{"id":53915,"date":"2025-07-14T18:57:05","date_gmt":"2025-07-14T16:57:05","guid":{"rendered":"https:\/\/swissgrc.com\/ar\/?p=53915"},"modified":"2026-08-20T16:04:44","modified_gmt":"2026-08-20T14:04:44","slug":"tprm-under-new-rules-eba-dora-and-marisk-explained","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/","title":{"rendered":"TPRM under new rules: EBA, DORA and MaRisk explained"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"53915\" class=\"elementor elementor-53915\" data-elementor-settings=\"{&quot;ha_cmc_init_switcher&quot;:&quot;no&quot;}\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-35a9138 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"35a9138\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-73cd8ab\" data-id=\"73cd8ab\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5b9f303 tt elementor-widget elementor-widget-text-editor\" data-id=\"5b9f303\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong><\/strong><\/p>\n<p class=\"wp-block-paragraph\"><strong>The regulatory landscape for Third-Party Risk Management (TPRM) is undergoing a fundamental transformation. With the new EBA Guideline, the DORA Regulation, and the anticipated revision of MaRisk, financial institutions are required to strategically realign their outsourcing and risk governance practices. The Deggendorf Note 2025\/06 delivers a thorough analysis of this shift and leaves no doubt: Excel spreadsheets and siloed solutions are no longer sufficient.<\/strong><\/p>\n<p class=\"\" data-start=\"883\" data-end=\"1269\">The foundation of the <a href=\"https:\/\/th-deg.de\/Fakult%C3%A4ten\/ai\/bdo-stiftungsprofessur\/deggendorfer-notiz\/Deggendorfer%20Notiz%202025-06%20-%20Auswirkungen%20der%20EBA-Guidelines%20zum%20Third-Party%20Risk%20Management.pdf\">Deggendorf Note 2025\/06 by Prof. Dr. Andreas Igl<\/a> is the <a href=\"https:\/\/www.eba.europa.eu\/sites\/default\/files\/2025-07\/33a0ee15-9601-4c2b-828e-1b09201a6e9f\/CP%20on%20Draft%20Guidelines%20on%20sound%20management%20of%20third%20party%20risk.pdf\">Consultation Paper published by the European Banking Authority (EBA) in July 2025<\/a>. This document is the first to clearly outline the comprehensive regulatory requirements for managing risks arising from non-ICT third-party arrangements, and it directly complements the <a href=\"https:\/\/swissgrc.com\/dora\">DORA Regulation (EU 2022\/2554)<\/a>, which came into force in January 2025. In combination with the existing MaRisk AT 9 framework in Germany, this creates substantial implications for third-party and outsourcing governance in the financial sector.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-570026f elementor-widget elementor-widget-text-editor\" data-id=\"570026f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>A three-pillar regulatory model: EBA guideline, DORA and MaRisk<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8d0b1e elementor-widget elementor-widget-text-editor\" data-id=\"f8d0b1e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p data-start=\"1570\" data-end=\"1800\">With the publication of the new EBA Guideline on the management of third-party risks (non-ICT) and the now fully applicable DORA Regulation, for the first time there is a clearly structured European framework for TPRM.<\/p>\n<ul data-start=\"1802\" data-end=\"2138\">\n<li data-start=\"1802\" data-end=\"1868\">\n<p data-start=\"1804\" data-end=\"1868\">DORA targets ICT third-party providers and their resilience.<\/p>\n<\/li>\n<li data-start=\"1869\" data-end=\"2004\">\n<p data-start=\"1871\" data-end=\"2004\">The EBA Guideline focuses on non-ICT third-party providers, particularly when delivering critical or important functions.<\/p>\n<\/li>\n<li data-start=\"2005\" data-end=\"2138\">\n<p data-start=\"2007\" data-end=\"2138\">The German MaRisk AT 9, long used as a national standard, will likely be revised in alignment with these European developments.<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2140\" data-end=\"2412\"><strong data-start=\"2143\" data-end=\"2184\">Key insight from the Deggendorf Note: <\/strong>Managing outsourcing only from an operational or administrative perspective is no longer sufficient. Going forward, functional criticality will take centre stage \u2014 regardless of ICT involvement or contractual formalities.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bca54c3 elementor-widget elementor-widget-text-editor\" data-id=\"bca54c3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\n<p class=\"wp-block-paragraph\">The first strategic decision: ICT or non-ICT?<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-102a066 elementor-widget elementor-widget-text-editor\" data-id=\"102a066\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p data-start=\"2473\" data-end=\"2670\">According to the Deggendorf Note, the distinction between ICT and non-ICT services will now be the initial decision point in any third-party risk assessment. This classification determines:<\/p>\n<ul data-start=\"2672\" data-end=\"2856\">\n<li data-start=\"2672\" data-end=\"2734\">\n<p data-start=\"2674\" data-end=\"2734\">which regulatory framework applies (DORA vs. EBA Guideline),<\/p>\n<\/li>\n<li data-start=\"2735\" data-end=\"2787\">\n<p data-start=\"2737\" data-end=\"2787\">how third parties must be assessed and documented,<\/p>\n<\/li>\n<li data-start=\"2788\" data-end=\"2856\">\n<p data-start=\"2790\" data-end=\"2856\">and which monitoring, governance, and reporting obligations arise.<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2858\" data-end=\"3120\">This distinction requires robust governance structures that enable risk-based classification across the entire organisation. The responsibility increasingly lies at the <strong>executive level<\/strong>, as identifying critical functions has now become a strategic task.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d252e6f elementor-widget elementor-widget-text-editor\" data-id=\"d252e6f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\n<p class=\"wp-block-paragraph\">From outsourcing to function-based risk: TPRM becomes strategic<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d370f42 elementor-widget elementor-widget-text-editor\" data-id=\"d370f42\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p data-start=\"3199\" data-end=\"3452\">A paradigm shift is taking place: The legal concept of outsourcing is no longer at the core \u2014 instead, the focus is now on the function being supported by the third party. This change has a significant impact on how risk is assessed and managed:<\/p>\n<ul data-start=\"3454\" data-end=\"3736\">\n<li data-start=\"3454\" data-end=\"3509\">\n<p data-start=\"3456\" data-end=\"3509\">Evaluation is function-based, not contract-based.<\/p>\n<\/li>\n<li data-start=\"3510\" data-end=\"3620\">\n<p data-start=\"3512\" data-end=\"3620\">Criticality is defined by the importance to the business model, not by time sensitivity or volume alone.<\/p>\n<\/li>\n<li data-start=\"3621\" data-end=\"3736\">\n<p data-start=\"3623\" data-end=\"3736\">The principle of proportionality allows tailored implementation, based on institution type and risk exposure.<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"3738\" data-end=\"3906\"><strong data-start=\"3741\" data-end=\"3781\">Conclusion from the Deggendorf Note:<\/strong><br data-start=\"3781\" data-end=\"3784\" \/>The traditional operational view must give way to a strategic and risk-oriented governance model for third-party risk.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8a6238f elementor-widget elementor-widget-text-editor\" data-id=\"8a6238f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\n<p class=\"wp-block-paragraph\">Excel no longer enough: Stronger oversight and reporting required<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6566230 elementor-widget elementor-widget-text-editor\" data-id=\"6566230\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p data-start=\"3987\" data-end=\"4254\">The Deggendorf Note openly criticises the fact that many institutions continue to manage third-party relationships using Excel spreadsheets and fragmented documentation. This approach is no longer sufficient to meet the new regulatory expectations, which include:<\/p>\n<p data-start=\"4256\" data-end=\"4271\">Under DORA:<\/p>\n<ul data-start=\"4273\" data-end=\"4443\">\n<li data-start=\"4273\" data-end=\"4326\">\n<p data-start=\"4275\" data-end=\"4326\">A central ICT third-party register (Art. 28),<\/p>\n<\/li>\n<li data-start=\"4327\" data-end=\"4382\">\n<p data-start=\"4329\" data-end=\"4382\">Resilience testing and audits of ICT providers,<\/p>\n<\/li>\n<li data-start=\"4383\" data-end=\"4443\">\n<p data-start=\"4385\" data-end=\"4443\">Mandatory incident reporting to supervisors (Art. 19).<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"4445\" data-end=\"4483\">Under the EBA Guideline (non-ICT):<\/p>\n<ul data-start=\"4485\" data-end=\"4692\">\n<li data-start=\"4485\" data-end=\"4562\">\n<p data-start=\"4487\" data-end=\"4562\">Comprehensive contract requirements, including KPIs and audit rights,<\/p>\n<\/li>\n<li data-start=\"4563\" data-end=\"4614\">\n<p data-start=\"4565\" data-end=\"4614\">Emphasis on function-based risk assessment,<\/p>\n<\/li>\n<li data-start=\"4615\" data-end=\"4692\">\n<p data-start=\"4617\" data-end=\"4692\">Governance expectations that cover the entire third-party supply chain.<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"4694\" data-end=\"4841\">The message is clear: <strong>Institutions are strongly encouraged to professionalise and digitise their third-party risk management processes.<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b7ef7e0 elementor-widget elementor-widget-text-editor\" data-id=\"b7ef7e0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\n<p class=\"wp-block-paragraph\">From regulation to implementation: Technology as enabler<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8b90e73 elementor-widget elementor-widget-text-editor\" data-id=\"8b90e73\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p data-start=\"4913\" data-end=\"5220\">Although the Deggendorf Note maintains a technology-neutral tone, its analysis implies a clear course of action:<br data-start=\"5025\" data-end=\"5028\" \/>Third-party risk governance must transition to structured, tool-supported systems. Only with such systems can institutions ensure transparency, auditability, traceability, and scalability.<\/p>\n<p data-start=\"5222\" data-end=\"5272\">Swiss GRC offers a modular TPRM solution that:<\/p>\n<ul data-start=\"5274\" data-end=\"5545\">\n<li data-start=\"5335\" data-end=\"5412\">\n<p data-start=\"5337\" data-end=\"5412\">Provides an integrated, centralised Third-Party Information Register,<\/p>\n<\/li>\n<li data-start=\"5413\" data-end=\"5481\">\n<p data-start=\"5415\" data-end=\"5481\">Supports risk-based classification and governance workflows,<\/p>\n<\/li>\n<li data-start=\"5482\" data-end=\"5545\">\n<p data-start=\"5484\" data-end=\"5545\">Enables consistent documentation and automated reporting.<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"5547\" data-end=\"5723\">Learn more about Swiss GRC\u2019s TPRM Solution: <a href=\"https:\/\/swissgrc.com\/en\/tprm-software\"><strong data-start=\"5596\" data-end=\"5652\">Manage third-party risk securely and with confidence<\/strong><\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-20a59c1 elementor-widget elementor-widget-text-editor\" data-id=\"20a59c1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\n<p class=\"wp-block-paragraph\">A governance priority: TPRM as a core discipline<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7f072fd elementor-widget elementor-widget-text-editor\" data-id=\"7f072fd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p data-start=\"5787\" data-end=\"6179\">The Deggendorf Note 2025\/06 clearly shows that managing third-party relationships is becoming a core governance competency in the financial industry.<br data-start=\"5944\" data-end=\"5947\" \/>The regulatory expectations from DORA, the new EBA Guideline, and upcoming revisions to MaRisk require organisations to completely rethink their outsourcing strategies \u2014 strategically, systematically, and risk-based.<\/p>\n<p data-start=\"6181\" data-end=\"6334\">Those who act now will not only strengthen their regulatory resilience, but also ensure their long-term digital and organisational viability.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>The regulatory landscape for Third-Party Risk Management (TPRM) is undergoing a fundamental transformation. With the new EBA Guideline, the DORA Regulation, and the anticipated revision of MaRisk, financial institutions are required to strategically realign their outsourcing and risk governance practices. The Deggendorf Note 2025\/06 delivers a thorough analysis of this shift and leaves no doubt: Excel spreadsheets and siloed solutions are no longer sufficient.<\/p>\n","protected":false},"author":8,"featured_media":53917,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Yahya Mohamed Mao","real_author_title":"Chief Marketing Officer","real_author_bio":"Yahya Mohamed Mao is Chief Marketing Officer and Member of the Executive Board at Swiss GRC. In this role, he drives the company's global marketing and communications strategy, shaping brand positioning and market expansion across key regions.","real_author_photo":54996,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[30],"tags":[],"class_list":["post-53915","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-news"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"How the EBA Guideline, DORA and MaRisk reshape TPRM in 2025. Learn what financial institutions must do to align third-party risk management strategies.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yahya Mohamed Mao\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ar_AR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"TPRM under new rules: EBA, DORA and MaRisk explained\" \/>\n\t\t<meta property=\"og:description\" content=\"How the EBA Guideline, DORA and MaRisk reshape TPRM in 2025. Learn what financial institutions must do to align third-party risk management strategies.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/07\/Europlaza-EBA-e1752510670492.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/07\/Europlaza-EBA-e1752510670492.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1960\" \/>\n\t\t<meta property=\"og:image:height\" content=\"1104\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-07-14T16:57:05+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-08-20T14:04:44+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"TPRM under new rules: EBA, DORA and MaRisk explained\" \/>\n\t\t<meta name=\"twitter:description\" content=\"How the EBA Guideline, DORA and MaRisk reshape TPRM in 2025. Learn what financial institutions must do to align third-party risk management strategies.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@yibnm\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/07\/Europlaza-EBA-e1752510670492.jpg\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"Yahya Mohamed Mao\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#blogposting\",\"name\":\"TPRM under new rules: EBA, DORA and MaRisk explained\",\"headline\":\"TPRM under new rules: EBA, DORA and MaRisk explained\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/yahyaen\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2025\\\/07\\\/Europlaza-EBA-e1752510670492.jpg\",\"width\":1960,\"height\":1104,\"caption\":\"Europlaza building in Paris, home to the EBA\"},\"datePublished\":\"2025-07-14T18:57:05+02:00\",\"dateModified\":\"2026-08-20T16:04:44+02:00\",\"inLanguage\":\"ar\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#webpage\"},\"articleSection\":\"Industry News\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/industry-news\\\/#listItem\",\"name\":\"Industry News\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/industry-news\\\/#listItem\",\"position\":2,\"name\":\"Industry News\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/industry-news\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#listItem\",\"name\":\"TPRM under new rules: EBA, DORA and MaRisk explained\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#listItem\",\"position\":3,\"name\":\"TPRM under new rules: EBA, DORA and MaRisk explained\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/industry-news\\\/#listItem\",\"name\":\"Industry News\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/yahyaen\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/yahyaen\\\/\",\"name\":\"Yahya Mohamed Mao\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3bf99b34df7860c8d0a49d2d8c009068894348156d0a51ba297529d37fbb168d?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Yahya Mohamed Mao\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/yibnm\",\"https:\\\/\\\/ch.linkedin.com\\\/in\\\/yahyamohamedmao\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/\",\"name\":\"TPRM under new rules: EBA, DORA and MaRisk explained\",\"description\":\"How the EBA Guideline, DORA and MaRisk reshape TPRM in 2025. Learn what financial institutions must do to align third-party risk management strategies.\",\"inLanguage\":\"ar\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/yahyaen\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/yahyaen\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2025\\\/07\\\/Europlaza-EBA-e1752510670492.jpg\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#mainImage\",\"width\":1960,\"height\":1104,\"caption\":\"Europlaza building in Paris, home to the EBA\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/tprm-under-new-rules-eba-dora-and-marisk-explained\\\/#mainImage\"},\"datePublished\":\"2025-07-14T18:57:05+02:00\",\"dateModified\":\"2026-08-20T16:04:44+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"ar\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>TPRM under new rules: EBA, DORA and MaRisk explained<\/title>\n\n","aioseo_head_json":{"title":"TPRM under new rules: EBA, DORA and MaRisk explained","description":"How the EBA Guideline, DORA and MaRisk reshape TPRM in 2025. Learn what financial institutions must do to align third-party risk management strategies.","canonical_url":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#blogposting","name":"TPRM under new rules: EBA, DORA and MaRisk explained","headline":"TPRM under new rules: EBA, DORA and MaRisk explained","author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/yahyaen\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/07\/Europlaza-EBA-e1752510670492.jpg","width":1960,"height":1104,"caption":"Europlaza building in Paris, home to the EBA"},"datePublished":"2025-07-14T18:57:05+02:00","dateModified":"2026-08-20T16:04:44+02:00","inLanguage":"ar","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#webpage"},"articleSection":"Industry News"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/ar\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/industry-news\/#listItem","name":"Industry News"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/industry-news\/#listItem","position":2,"name":"Industry News","item":"https:\/\/swissgrc.com\/ar\/category\/industry-news\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#listItem","name":"TPRM under new rules: EBA, DORA and MaRisk explained"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#listItem","position":3,"name":"TPRM under new rules: EBA, DORA and MaRisk explained","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/industry-news\/#listItem","name":"Industry News"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/ar\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/ar\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/ar\/author\/yahyaen\/#author","url":"https:\/\/swissgrc.com\/ar\/author\/yahyaen\/","name":"Yahya Mohamed Mao","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/3bf99b34df7860c8d0a49d2d8c009068894348156d0a51ba297529d37fbb168d?s=96&d=mm&r=g","width":96,"height":96,"caption":"Yahya Mohamed Mao"},"sameAs":["https:\/\/twitter.com\/yibnm","https:\/\/ch.linkedin.com\/in\/yahyamohamedmao"]},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#webpage","url":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/","name":"TPRM under new rules: EBA, DORA and MaRisk explained","description":"How the EBA Guideline, DORA and MaRisk reshape TPRM in 2025. Learn what financial institutions must do to align third-party risk management strategies.","inLanguage":"ar","isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/yahyaen\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/ar\/author\/yahyaen\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/07\/Europlaza-EBA-e1752510670492.jpg","@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#mainImage","width":1960,"height":1104,"caption":"Europlaza building in Paris, home to the EBA"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/#mainImage"},"datePublished":"2025-07-14T18:57:05+02:00","dateModified":"2026-08-20T16:04:44+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/ar\/#website","url":"https:\/\/swissgrc.com\/ar\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"ar","publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"}}]},"og:locale":"ar_AR","og:site_name":"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"TPRM under new rules: EBA, DORA and MaRisk explained","og:description":"How the EBA Guideline, DORA and MaRisk reshape TPRM in 2025. Learn what financial institutions must do to align third-party risk management strategies.","og:url":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/","og:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/07\/Europlaza-EBA-e1752510670492.jpg","og:image:secure_url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/07\/Europlaza-EBA-e1752510670492.jpg","og:image:width":1960,"og:image:height":1104,"article:published_time":"2025-07-14T16:57:05+00:00","article:modified_time":"2026-08-20T14:04:44+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"TPRM under new rules: EBA, DORA and MaRisk explained","twitter:description":"How the EBA Guideline, DORA and MaRisk reshape TPRM in 2025. Learn what financial institutions must do to align third-party risk management strategies.","twitter:creator":"@yibnm","twitter:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/07\/Europlaza-EBA-e1752510670492.jpg","twitter:label1":"Written by","twitter:data1":"Yahya Mohamed Mao","twitter:label2":"Est. reading time","twitter:data2":"4 minutes"},"aioseo_meta_data":{"post_id":"53915","title":"TPRM under new rules: EBA, DORA and MaRisk explained","description":"How the EBA Guideline, DORA and MaRisk reshape TPRM in 2025. Learn what financial institutions must do to align third-party risk management strategies.","keywords":null,"keyphrases":{"focus":{"keyphrase":"TPRM","score":84},"additional":[{"keyphrase":"EBA","score":89},{"keyphrase":"DORA","score":89},{"keyphrase":"MaRisk","score":89}]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-08-20 14:10:17","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"titles":[],"descriptions":[],"socialPosts":{"email":[],"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2025-07-14 16:30:07","updated":"2026-09-17 12:30:12","focus_keyword":"TPRM","additional_keywords":[{"word":"EBA","score":89,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"DORA","score":89,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"MaRisk","score":89,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/category\/industry-news\/\" title=\"Industry News\">Industry News<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tTPRM under new rules: EBA, DORA and MaRisk explained\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/ar\/"},{"label":"Industry News","link":"https:\/\/swissgrc.com\/ar\/category\/industry-news\/"},{"label":"TPRM under new rules: EBA, DORA and MaRisk explained","link":"https:\/\/swissgrc.com\/ar\/tprm-under-new-rules-eba-dora-and-marisk-explained\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/53915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/comments?post=53915"}],"version-history":[{"count":27,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/53915\/revisions"}],"predecessor-version":[{"id":54052,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/53915\/revisions\/54052"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media\/53917"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media?parent=53915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/categories?post=53915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/tags?post=53915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}