Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09): final report

What it contains

The final report on the European Banking Authority’s (EBA) guidelines, EBA/GL/2026/09, published on 18 September 2026, sets out how credit institutions, certain investment firms, payment and electronic money institutions and issuers of asset-referenced tokens should manage the risks of service providers that are not information and communication technology (ICT) providers. It starts from the fact that the use of third parties is one of the main drivers of operational risk and that the traditional notion of outsourcing should be broadened to third-party arrangements in general. ICT services fall within the scope of the DORA Regulation; these guidelines cover the rest, with particular attention to those that support critical or important functions, whose definition is consistent with DORA’s.

The guidelines are organized around proportionality, the assessment of third-party arrangements, the governance framework (policies, conflicts of interest, business continuity plans, internal audit and documentation), pre-contractual analysis (supervisory conditions, risk assessment and due diligence), the contractual phase (subcontracting, access, information and audit rights, and termination rights), monitoring and exit strategies. Where services support critical or important functions, stricter provisions apply. A separate title is addressed to competent authorities, which must supervise these arrangements, identify and monitor concentration risk and assess whether it could threaten the stability of the financial system.

The guidelines repeal the EBA guidelines on outsourcing of 25 February 2019. They apply to third-party arrangements entered into, reviewed or amended from the date of application, which the report leaves to be set; entities must review existing arrangements and, if the review of those supporting critical or important functions is not finished within two years of that date, inform their competent authority with the planned measures or the possible exit. Arrangements that do not support critical or important functions may be reviewed at renewal. The report also includes the impact assessment and the feedback on the public consultation.

Summary prepared by the Dominican Republic Risk Management Club from a reading of the original document, with the source verified on 12 October 2026. It does not replace reading the official text and is not advice.

See all publications