The European Banking Authority has finalised new Guidelines for managing third-party risk from non-ICT services, creating a framework designed to sit alongside the Digital Operational Resilience Act's treatment of ICT third-party risk. Published on 18 September, the Guidelines focus particularly on third-party arrangements supporting critical or important functions, where disruption could materially impair a financial entity, with more extensive requirements applying to those arrangements while the EBA seeks to reduce unnecessary burdens for less material ones.
For financial entities, the first question is therefore not simply whether they use an outside provider. They need to determine what kind of service is being provided, whether it falls within DORA's ICT framework or the EBA's non-ICT framework, and whether the service supports a critical or important function. Those distinctions determine how the third-party relationship needs to be governed and monitored.
DORA already provides the EU framework for managing third-party risk associated with ICT services, while the new EBA Guidelines deal with third-party arrangements involving services other than ICT. The EBA has deliberately sought consistency between the two regimes so financial entities can take a more holistic approach to third-party risk rather than operating entirely separate systems for ICT and non-ICT relationships.
The distinction means the new Guidelines should not simply be described as DORA being extended to non-ICT services. They are separate EBA Guidelines covering non-ICT third-party arrangements, but their structure has been closely aligned with DORA, particularly around risk assessment, contractual arrangements, monitoring, documentation and the treatment of services supporting critical or important functions.
One of the most important assessments is whether a third-party arrangement supports a critical or important function, or CIF. The EBA's definition focuses on functions where disruption, defective performance or failure could materially impair the financial entity, including through its financial performance, the soundness or continuity of its activities and services, or its continuing compliance with the conditions and obligations attached to its authorisation.
That classification matters because arrangements supporting critical or important functions face more extensive requirements under the Guidelines. The EBA's approach is intended to concentrate the more demanding controls on higher-risk relationships while allowing proportionality for less material arrangements, although that does not mean non-CIF arrangements can simply be ignored. They remain part of the broader third-party-risk framework where they fall within its scope.
Another important distinction is between a third-party arrangement and traditional outsourcing. Under the EBA framework, outsourcing sits within the wider category of third-party arrangements rather than defining the entire perimeter, meaning firms cannot necessarily rely on an existing outsourcing inventory as a complete picture of the relationships covered by the new framework.
The relevant exercise is broader because firms need to identify in-scope non-ICT third-party arrangements before determining the risk and criticality attached to them. That does not mean every purchase from an outside supplier becomes a critical third-party arrangement, as the framework contains scope distinctions and exclusions and applies a proportionate approach according to the nature and risk of the relationship.
Among the activities identified outside the relevant third-party arrangement perimeter are certain statutory audit activities, specified regulated financial services, payment and financial-market infrastructure arrangements and a range of ancillary services. The EBA nevertheless makes clear that exclusion from these Guidelines does not necessarily mean that risks associated with those services can be disregarded.
Using a third-party provider does not transfer the financial entity's management responsibilities to that provider. The Guidelines require firms to retain sufficient governance, expertise and resources to understand and oversee externally supported functions, preventing extensive reliance on third parties from leaving an entity without the substance required to control its own activities.
The management body remains responsible for the entity and its third-party-risk framework, including where arrangements are made with another company in the same group. Firms therefore need sufficient internal capability to identify, assess, monitor and manage the risks created by their third-party relationships and to challenge a provider's performance where necessary.
Documentation forms an important part of the framework because financial entities are expected to maintain an updated register of third-party arrangements within scope and distinguish those supporting critical or important functions from other arrangements. The EBA has designed this requirement to be consistent with DORA's register requirements, allowing ICT and non-ICT information to be coordinated and potentially maintained within a single register.
Using a combined register does not remove the underlying classification exercise. Firms still need to distinguish ICT arrangements governed by DORA from non-ICT arrangements covered by the EBA Guidelines and identify which of those non-ICT relationships support critical or important functions, as those classifications affect the controls that need to be applied.
The framework extends beyond provider selection and the signing of a contract, covering the lifecycle of third-party arrangements through risk assessment, due diligence, contracting, subcontracting, ongoing monitoring, documentation and exit planning. This is particularly significant for arrangements supporting critical or important functions because firms need to consider what happens if the provider fails, becomes unavailable or can no longer provide the service on acceptable terms.
Business continuity and exit planning therefore form part of third-party-risk management rather than being issues considered only after a relationship has deteriorated. For relevant critical or important functions, firms need to consider their ability to move the service to another provider, bring the activity back within the organisation or otherwise discontinue the dependent activity within an appropriate timeframe.
Subcontracting also needs to be considered where it affects the delivery of the service. The contractual framework must give firms sufficient visibility and control over material changes in subcontracting arrangements, particularly where those changes could affect a critical or important function.
Assessing providers individually may not reveal the full exposure because a financial entity can become dependent on the same provider, a limited group of providers or closely connected providers across several activities. The EBA therefore treats concentration risk as part of the wider third-party-risk framework, particularly where replacing a provider would be difficult or several important activities depend on the same organisation.
The issue also has a supervisory dimension because similar dependencies can exist across multiple financial entities. The Guidelines therefore give supervisors a basis for examining concentrations in third-party arrangements, while firms themselves need to understand whether apparently separate relationships create a larger dependency when considered together.
The EBA's 18 September announcement says a two-year transitional period will support implementation, but that should not be interpreted as a deadline running automatically from the publication date. The EBA's regulatory page currently describes the final report as “Not yet applicable” and does not yet specify an application date or compliance deadline, meaning Finance Gazette should not calculate a September 2028 deadline from the information currently available.
The final Guidelines themselves connect the transitional treatment of existing arrangements supporting critical or important functions to the date of application, rather than simply to the date on which the final report was published. The existing 2019 EBA Guidelines on outsourcing arrangements are also due to be repealed when the new framework takes effect, so the formal application date remains an important part of the wider regulatory timetable that firms will need to monitor.
For affected financial entities, implementation begins with understanding their third-party relationships and correctly classifying them. They need to establish which arrangements fall within the non-ICT framework, distinguish those services from ICT arrangements governed by DORA and then determine which non-ICT arrangements support critical or important functions before applying the appropriate governance and risk-management requirements.
That classification affects the subsequent approach to due diligence, contractual safeguards, subcontracting, monitoring, documentation, business continuity and exit planning. The significance of the EBA's final Guidelines is therefore broader than simply replacing an outsourcing rulebook: they establish a wider framework for non-ICT third-party dependencies while maintaining the regulatory boundary between those services and the ICT third-party risks already addressed by DORA.
