EBA/GL/2026/09: EBA third-party risk guidelines to replace 2019 outsourcing guidelines

On 18 September 2026 the European Banking Authority published its final report on Guidelines on the sound management of third-party risk related to non-ICT services, reference EBA/GL/2026/09. The guidelines cover third-party arrangements across their life cycle, from risk assessment and due diligence to contracting, subcontracting, monitoring, documentation and exit. Outsourcing arrangements are treated as a subset of third-party arrangements.

ICT services are excluded because they fall within the Digital Operational Resilience Act (DORA); the guidelines apply to non-ICT services, but firms should take a holistic approach to both. The EBA Guidelines on outsourcing of 25 February 2019 are repealed with effect from the date of application. Competent authorities and financial institutions must make every effort to comply, and national supervisors must tell the EBA whether they comply or intend to comply.

The guidelines are addressed to competent authorities and to credit institutions, third-country branches, investment firms other than small and non-interconnected investment firms, payment institutions, electronic money institutions, issuers of asset-referenced tokens and certain mortgage creditors, as well as approved financial holding companies and mixed financial holding companies. Class 1 minus and Class 2 investment firms apply them without prejudice to the outsourcing requirements of MiFID II and Delegated Regulation (EU) 2017/565 and to relevant ESMA guidance.

Crypto-asset service providers are not addressees; the EBA notes that Article 73 of MiCA regulates their outsourcing. UCITS management companies and AIFMs are not addressees either, although the guidelines apply on a consolidated and sub-consolidated basis, which can include them where they are part of a banking or investment-firm group's prudential scope of consolidation.

A function is critical or important where its disruption would materially impair the firm's continuing compliance with its authorisation or other obligations, its financial performance, or the soundness or continuity of its services and activities. Operational tasks of internal control functions should always be considered critical or important unless the firm's assessment shows otherwise. Some services are excluded, such as services legally required to be performed by a third party (for example the statutory audit), market information services and the purchase of goods or utilities.

The management body should approve a written policy on non-ICT services supporting critical or important functions and review it at least once a year, and the firm should assign a role or a member of senior management to oversee third-party risk. Relying on third parties takes no responsibility away from the management body, and firms should not become 'empty shells'. Firms should keep a register of all third-party arrangements, consistent as far as possible with the DORA register of information and possibly combined with it, inform their competent authority in a timely manner of planned arrangements for critical or important functions, and be able, within an appropriate time, to move such a function to another provider, bring it back in-house or discontinue the business activities that depend on it. See our study note on outsourcing critical functions.

Not yet. The EBA lists the guidelines as final and awaiting translation into the official EU languages and as not yet applicable, and the final report leaves the date of application blank. From that date they apply to all third-party arrangements entered into, reviewed or amended, and firms should review and amend existing arrangements to bring them into line.

Where the review and documentation of existing arrangements supporting critical or important functions is not finalised within two years of the date of application, firms should inform their competent authority, including the measures planned to complete the review or the possible exit strategy. Arrangements supporting other functions may be reviewed and documented when they are renewed.