1. Introduction
On the 18th of September 2026, the European Banking Authority (“EBA”) published its final Guidelines on the sound management of third-party risk related to non-ICT services by financial institutions (the “Guidelines”). Once applicable, the Guidelines will repeal and replace the 2019 Guidelines on outsourcing arrangements. Their application date will be confirmed following their translation into the EU official languages.
The Guidelines mark a shift in the EBA’s approach to third-party risk. Moving beyond the traditional concept of outsourcing, they introduce a more comprehensive framework for managing risks arising from financial institutions’ increasing reliance on third-party service providers (“TPSPs”), while placing proportionality at the heart of the new regime.
The Guidelines complement the regulatory framework established by the Digital Operational Resilience Act (“DORA”). Whereas DORA governs third-party risk relating to ICT services, the new Guidelines establish a corresponding framework for non-ICT services, thereby promoting a holistic approach to third-party risk management across in-scope financial institutions.
While the content of the Guidelines has been fixed, they still must be finalised and published. Therefore, their date of application is not yet known.
2. What is changing?
The Guidelines implement three key changes.
First, moving away from the concept of outsourcing, they extend the scope of third-party risk management obligations to the broader group of third-party service providers (“TPSPs”).
The Guidelines now cover recurrent or ongoing arrangements under which a TPSP supports a financial institution’s functions, including where the arrangement does not qualify as outsourcing. Outsourcing remains in scope, but as a subset of the broader category of third-party arrangements.
Second, the new framework applies to a wider range of financial institutions: alongside CRD institutions, payment- and electronic money institutions, the Guidelines now also apply to issuers of asset-referenced tokens, certain investment firms and third-country branches.
Third, although the Guidelines largely mirror the structure and content of their predecessors, they strengthen the approach to third-party risk management, notably by further developing monitoring as a distinct component of the framework. They also introduce a two-tier approach to mandatory contractual provisions, inspired by Article 30 DORA, with stricter requirements applying to arrangements supporting critical or important functions (“CIFs”).
3. What should financial institutions do now?
As a principle, the Guidelines will apply to all TPSP arrangements entered into after their date of application (still to be set).
Regarding existing arrangements, the Guidelines differentiate between arrangements supporting CIFs and those that do not. Arrangements supporting CIFs should be brought into compliance within two years as from the date of application of the Guidelines. Arrangements supporting other functions must be updated the first time they are amended or reviewed after the date of application of the Guidelines.
Financial institutions should thus not wait to start preparing. The shift from outsourcing to broader third-party risk management may bring arrangements that have so far fallen outside outsourcing frameworks within the scope of internal governance, monitoring and documentation requirements.
More particularly, they should identify affected arrangements, assess their criticality, and determine where existing policies, contractual frameworks, registers and exit strategies will need to be adapted. In parallel, institutions should consider how to align the new non-ICT framework with their existing DORA processes.
The new Guidelines are not simply an update to the outsourcing framework: they require financial institutions to rethink third-party risk beyond outsourcing and across their organisation.
If you have any questions or would like to discuss the impact of the new EBA Guidelines on your third-party arrangements, feel free to reach out to us at digitalfinance@simontbraun.eu.
***
This newsletter does not constitute legal advice or a legal opinion. Please consult with a legal counsel of your choice before taking any action based on the information provided.