On 18 September 2026, the European Banking Authority (EBA) published its Final Report on guidelines on the sound management of third-party risk regarding non-ICT services. The Final Report sets out the EBA’s response to feedback on its earlier consultation, together with the final text of the guidelines. The EBA presents the guidelines as part of its wider effort to simplify its regulatory framework.
Who is affected?
The guidelines are addressed both to Member State competent authorities (NCAs) and directly to financial institutions. They set out the internal governance and risk management arrangements that a broad range of firms should have in place when they rely on third-party service providers (TPSPs) for non-ICT services. In-scope entities are institutions, investment firms that do not meet all the conditions to qualify as small and non-interconnected under Article 12(1) of the Investment Firms Regulation, payment institutions, electronic money institutions, issuers of asset-referenced tokens, and creditors under point (2) of Article 4 of the Mortgage Credit Directive that are financial institutions. The guidelines also extend to third-country branches and to approved financial holding companies and mixed financial holding companies. NCAs and financial institutions must make every effort to comply with them.
Drawing the line with DORA
The guidelines apply to non-ICT services provided by TPSPs, other than those falling within Chapter V of the Digital Operational Resilience Act (DORA). In practice, this means ICT third-party risk stays under DORA, while the new guidelines cover other outsourced and third-party services. The EBA nonetheless encourages a holistic approach to third-party risk management covering both ICT and non-ICT services. It describes the resulting framework as more proportionate and consistent, and aligned with DORA.
A focus on critical or important functions
A key feature of the guidelines is that they concentrate on arrangements supporting critical or important functions (CIFs), meaning functions whose disruption would materially impair a financial entity’s performance. By focusing on these higher-risk arrangements, the EBA aims to reduce unnecessary operational and supervisory burdens for less material arrangements while maintaining sound risk management.
The guidelines cover the full lifecycle of third-party arrangements. This includes risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies.
Internal governance and risk management arrangements
The guidelines are, at their core, a governance instrument. They specify the internal governance arrangements, including sound risk management, that in-scope firms should implement when they rely on TPSPs to provide non-ICT services supporting their functions, with a particular focus on critical or important functions. Using TPSPs cannot result in the delegation of the management body’s responsibilities, and firms remain fully responsible and accountable for complying with all their regulatory obligations.
In practice, these arrangements are organised around the lifecycle of each third-party arrangement. Before entering into any third-party arrangement, firms should assess whether it concerns a critical or important function, identify and assess the relevant risks, and carry out appropriate due diligence on the prospective TPSP. Each written third-party agreement should cover a specified set of aspects, and it should state whether subcontracting of critical or important functions is permitted. During the relationship, firms should appropriately document their assessments and the results of their ongoing monitoring. They must also keep an up-to-date register of all third-party arrangements, which may be combined with the DORA register of information. For arrangements supporting critical or important functions, firms should be able to transfer the function to another TPSP, bring it back in-house, or discontinue the dependent business activities within an appropriate time frame. The EBA stresses that formal assessments alone are not enough: firms should be able to control and challenge TPSPs’ performance and carry out ongoing monitoring.
Proportionality shapes how demanding these arrangements need to be. By concentrating on arrangements supporting CIFs, the guidelines aim to reduce unnecessary operational and supervisory burdens for less material arrangements while maintaining sound risk management. Firms should therefore expect their governance effort to be focused on the arrangements whose disruption would materially impair their performance. Even so, firms should still have robust governance for other arrangements, applied on a risk-based and proportionate basis.
The guidelines also place specific duties on the management body. It should approve a written policy on the use of non-ICT services supporting critical or important functions and review it at least once a year. Firms should also set up a role to monitor all third-party arrangements, or designate a senior manager who is directly accountable to the management body. Above all, firms must keep sufficient substance and must not become “empty shells” or “letter-box entities”.
The EBA also expects firms to take a holistic approach, managing third-party risk consistently across ICT and non-ICT services. Because ICT services within Chapter V of DORA fall outside the guidelines, firms will in practice run the two regimes side by side. Joined-up governance is permitted but not required: firms may develop integrated or separate ICT and non-ICT strategies, and the non-ICT policy may be merged with the DORA policy.
Supervisory review
The guidelines also explain how NCAs should review and monitor these arrangements. This is to be done in the context of Article 97 of Capital Requirements Directive IV (the supervisory review and evaluation process), Article 36 of the Investment Firms Directive, Article 9(3) of Payment Services Directive 2, Article 5(5) of the Electronic Money Directive and Article 35(3) of the Regulation on markets in crypto assets (MiCA). In doing so, NCAs fulfil their duty to monitor firms’ continuous compliance with the conditions of their authorisation.
Timing and next steps
The guidelines are final and are awaiting translation into the EU official languages. They will apply to third-party arrangements entered into, reviewed or amended on or after the date of application, which is yet to be set. A two-year transitional period will then apply. Firms that have not finished reviewing and documenting arrangements supporting critical or important functions by the end of that period must tell their NCA, including the steps they plan to take. Other arrangements may be reviewed when they are renewed. The guidelines will also repeal the EBA Guidelines on outsourcing of 25 February 2019.
For affected firms, the practical priority is to identify which non-ICT third-party arrangements support critical or important functions. Firms should then check their lifecycle controls against the guidelines, from due diligence through to exit planning. Because the EBA wants a holistic approach, firms should also make sure their non-ICT framework fits with their existing DORA arrangements.