EBA Guidelines: Critical Functions First

On 18 September 2026, the EBA published the Final Report on Guidelines EBA/GL/2026/09 concerning the management of third-party risk regarding non-ICT services. They repeal the 2019 outsourcing guidelines and no longer work with the notion of outsourcing, but with the broader notion of a third-party arrangement, of which outsourcing is a subset. More is therefore captured than before. At the same time, the final version tiers the effort: the deeper requirements apply to arrangements that support critical or important functions. For institutions, this raises the question of which arrangements need to be reviewed first during implementation.

What changed between the draft and the final version?

The final version tiers what the draft had largely treated alike: the enhanced requirements apply to third-party arrangements supporting critical or important functions, while all others are governed by a risk-based and proportionate approach.

The underlying shift in terminology remains. A third-party arrangement is any arrangement between a financial entity and an external or intragroup service provider under which that provider supports one or more functions on a recurrent or ongoing basis. Outsourcing arrangements are explicitly a subset of these. This brings non-ICT services into scope that were previously not classified as outsourcing. Read together, the two movements give the real picture: the capture is broader, the depth of requirements is graduated.

During the consultation from 8 July 2025 to 8 October 2025, stakeholders raised concerns about an excessive expansion of scope. The industry association AMAFI criticised that the draft envisaged a regime for third parties with non-critical functions that was practically identical to the one for critical or important functions. The association FIA also pointed out that a scope drawn too broadly could complicate the assessment of critical and important functions and undermine consistency with DORA.

Which institutions and services do the guidelines apply to?

The guidelines are addressed to the competent authorities of member states and concern institutions, third-country branches, certain investment firms, payment institutions, e-money institutions, issuers of asset-referenced tokens, and certain lenders under the Mortgage Credit Directive, where these rely on third-party providers for non-ICT services. Credit intermediaries and account information service providers registered only for that service are not addressed.

Services falling under Chapter V of DORA are excluded, as a separate regime already exists for ICT third parties. Beyond that, the guidelines set out an explicit list of exclusions: services legally required to be performed by a third party such as the statutory audit, regulated financial services legally required to be performed by another supervised entity, market information services, transactions between financial institutions acting as counterparties, payment network infrastructures, clearing and settlement arrangements, supervised global financial messaging infrastructures, correspondent banking services, and purchases with no material impact on risk exposure or operational resilience such as printing, cleaning, catering or legal opinions, as well as the acquisition of goods and utilities.

The guidelines repeal the EBA outsourcing guidelines of 25 February 2019 and create a uniform EU framework, to be implemented on a ‘comply or explain’ basis. For institutions whose third-party risk governance is already tiered by criticality, the adjustment is likely to be smaller than for those that have so far managed third parties primarily through contracts.

Which third-party relationships should be reviewed first?

Priority applies to arrangements that support critical or important functions, meaning functions whose disruption would materially impair the financial performance of a financial entity, the soundness or continuity of its services and activities, or its continuing compliance with the conditions of its authorisation. The definition is aligned with Article 3(22) of DORA.

The assessment path has three steps: is the service a non-ICT service, does the provider support a function on a recurrent or ongoing basis, and is that function critical or important? A finding of ‘not an outsourcing’ therefore no longer ends the review. Operational tasks of internal control functions are to be treated as critical or important by default, unless the assessment establishes otherwise.

For these arrangements, the guidelines require enhanced due diligence, clear contractual provisions, a review of subcontracting arrangements, ongoing monitoring, complete documentation and exit planning in case a provider needs to be replaced. These requirements show that risk, control and contract are closely linked and rarely fall into place on their own. For arrangements outside this category, the final version reduces the operational and supervisory burden, while still requiring robust, risk-based governance.

How much time remains for implementation?

An exact application date has not yet been set. From that date, the guidelines apply to all third-party arrangements entered into, reviewed or amended, and existing arrangements are to be brought into line accordingly.

The widely quoted two-year period is more precise than it sounds. Where the review and documentation of arrangements supporting critical or important functions is not finalised two years after the date of application, financial entities must inform their competent authority, including the measures planned to complete the review or a possible exit strategy. For arrangements that do not support a critical or important function, review and documentation may be carried out solely on the occasion of contract renewal. The period is therefore not a deadline for everything, but a notification point for what matters. Institutions that already capture their third-party risks in a structured way as part of Operational Resilience can build on this foundation, since the guidelines are explicitly intended to align with DORA.

How should institutions proceed now?

The first step is to review the existing supplier register with the aim of flagging each arrangement according to whether it supports a critical or important function.

The second step concerns the register itself. The guidelines require an up-to-date register of all third-party arrangements in scope, distinguishing between those supporting critical or important functions and all others. It should be consistent, as far as possible, with the register of information under Article 28(3) of DORA, discrepancies between the two should be avoided, and the EBA explicitly allows both to be combined into a single register. The same applies to the policy on contractual arrangements, which may be merged with the policy under Article 28(10) of DORA, and to the monitoring role, which may be combined with the role under Article 5(3) of DORA. Institutions that have implemented DORA therefore extend existing structures rather than building a second register world.

For arrangements supporting critical or important functions, the register requires additional entries: the governing law, the dates of the most recent audits, material subcontractors including chain and location, substitutability, an assessment of reintegration with recovery time and recovery point objectives, the existence of an exit plan, alternative providers and the estimated annual cost. These entries cannot be assembled at short notice. Starting early provides more time to negotiate with providers whose contracts need to be amended. Responsibility for this initial review typically lies with the function that maintains the supplier register.

FAQ

Frequently asked questions

When were the EBA guidelines on non-ICT third-party risk published?

The EBA published the Final Report on Guidelines EBA/GL/2026/09 on 18 September 2026. This is the final version, which, compared to the consultation draft of 8 July 2025, concentrates the enhanced requirements on arrangements that support critical or important functions.

What is a third-party arrangement, and why is outsourcing only a subset?

A third-party arrangement is any arrangement between a financial entity and an external or intragroup service provider under which that provider supports one or more functions on a recurrent or ongoing basis. Outsourcing, where the provider performs a function the entity would otherwise undertake itself, is included as a subset. A finding of ‘not an outsourcing’ therefore no longer takes an arrangement out of scope.

What counts as a critical or important function under the guidelines?

A critical or important function is one whose disruption would materially impair the financial performance of a financial entity, the soundness or continuity of its services and activities, or its continuing compliance with the conditions of its authorisation. For third-party arrangements that support such functions, the guidelines require enhanced due diligence, clear contracts, monitoring, documentation and exit planning.

May the new register be merged with the DORA register of information?

Yes. The register for non-ICT arrangements should be consistent, as far as possible, with the register of information under Article 28(3) of DORA, discrepancies should be avoided, and both may be combined into a single register. The policy on contractual arrangements may likewise be merged with the policy under Article 28(10) of DORA.

Do the new guidelines replace the previous 2019 EBA outsourcing guidelines?

Yes, the guidelines repeal the EBA outsourcing guidelines of 25 February 2019 and create a uniform EU framework. Implementation follows the ‘comply or explain’ principle applied by the competent authorities of member states.

Which institutions are affected by the EBA guidelines?

Affected are institutions, third-country branches, certain investment firms, payment institutions, e-money institutions, issuers of asset-referenced tokens, and certain lenders under the Mortgage Credit Directive, provided they rely on third-party providers for non-ICT services. Credit intermediaries and account information service providers registered only for that service are not addressed.

Which services are excluded?

Excluded are services under Chapter V of DORA, together with an explicit list: services legally required to be performed by a third party such as the statutory audit, regulated financial services performed by another supervised entity, market information services, interbank transactions, payment network infrastructures, clearing and settlement, supervised global financial messaging infrastructures, correspondent banking services, purchases with no material impact on risk or resilience, and the acquisition of goods and utilities.

Sources

1. Final report on Guidelines on the sound management of third-party risk related to non-ICT services (EBA/GL/2026/09)European Banking Authority (EBA)
2. The EBA publishes its final Guidelines on the management of third-party riskEuropean Banking Authority (EBA)
3. Final report: EBA guidelines on the sound management of third-party risk regarding non-ICT servicesGlobal Regulation Tomorrow
4. EBA launches consultation on its draft guidelines on third-party risk managementEuropean Banking Authority (EBA)