EBA finalises guidelines on banks' non-ICT third-party risk

The EBA published final Guidelines on 18 September 2026 on sound management of third-party risk for non-ICT services, extending prudential supervisory expectations beyond ICT outsourcing for EU-regulated banks and their providers.