EBA Finalizes Broader Third-Party Risk Guidelines for Financial Institutions
The European Banking Authority has replaced its 2019 outsourcing rules with new Guidelines on non-ICT third-party risk management, expanding regulatory obligations for banks, investment firms, and payment institutions across the EU.
On 18 September 2026, the EBA published final Guidelines on the sound management of third-party risk (EBA/GL/2026/09), replacing the 2019 outsourcing guidelines. The new framework explicitly separates non-ICT third-party services—now covered by the Guidelines—from ICT services governed by DORA, while expecting firms to adopt a holistic approach. The scope expands beyond traditional outsourcing to include credit institutions, relevant third-country branches, Class 1-minus and Class 2 investment firms, payment institutions, and electronic money institutions, with exclusions for legally required services, market information, global payment networks, and immaterial services. Firms must maintain updated registers documenting both non-ICT arrangements and ICT subcontractors supporting critical functions, and must conduct life-cycle governance, due diligence, contract remediation, and exit planning. No effective date has been set, but a two-year transitional period is contemplated for existing critical arrangements, and the Guidelines will apply to new or amended arrangements from the application date. Financial institutions and their critical suppliers should begin gap analyses, contract reviews, and proactive engagement now, as service providers should expect information requests and amendment demands from regulated customers.