“Not an outsourcing” used to end the assessment. Now it starts one.

Over the next forty-eight hours you will read a dozen summaries of the new EBA guidelines. They will all be correct. They will all say the same thing: broader concept, critical or important functions as the new yardstick, a bigger register, alignment with DORA. Tick. Move on. This is not one of them.

What changes in the plumbing, not in the text

1. The first question is a different question now

For fifteen years, everything in a supervised institution hung on a single question: is this an outsourcing, yes or no? That question was a gate. If the answer was no, the file was closed: no contractual clauses, no register entry, no notification, no report to the board.

The new guidelines don’t abolish the question. They demote it. Outsourcing is now, in the EBA’s own words, a subset of the third-party arrangement. It survives as a label, not as a gate.

The new gate has three steps (para 31): is this a non-ICT service? Does it support a function on a recurrent or ongoing basis? And is that function critical or important?

That is not a definitional nicety. That is different plumbing. Because the place where the first question actually gets asked is not the compliance function. It is procurement, where a contract is born. The EBA has written a letter to a function that does not normally read EBA letters.

2. The border with DORA is drawn by you

The guidelines cover non-ICT services. But what about a service that is both: a business process run on the provider’s own platform?

The answer is in para 32, and it is remarkably unsupervised: it belongs to the financial entity to determine whether the use of the ICT service is material to the provision of the arrangement, and therefore triggers DORA. Two frameworks, one judgement call, and the judgement is yours. Not the regulator’s, not the provider’s.

And in case anyone hoped “non-ICT” meant “IT-free”: para 58 pulls the ICT subcontractors that effectively underpin a critical non-ICT service straight back into your register.

3. Proportionality is a documented decision, not an omission

The EBA presents the focus on critical or important functions as relief. It is, but only for what happens after the assessment. For whether you have to look at all, it isn’t.

Cleaning, catering, office supplies, legal opinions: excluded. But the general exclusion is itself a materiality test, covering services without material impact on risk exposures or operational resilience (para 33). That is a judgement you make and must be able to defend. A footnote on the same page notes, drily, that exclusion does not mean the risk in those arrangements goes unmanaged.

And criticality is not a stamp you apply once. Where the risk, nature or scale of a function materially changes, the classification must be reassessed. Where a function becomes critical, the supervisor must be informed in a timely manner (para 65). So the honest question about your own house is not whether you classified correctly today. It is: who notices when that changes?

The questions with teeth

4. The mandatory field whose permitted value is “impossible”

It is not every day that a regulator builds you a form field and provides “impossible to substitute” as one of the answers.

For arrangements supporting critical or important functions, the register requires the outcome of the last substitutability assessment on a four-point scale: easy, medium, highly complex, or impossible to substitute (para 62(d)). Plus the assessment of whether the function could be reintegrated, with the recovery time objective and recovery point objective of the function (62(e)). Whether an exit plan exists, yes or no (62(f)). Alternative providers, where possible (62(g)). And the estimated annual cost (62(h)).

Translated: the supervisor is asking you to write down, line by line, where you are cornered, and what it costs to stand there. They know that for some services there is no second address. They ask anyway. That tells you what this register is really being built for.

Then there is the transition period everyone will call generous. It is something else. If the review and documentation of your critical arrangements is not finished after two years, you must tell your competent authority, including the measures planned, or the possible exit strategy (para 20). A transition period with a self-report attached is not a grace period. It is a deadline.

5. Intragroup is not a discount

The definition of a third-party arrangement names intragroup providers explicitly. The policy must differentiate between intragroup and external arrangements (para 49). Differentiate does not mean exempt.

Which means the shared service centre you built six years ago for efficiency is now a register entry with a substitutability rating, an exit plan, and the uncomfortable question of whether it would still stand up if other parts of the group did not. Efficiency creates a documentation obligation. No summary will say that, because nobody enjoys it.

6. One function inventory, or three that disagree

The definition of a critical or important function is deliberately aligned with DORA. The guidelines refer repeatedly to business continuity plans and to the internal audit function. For entities in scope of the recovery and resolution framework, they demand particular attention where an arrangement touches critical functions and core business lines (para 37). And competent authorities are to inform the resolution authority of newly identified, potentially critical functions.

Nowhere does any of it say: maintain one authoritative function inventory. Every one of these regimes assumes you have one.

In practice, the list exists three times: the critical processes from the business impact analysis, the critical or important functions under DORA, and now the functions in scope of these guidelines. If those three don’t reconcile, you don’t have a data problem. You have three different answers to the same supervisory question, and sooner or later somebody will put two of them side by side.

What this is actually good for

7. Your register has stopped being read by a human

The register must be made available on request in processable electronic form, expressly in the format set out under the DORA implementing standards (para 63). It should be consistent with the DORA register and may be merged with it (para 61). Title V requires competent authorities to identify concentration not only within an institution but at sector level, and to exchange that information.

That is not a reporting format. That is a dataset. What is being assembled, row by row, is a dependency map of the European financial system, and your institution is a row in it.

So the uncomfortable question is not whether you can file the register. It is whether you can read your own map as well as your supervisor is about to read it.

8. The sentence on page 10

And here it is, said out loud after all, in the background and rationale, paragraph 17, on page 10 of a document whose actual rules only begin on page 13. Which is to say, exactly where summaries rarely go:

Overreliance on third-party service providers supporting critical or important functions is likely to impact the conditions for authorisation and to heighten both concentration risks and the risk of creating “empty shells” that would lack the substance to remain authorised.

That is not a sentence about operational risk. That is a sentence about your licence.

The EBA is not worried about your vendor file. It is worried about institutions that have handed out so much of themselves that there is no longer enough left to supervise. Everything else in these guidelines, the register, the substitutability rating, the exit plans, the notifications, is instrumentation for that one worry.

And if that is the question, then the answer is not a better register. The answer is being able to say, at any moment, which functions you still perform yourself.

9. None of this is new data

Here is the real finding, and it is more encouraging than the rest.

Almost everything these guidelines ask for already exists inside your institution. The contractual data is in the contracts. The criticality is in the business impact analysis. The risk assessment is in the risk register. The effectiveness evidence is in the control tests. The weaknesses are in the audit findings. The data protection consequences are in the processing records, and para 72 names the GDPR explicitly. The cost is in procurement. The provider profile is in the third-party process.

It all exists. In seven places, in seven formats, owned by seven people, updated on seven different rhythms.

These guidelines do not ask you to produce new information. They ask you to have the same information in one shape.

And that is the opportunity no summary will mention. Connect those dots once, and you are not just answering a supervisor. On the same afternoon you also answer your clients’ due diligence questionnaires, your board’s question about the largest dependencies, and procurement’s question about what should be renegotiated in the next twelve months. Maintain once, use many times: that is not an efficiency argument. That is the difference between a compliance obligation and a basis for decisions.

And if you are supervised in Switzerland?

Then none of this applies to you. The EBA guidelines address institutions in the EU and EEA; the FINMA outsourcing circular stays where it is.

The standard reaches you anyway, through three doors.

First, through your own entities in the EU, where it applies directly.

Second, and this is the door that opens first, through your clients. An EU-supervised institution that uses you as a provider has to assess your substitutability, know your subcontracting chain, state the country of performance and hold an exit plan. It gets that information from you. So you will be measured against this standard long before any Swiss authority asks for it, not as an addressee, but as a row in somebody else’s register.

Third, through convergence. Anyone who has watched the last fifteen years knows the pattern.

The question is not whether these guidelines apply to you. It is how fast you can answer when a client asks. And they will ask, because the rules oblige them to.

Four questions before the clock starts

The guidelines are final; the date of application will be fixed on publication, and the two-year period runs from there. That is not a lot of time, which is why it is worth starting with four questions, none of which needs a project.

One: who asks the first question today, and does that person know it has changed? If the answer is “procurement”, that is not a failing. That is where the work starts.

Two: can you produce a single function list that BCM, DORA and these guidelines would all accept? If not, this is the cheapest and highest-leverage move in the entire programme.

Three: for your ten largest non-ICT dependencies, what would you honestly put in the substitutability field? Not what looks good. What is true.

Four: if a supervisor asked tomorrow which functions you still perform yourself, how long would the answer take? That question does not measure your documentation. It measures your substance.

None of these needs a budget. All four need an afternoon and the right people in the room.

At Swiss GRC we spend our days on exactly these questions, with supervised institutions that no longer want contracts, third parties, functions, controls, continuity and audit findings living in seven separate folders, but in one picture. If any of those four questions makes you uncomfortable, that is a good reason for a conversation. Not for a demo, for a conversation.

The regulator defines the dots. Connecting them was never their job. It’s yours.

FAQ

Frequently asked questions

Is it still enough to establish that a service is not an outsourcing?

No. Under the guidelines, outsourcing is a subset of the third-party arrangement and therefore a label, not an exclusion criterion. What matters is the three-step test: a non-ICT service, supporting a function on a recurrent or ongoing basis, and the criticality of that function.

Who decides where the border with DORA runs for mixed services?

The institution itself. Under para 32 it belongs to the financial entity to determine whether the use of the ICT service is material to the provision of the arrangement and therefore triggers the DORA framework. It is a judgement call that must be defensible.

Are intragroup providers exempt from the requirements?

No. The definition of a third-party arrangement names intragroup providers explicitly. The policy must differentiate between intragroup and external arrangements, which allows differentiated treatment but creates no exemption.

What exactly does the two-year transition period mean?

If the review and documentation of arrangements supporting critical or important functions is not complete two years after the date of application, the competent authority must be informed, including the measures planned or a possible exit strategy. For arrangements without a critical function, review and documentation may follow at contract renewal.

Do the guidelines apply to Swiss institutions?

Not directly, as they address institutions in the EU and EEA. They become relevant through your own EU entities, through convergence, and above all through EU clients who need your substitutability, subcontracting chain, country of performance and exit plan for their own register.

This article is professional commentary, not legal advice. The text of the guidelines governs.

Sources

1. Final report on Guidelines on the sound management of third-party risk related to non-ICT services (EBA/GL/2026/09)European Banking Authority (EBA)
2. The EBA publishes its final Guidelines on the management of third-party riskEuropean Banking Authority (EBA)
3. EBA guidelines: critical functions firstSwiss GRC