risks, the business continuity policy and the audit plans of internal audit.

Proportionality and group structures

Proportionality means that governance arrangements must fit the risk profile, nature, business model, scale and complexity of the activities (para. 23). The yardstick for each arrangement is the complexity of the function, the risks, criticality and the impact on continuity (para. 24); the criteria in Title I of the EBA governance guidelines under the CRD, IFD and MiCAR apply accordingly (para. 25).

The policy must be reviewed at least annually and updated where necessary; changes are to be implemented in the contractual relationships promptly and as soon as possible, and the management body ensures implementation at individual, sub-consolidated and consolidated level (para. 47). The EBA rejected the request to drop the annual cycle — it is not burdensome where nothing has changed, and it is consistent with DORA (Feedback p. 85). Whether the 2019 outsourcing policy and the new policy form a single document is left to the financial entity.

In addition, the policy must capture the impact of critical or important functions placed with TPSPs on four areas and feed it into decision-making: the risk profile, the ability to oversee the TPSP and manage risks, business continuity measures and business performance (para. 50).

Three adjacent sections belong to the policy in substance. Conflicts of interest must be identified, assessed and managed; for intra-group TPSPs the terms, including the price, must be objective, and synergies may be priced in as long as the TPSP remains viable on a standalone basis — within a group, independently of the failure of other group entities (paras. 51–53). Business continuity requires regularly tested plans that involve the TPSP and a business impact analysis with quantitative and qualitative criteria, scenario analysis and a view on substitutability (paras. 54–55). Internal audit reviews on a risk-based approach, includes critical arrangements in the audit plan, assesses the framework, the criticality and risk assessments, the involvement of governing bodies and monitoring, and runs a formal follow-up process for findings (paras. 56–57).

The register covers all third-party arrangements within scope — at individual, sub-consolidated and consolidated level — and distinguishes critical or important functions from the rest; ICT subcontractors of a non-ICT TPSP that effectively underpin a critical or important service belong in it (para. 58). Terminated arrangements remain documented for an appropriate period; the five-year retention period originally planned was aligned with DORA (para. 59; Feedback p. 90). Groups and IPSs may maintain the register centrally, provided each institution receives its individual register without delay (paras. 60, 28 d).

Provision to supervisors and notifications

On request, the competent authority receives the register in full or in part in a processable electronic format — the format of the DORA ITS, such as a database format or CSV, is permitted (para. 63) — together with all necessary information, up to and including copies of contracts (para. 64). Planned arrangements supporting critical or important functions, and any case in which a function becomes critical or important, must be notified in good time, where appropriate within the supervisory dialogue, with at least the information set out in paras. 61 and 62 (para. 65); the same applies to material changes and severe events (para. 66). Assessments and monitoring results must be documented (para. 67). The Guidelines set no deadline; centralised notifications from groups are possible (Feedback pp. 77–78, 92).

Functions requiring authorisation — banking activities, payment services, the issuance of ART or investment services under Art. 4(2) MiFID II on a scale that requires authorisation or registration — may only be entrusted to a TPSP that is authorised or registered for them, or otherwise permitted to perform them under national law (para. 69; Section 11.1). If the TPSP is located in a third country, three cumulative conditions apply (para. 70):

1. 1
   Condition 1Authorisation and supervision in the third country

   The TPSP is authorised or registered for the activity in the third country and is supervised there by a competent authority (para. 70 a).

2. 2
   Condition 2Cooperation agreement between the authorities

   An appropriate cooperation agreement exists between the financial entity’s competent authority and the third-country supervisor, such as a memorandum of understanding or a college agreement (para. 70 b).

3. 3
   Condition 3Four minimum rights for the supervisor

   The agreement secures for the EU supervisor at least: information on request, access to data, documents, premises and personnel in the third country, the earliest possible notification of suspected breaches, and cooperation in enforcement (para. 70 c).

Risk analysis (Section 11.2)

Due diligence (Section 11.3)

• The depth of the review is proportionate to the criticality of the function (para. 77).
• For every TPSP: business model, size, complexity, financial strength, ownership and group structure; operational and technical capability and track record; group membership; supervisory status (para. 78).
• For critical or important functions, additionally: reputation, expertise, capacity and resources; internal controls and risk management including supply chain risks; geographical dependencies; business continuity, contingency and disaster recovery plans; required authorisations over the term of the contract; effective auditability, including on site, by the institution, its appointees and the competent authority (para. 79).
• The planned use of subcontractors for material parts must be taken into account (para. 80); where personal or confidential data are involved, the TPSP’s technical and organisational measures must be reviewed (para. 81).

The fifth assessment step — conflicts of interest — follows Section 7 (paras. 51–53) and must be documented with particular care for intra-group TPSPs.

Para. 83 requires the rights and obligations of the financial entity and the third-party service provider (TPSP) to be clearly allocated and set out in writing. The consequence: framework agreement, individual call-off and service schedule must together cover the minimum content of para. 84 — for every arrangement within scope, regardless of criticality.

Ten mandatory elements for every arrangement (para. 84 a–j)

Six additional clauses for critical or important functions (para. 85 a–f)

Para. 86 adds, in particular for TPSPs in third countries: without prejudice to the GDPR (Regulation (EU) 2016/679), differences in national data protection law must be taken into account. The contract obliges the TPSP to protect confidential, personal and otherwise sensitive information and to comply with all data protection obligations that apply to the financial entity itself — expressly including banking secrecy and comparable duties of confidentiality towards clients.

Maintain elements a–j and a–f as a clause checklist per contract, linked to the register fields (para. 61–62). Missing elements in legacy contracts are precisely what has to be renegotiated during the two-year transitional period (para. 19–20).

Para. 87 sets the frame: the arrangement specifies whether subcontracting is permitted and under which conditions. Subcontractors do not diminish the ultimate responsibility of the management body. Financial entities need a “clear and holistic view” of the chain and focus on those subcontractors that effectively underpin the non-ICT service — whoever does so is recorded in the register under para. 88 (para. 62 c).

What the contract must stipulate on subcontracting (para. 89 a–j)

• a — activities excluded from subcontracting
• b — conditions to be complied with in the event of subcontracting
• c — obligation of the TPSP to assess and manage the location risks of current or potential subcontractors, their parent company and the place of service provision
• d — obligation of the TPSP to monitor subcontracted functions so that all contractual obligations continue to be met
• e — reporting obligations of the TPSP regarding subcontractors of critical or important functions
• f — obligation of the TPSP to embed in its subcontracts the subcontractors' monitoring and reporting duties towards it and, where agreed, towards the financial entity
• g — continuity obligation: the TPSP secures the function across the entire chain, even where a subcontractor breaches its obligations
• h — chain rights: the subcontractor grants the financial entity and the competent and resolution authorities the same access, inspection and audit rights as the TPSP
• i — contractual amendments required to comply with EU law and these Guidelines are implemented by the subcontractor in a timely manner
• j — the financial entity documents and communicates the timetable for such amendments

The procedure: notification, deadline, decision (para. 90–94)

1. 1
   Step 1Notification by the TPSPpara. 90

   The TPSP notifies new subcontracts and intended material changes early enough for the financial entity to assess the impact on its risks and on the TPSP's ability to perform the contract.

2. 2
   Step 2Appropriate notice periodpara. 91

   The contract contains an appropriate notice period within which the financial entity may approve or object.

3. 3
   Step 3Assessment against risk tolerancepara. 93

   Where the subcontracting or the change exceeds the risk tolerance, the financial entity informs the TPSP before the deadline expires, objects and requests amendments — before the subcontract is concluded or the change is implemented.

4. 4
   Step 4Implementation only after approval or expiry of the deadlinepara. 92

   The TPSP may conclude the subcontract or implement the change only once the financial entity has approved, or has not objected by the end of the notice period.

5. 5
   Step 5Ongoing identification and monitoringpara. 94

   The TPSP identifies all subcontractors and monitors those providing critical or important functions or material parts thereof.

The chain thereby becomes an object of scrutiny. Para. 75 already requires the risk analysis to treat subcontractors in third countries and long, complex chains as a risk in their own right, because they reduce the ability of financial entities and supervisors to monitor. The register lists the subcontractors of material parts together with their rank in the chain (para. 62 c; for the fields see Chapter 6). Whoever does not receive this data does not have a chain problem but a contract problem.

Borderline case with DORA: ICT subcontractors of a non-ICT service provider that effectively underpin its service for a critical or important function also belong in the non-ICT register under para. 58 — the boundary runs along the main service, not along the chain.

Para. 96 starts with the entity's own organisation: the contract must enable the internal audit function to review the function performed by the TPSP on a risk-based approach. Para. 97 applies to CRD institutions regardless of criticality: every contract refers to the information and investigatory powers of the competent and resolution authorities under Article 63(1)(a) BRRD and Article 65(3) CRD — for TPSPs in a Member State and in third countries alike.

Under para. 101, financial entities determine audit frequency and scope on a risk-based approach and follow recognised audit standards. To use audit resources more efficiently, para. 102 permits two tools: pooled audits together with other clients of the same TPSP or by a jointly appointed third party, and third-party certifications and audit reports or reports of the TPSP's internal audit function.

The eight conditions for certificates and audit reports (para. 104 a–h)

Before planned on-site visits, the TPSP receives reasonable notice, except in emergency or crisis situations or where notice would render the audit ineffective (para. 105). In multi-client environments, risks to other clients — service levels, data availability, confidentiality — are to be avoided or mitigated (para. 106). Where complexity is high, the financial entity must verify that its own internal audit function, the audit pool or appointed external parties have the necessary skills; the same applies to the staff who evaluate certificates and third-party audits (para. 107).

Under para. 108, termination rights must exist, in line with applicable law, in five situations among others. For critical or important functions, para. 109 requires the contract to facilitate the transfer to another TPSP or reintegration: the obligations of the existing TPSP in the event of a transfer, including the handling of data, an appropriate transition period during which it continues to perform after termination, and a duty to support an orderly transition.

• para. 108 a — a material breach by the TPSP of applicable laws, regulations or contractual provisions
• para. 108 b — circumstances identified through monitoring that may alter the performance of the service
• para. 108 c — material changes such as subcontracting or a change of subcontractors
• para. 108 d — evidenced weaknesses in the TPSP's risk management or in the security of confidential, personal, otherwise sensitive or non-personal data
• para. 108 e — the competent authority can no longer effectively supervise the financial entity as a result of the contractual terms

Under para. 110, monitoring is risk-based and, for critical or important functions, ongoing. The risk analysis under Section 11.2 is updated regularly, the management body receives periodic risk reports, and where the risk, nature or scope of a function changes materially, its criticality is reassessed. Para. 111 requires internal concentration risks to be monitored — including subcontractors. Where deficiencies are identified or anticipated, corrective measures are to be taken or the contract is to be terminated (para. 113).

Under para. 114, exit strategies are to be documented for all critical or important functions, in line with the strategy and business continuity plans, and consider at least six scenarios. Para. 115 requires an exit without undue disruption to the business, without limiting compliance and without detriment to clients: exit plans are realistic, feasible, based on plausible scenarios, documented and, where appropriate, sufficiently tested — for instance through a cost, impact, resource and timing analysis of a transfer. Alternative solutions and transition plans take account of data location and ensure continuity during the transition period.

• para. 114 a — termination of the third-party arrangement
• para. 114 b — failure of the TPSP
• para. 114 c — concentration risk at entity level and a potentially difficult exit
• para. 114 d — deterioration of quality and actual or potential business disruption caused by failed service delivery
• para. 114 e — material risks to the continuous provision of the function
• para. 114 f — a material breach by the TPSP of laws, regulations or contractual terms

Para. 116 also requires the scenario analysis under para. 73 to be incorporated, the objectives of the exit strategy to be defined, roles, responsibilities and sufficient resources to be assigned, and success criteria to be set for the transfer of the services and of the data held by the TPSP.

Three questions come first: does an arrangement amount to a material change in the conditions of the initial authorisation (para. 117)? Can the authority effectively supervise the financial entity — in particular because the contracts require the TPSP to grant access and audit rights under Section 12.2 (para. 118)? And where does the analysis take place? At least in the SREP; for payment institutions, in other supervisory processes such as ad hoc requests or on-site inspections (para. 119).

Supervisors keep identified concentration risks under observation and assess their impact on other financial entities and on the stability of the financial system; they notify the resolution authority of new potentially critical functions within the meaning of the BRRD (para. 125). Where critical or important functions are performed outside the EU/EEA, the authority must be satisfied of its ability to supervise effectively (para. 127). Authorities cooperate closely and exchange information in a timely manner — particularly on sectoral concentration (para. 128).

Intervention powers are graduated (para. 126): where robust governance or regulatory compliance is lacking, supervisors may limit the scope of non-ICT services for critical or important functions or require the exit from one or more arrangements. Where effective supervision cannot otherwise be ensured, termination or temporary suspension of contracts comes into consideration — taking into account the need to continue operations.

For the SREP dialogue: the EBA decided against ex-ante approval (cost-benefit analysis, Option B: high-level principles). Instead, timely information and, where appropriate, supervisory dialogue on planned critical arrangements apply (para. 65), together with the register in a processable electronic format on request (para. 63).

The Executive Summary states the objective: closing the gap with DORA, enabling a holistic approach and aligning both frameworks closely — for a level playing field and supervisory convergence (p. 4). The definition of the critical or important function is “fully consistent” with DORA (p. 5, para. 17). Three passages expressly permit consolidation (role, policy, register); two further building blocks follow from the parallelism of the two regimes.

Methodologically, ISO/IEC 27001:2022 with controls A.5.19 to A.5.23 (supplier relationships, security in supplier agreements, ICT supply chain, monitoring and change management of supplier services, cloud usage) and ISO/IEC 27036 (information security for supplier relationships) provide the control framework for mapping both regimes in a single management system — in platforms such as VamiGRC as one data model with two views.

Consolidation is an option, not an obligation (para. 49, 61). Anyone maintaining two registers should avoid discrepancies (para. 61) — in practice, that means a single data source.

From the date of application, the Guidelines apply to all arrangements entered into, reviewed or amended on or after that date (para. 18); existing arrangements are to be reviewed and amended (para. 19). For critical or important functions, a two-year transitional period applies — anyone not finished by then informs the competent authority of the planned measures or a possible exit strategy (para. 20). Non-critical arrangements are reviewed only upon renewal (para. 21). The EBA deliberately chose this Option B2 to reduce renegotiation pressure (pp. 58–59).

1. 1
   Phase 0Mobilisation — before the date of applicationpara. 38–44

   Mandate from the management body, role under para. 44 c (combined with the DORA role), inventory of all non-ICT contracts, gap analysis against para. 84–85, 61–62 and 48–49, decision on the integration architecture.

2. 2
   Phase 1The first 90 days from the date of applicationpara. 31–37, 61

   Three-step test and criticality for all arrangements, basic register fields (para. 61), prioritisation of critical contracts by renewal date, approved policy (para. 47), process for new arrangements — para. 18 applies to them immediately — and reporting channel to the competent authority (para. 65).

3. 3
   Phase 2Months 4–12: contract and chainpara. 84–95, 98

   Renegotiation of critical arrangements: clause set para. 84–85, subcontracting rules para. 89–95, audit rights para. 98, subcontractor data para. 62 c, updated due diligence (para. 77–82), additional register fields (para. 62), KPI/KCI reporting (para. 112).

4. 4
   Phase 3Months 13–24: exit tests and evidencepara. 56, 101–104, 115

   Test exit plans where appropriate (para. 115), internal audit plan (para. 56), first own or pooled audits (para. 101–104), reports to the management body (para. 110) — and where the review will not finish in time, supervisory dialogue before month 24 (para. 20).

5. 5
   Phase 4From month 24: steady statepara. 21, 47, 110, 119

   Bring non-critical arrangements into line upon renewal (para. 21), review the policy annually (para. 47), reassess criticality upon material changes (para. 110), deliver the register electronically on request (para. 63), SREP readiness (para. 119).

The programme scales with proportionality: less complex financial entities may assign the role to a member of the management body (para. 44 c), use qualitative risk analyses (para. 73) and maintain the register centrally within the group or IPS (para. 60).

Date of application: the Final Report contains the placeholder “[date]” (para. 18, 20, 22); the EBA lists the Guidelines as “final and awaiting translation”. Until the translations are published, month 0 is unknown — plan relative to the date of application and use the time for Phase 0.