Beyond Outsourcing - Third-Party Risk Management

On 18 September 2026, the European Banking Authority (EBA) published its final Guidelines on the sound management of third-party risk regarding non-ICT services (EBA Guidelines). The EBA Guidelines will repeal the EBA Guidelines on outsourcing arrangements published in 2019 (2019 Guidelines).

Three weeks later, on 8 October 2026, the Central Bank of Ireland (Central Bank) published Consultation Paper 173 (CP173). CP173 seeks views on proposed Guidance on Good Practices for the Sound Management of Third-Party Risks (Draft Guidance). Once finalised, the Draft Guidance will replace the Central Bank's Cross-Industry Guidance on Outsourcing published in December 2021 (2021 Guidance).

Taken together, these publications move both the European and the Irish framework away from the traditional concept of outsourcing and towards the wider risk management of all third-party dependencies. We summarise below the key changes and their likely impact on our clients.

1. The EBA Guidelines on Third-Party Risk Management

1.1         From outsourcing to third-party arrangements

The EBA Guidelines update the 2019 framework. They respond to the increasing reliance of financial entities on third-party service providers (TPSPs) and to the entry into force of the Digital Operational Resilience Act (DORA). The EBA presents the update as part of its wider simplification agenda, delivering a more proportionate framework aligned with DORA.

The most significant conceptual change is the move away from outsourcing as the organising concept. The EBA Guidelines apply to third-party arrangements generally, and outsourcing arrangements are now treated as only one subset of those arrangements. Beyond this change in scope, the core lifecycle requirements are largely carried over from the 2019 Guidelines but are now concentrated on arrangements supporting critical or important functions, with a lighter, more principles-based approach for other arrangements.

1.2         Interaction with DORA

ICT services provided by TPSPs already fall within the scope of DORA. The EBA Guidelines are therefore limited to non-ICT services. The intention is that firms take a holistic approach to third-party risk across both frameworks, with close alignment between them.

The same thinking applies to record keeping. The register of third-party arrangements under the EBA Guidelines should be consistent, as far as possible, with the DORA register of information, and firms may combine the two in one single register.

1.3         Scope

The 2019 Guidelines applied only to credit institutions and investment firms subject to the Capital Requirements Directive, payment institutions and electronic money institutions. The EBA Guidelines go further. They also cover investment firms that are not small and non-interconnected, issuers of asset-referenced tokens (ARTs), and creditors under the Mortgage Credit Directive (MCD) that are financial institutions.

1.4         Focus on critical or important functions

The EBA Guidelines concentrate on third-party arrangements that support critical or important functions (CIFs). These are functions whose disruption would materially impair the performance of a financial entity. The definition is fully consistent with the definition under DORA, and more onerous requirements apply where non-ICT services support CIFs.

For third-party arrangements that support CIFs, the EBA Guidelines cover the full lifecycle: risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies. Other arrangements are subject to a more proportionate, principles-based approach, although firms may choose to apply the stricter requirements. The Guidelines also take into account the Basel Committee on Banking Supervision's Principles for the Sound Management of Third-Party Risk.

Throughout, the management body remains responsible for the firm's activities at all times. The use of TPSPs must not leave a firm as an "empty shell" that lacks the substance to remain authorised.

1.5         When will the new EBA guidelines come into effect?

The EBA Guidelines are awaiting translation into the official languages of the EU and are not yet applicable. No application date has been set. EBA guidelines are formally issued only once they are published in all official languages. A two-month "comply or explain" period then starts, during which competent authorities, including the Central Bank, must tell the EBA whether they comply or intend to comply. Once the EBA Guidelines apply, a two-year transitional period will follow to support a smooth and proportionate implementation.

2. CP173: The Central Bank's Proposed Draft Guidance

2.1         Why is the Central Bank proposing new Guidance?

The Central Bank says it has seen significant changes since 2021 in how firms engage with third parties. These include relationships that go beyond traditional outsourcing arrangements and a changing risk environment. New international standards and European frameworks also prompted the revision, including the Basel Committee's 2024 Principles and the Financial Stability Board's toolkit on third-party risk management.

2.2         A broader scope

Like the EBA Guidelines, the Draft Guidance looks beyond outsourcing to the management of the risks associated with all third-party arrangements, described in the Draft Guidance as arrangements under which a third-party service provider, including an intragroup provider, provides services or support to a firm on an ongoing or recurring basis. The Draft Guidance specifically mentions partnerships and joint ventures and potentially creating a reliance by a firm on a third-party and therefore falling within scope. It also confirms that the Central Bank does not regard "delegation" and "outsourcing" as different concepts, because both create a reliance on a third party.

The Draft Guidance, like the 2021 Guidance, will apply to all regulated firms in Ireland.

2.3         An outcomes-based structure

The Draft Guidance is organised around 16 outcomes across five stages: governance and organisational context, due diligence and risk assessment, contracting, ongoing risk management and monitoring, and incident and termination management. Each outcome is supported by "foundational" and "supporting" good practices.

The good practices are intended to apply to a firm's critical or important third-party arrangements, unless a practice is stated to apply to all arrangements. Each firm is responsible for setting its own criteria for what is critical or important in the context of its business model.

2.4         Key risks and record keeping

The Draft Guidance gives particular attention to sub-outsourcing, intragroup arrangements, concentration risk and offshoring. This reflects recurring supervisory findings cited in CP173, including inadequate exit planning and limited oversight of sub-outsourcing.

It also sets out detailed register fields. Critical or important arrangements carry additional fields, including a substitutability assessment, recovery time objectives and the estimated annual budget cost.

2.5         Status

The Draft Guidance is described by the CBI as “non-binding”. It uses "should" to indicate the CBI’s opinion and advice on good practices that firms may consider when managing risks arising from third-party arrangements. However, the Central Bank may require firms to demonstrate that they have properly considered the topics covered in the Guidance. In practice, therefore, the Guidance will operate as a supervisory benchmark.

By contrast, CP173 describes the EBA Guidelines as “binding”. In-scope firms should expect the EBA Guidelines to be applied in practice as supervisory requirements.

3. Practical implications

Although neither publication is yet in final form, both will require significant implementation work across governance, risk, legal and operations functions.

The starting point is for each firm to establish which framework applies to it: the EBA Guidelines, DORA, the Central Bank’s Draft Guidance or a combination of these. Firms should then map each of their arrangements against the relevant framework. That exercise should extend beyond traditional outsourcing to intragroup services, partnerships and delegation arrangements, measured against the broader definition of third-party risk now adopted at both European and Irish level.

Methodologies for identifying critical or important functions should be documented, aligned with DORA where relevant, and reviewed periodically. Firms should also consider whether DORA and non-ICT information can be held in a single register, and how that register maps to the Central Bank's fields and the February 2027 collection.

Firms within the scope of the EBA Guidelines should begin a gap analysis of contracts and exit strategies for critical or important arrangements well before the two-year transitional period runs out. Firms subject only to the Draft Guidance should plan on the basis that the Guidance may apply from finalisation.  

4. What Happens next?

Responses to CP173 should be submitted by 3 December 2026 to TPRMconsultation@centralbank.ie.

The Draft Guidance is expected to be finalised and published in Q1 2027, at which point the 2021 Guidance will be considered withdrawn.

The EBA Guidelines will apply from a date to be confirmed once translations are published, subject to the two-year transitional period.

Separately, the Central Bank will resume its domestic collection of outsourcing registers, with a submission deadline of 28 February 2027 (data reference date 31 December 2026). The collection is limited to firms that submitted registers in the 2024 cycle and uses the same template. Firms also within the DORA register of information collection may leave in or remove data already submitted under DORA.

5. Conclusion

The EBA Guidelines and CP173 mark a decisive shift from outsourcing to third-party risk management, with a shared focus on critical or important arrangements. Firms should begin assessing their position under each framework. Firms for which the Draft Guidance is likely to become the primary benchmark should consider responding to CP173 by 3 December 2026.

If you have any questions arising from this briefing, please get in touch with your usual contact in the Dillon Eustace Financial Regulation team.