{"id":70642,"date":"2026-09-18T18:09:12","date_gmt":"2026-09-18T16:09:12","guid":{"rendered":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/"},"modified":"2026-09-20T10:19:26","modified_gmt":"2026-09-20T08:19:26","slug":"eba-guidelines-critical-functions-first","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/","title":{"rendered":"EBA Guidelines: Critical Functions First"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">On 18 September 2026, the EBA published the <a href=\"https:\/\/www.eba.europa.eu\/sites\/default\/files\/2026-09\/6b826e13-fecc-4940-ae21-b741cf76eabc\/Final%20report%20on%20GL%20on%20third-country%20risk%20management.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Final Report<\/a> on Guidelines EBA\/GL\/2026\/09 concerning the management of third-party risk regarding non-ICT services. They repeal the 2019 outsourcing guidelines and no longer work with the notion of outsourcing, but with the broader notion of a third-party arrangement, of which outsourcing is a subset. More is therefore captured than before. At the same time, the final version tiers the effort: the deeper requirements apply to arrangements that support critical or important functions. For institutions, this raises the question of which arrangements need to be reviewed first during implementation.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>On 18 September 2026, the EBA published its final Guidelines EBA\/GL\/2026\/09. They capture all third-party arrangements for non-ICT services, but require the enhanced obligations only for those supporting critical or important functions. Institutions should therefore identify and document these arrangements first, and handle the rest through a leaner, risk-based process.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-what-changed-between-the-draft-and-the-f\">What changed between the draft and the final version?<\/a><\/li>\n<li><a href=\"#a2-which-institutions-and-services-do-the-g\">Which institutions and services do the guidelines apply to?<\/a><\/li>\n<li><a href=\"#a3-which-third-party-relationships-should-b\">Which third-party relationships should be reviewed first?<\/a><\/li>\n<li><a href=\"#a4-how-much-time-remains-for-implementation\">How much time remains for implementation?<\/a><\/li>\n<li><a href=\"#a5-how-should-institutions-proceed-now\">How should institutions proceed now?<\/a><\/li>\n<\/ol>\n<\/nav>\n<h2 id=\"a1-what-changed-between-the-draft-and-the-f\">What changed between the draft and the final version?<\/h2>\n<p>The final version tiers what the draft had largely treated alike: the enhanced requirements apply to third-party arrangements supporting critical or important functions, while all others are governed by a risk-based and proportionate approach.<\/p>\n<p>The underlying shift in terminology remains. A third-party arrangement is any arrangement between a financial entity and an external or intragroup service provider under which that provider supports one or more functions on a recurrent or ongoing basis. Outsourcing arrangements are explicitly a subset of these. This brings non-ICT services into scope that were previously not classified as outsourcing. Read together, the two movements give the real picture: the capture is broader, the depth of requirements is graduated.<\/p>\n<p>During the <a href=\"https:\/\/eba.europa.eu\/publications-and-media\/press-releases\/eba-launches-consultation-its-draft-guidelines-third-party-risk-management-regard-non-ict-related\" target=\"_blank\" rel=\"noopener nofollow\">consultation<\/a> from 8 July 2025 to 8 October 2025, stakeholders raised concerns about an excessive expansion of scope. The industry association AMAFI criticised that the draft envisaged a regime for third parties with non-critical functions that was practically identical to the one for critical or important functions. The association FIA also pointed out that a scope drawn too broadly could complicate the assessment of critical and important functions and undermine consistency with DORA.<\/p>\n<h2 id=\"a2-which-institutions-and-services-do-the-g\">Which institutions and services do the guidelines apply to?<\/h2>\n<p>The guidelines are addressed to the competent authorities of member states and concern institutions, third-country branches, certain investment firms, payment institutions, e-money institutions, issuers of asset-referenced tokens, and certain lenders under the Mortgage Credit Directive, where these rely on third-party providers for non-ICT services. Credit intermediaries and account information service providers registered only for that service are not addressed.<\/p>\n<p>Services falling under Chapter V of DORA are excluded, as a separate regime already exists for ICT third parties. Beyond that, the guidelines set out an explicit list of exclusions: services legally required to be performed by a third party such as the statutory audit, regulated financial services legally required to be performed by another supervised entity, market information services, transactions between financial institutions acting as counterparties, payment network infrastructures, clearing and settlement arrangements, supervised global financial messaging infrastructures, correspondent banking services, and purchases with no material impact on risk exposure or operational resilience such as printing, cleaning, catering or legal opinions, as well as the acquisition of goods and utilities.<\/p>\n<p>The guidelines repeal the EBA outsourcing guidelines of 25 February 2019 and create a uniform EU framework, to be implemented on a &#8216;comply or explain&#8217; basis. For institutions whose third-party risk governance is already tiered by criticality, the adjustment is likely to be smaller than for those that have so far managed third parties primarily through contracts.<\/p>\n<figure class=\"rc-shot\"><img src=\"https:\/\/swissgrc.com\/wp-content\/uploads\/sites\/5\/2026\/09\/Isometric-screenshots-net-background-1024x572.png\" alt=\"Views from the Third-Party Risk Management solution of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating\" loading=\"lazy\" decoding=\"async\"><figcaption>Views from the Third-Party Risk Management solution of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating<\/figcaption><\/figure>\n<h2 id=\"a3-which-third-party-relationships-should-b\">Which third-party relationships should be reviewed first?<\/h2>\n<p>Priority applies to arrangements that support critical or important functions, meaning functions whose disruption would materially impair the financial performance of a financial entity, the soundness or continuity of its services and activities, or its continuing compliance with the conditions of its authorisation. The definition is aligned with Article 3(22) of DORA.<\/p>\n<p>The assessment path has three steps: is the service a non-ICT service, does the provider support a function on a recurrent or ongoing basis, and is that function critical or important? A finding of &#8216;not an outsourcing&#8217; therefore no longer ends the review. Operational tasks of internal control functions are to be treated as critical or important by default, unless the assessment establishes otherwise.<\/p>\n<p>For these arrangements, the guidelines require enhanced due diligence, clear contractual provisions, a review of subcontracting arrangements, ongoing monitoring, complete documentation and exit planning in case a provider needs to be replaced. These requirements show that risk, control and contract are closely linked and rarely fall into place on their own. For arrangements outside this category, the final version reduces the operational and supervisory burden, while still requiring robust, risk-based governance.<\/p>\n<h2 id=\"a4-how-much-time-remains-for-implementation\">How much time remains for implementation?<\/h2>\n<p>An exact application date has not yet been set. From that date, the guidelines apply to all third-party arrangements entered into, reviewed or amended, and existing arrangements are to be brought into line accordingly.<\/p>\n<p>The widely quoted two-year period is more precise than it sounds. Where the review and documentation of arrangements supporting critical or important functions is not finalised two years after the date of application, financial entities must inform their competent authority, including the measures planned to complete the review or a possible exit strategy. For arrangements that do not support a critical or important function, review and documentation may be carried out solely on the occasion of contract renewal. The period is therefore not a deadline for everything, but a notification point for what matters. Institutions that already capture their third-party risks in a structured way as part of Operational Resilience can build on this foundation, since the guidelines are explicitly intended to align with DORA.<\/p>\n<h2 id=\"a5-how-should-institutions-proceed-now\">How should institutions proceed now?<\/h2>\n<p>The first step is to review the existing supplier register with the aim of flagging each arrangement according to whether it supports a critical or important function.<\/p>\n<p>The second step concerns the register itself. The guidelines require an up-to-date register of all third-party arrangements in scope, distinguishing between those supporting critical or important functions and all others. It should be consistent, as far as possible, with the register of information under Article 28(3) of DORA, discrepancies between the two should be avoided, and the EBA explicitly allows both to be combined into a single register. The same applies to the policy on contractual arrangements, which may be merged with the policy under Article 28(10) of DORA, and to the monitoring role, which may be combined with the role under Article 5(3) of DORA. Institutions that have implemented DORA therefore extend existing structures rather than building a second register world.<\/p>\n<p>For arrangements supporting critical or important functions, the register requires additional entries: the governing law, the dates of the most recent audits, material subcontractors including chain and location, substitutability, an assessment of reintegration with recovery time and recovery point objectives, the existence of an exit plan, alternative providers and the estimated annual cost. These entries cannot be assembled at short notice. Starting early provides more time to negotiate with providers whose contracts need to be amended. Responsibility for this initial review typically lies with the function that maintains the supplier register.<\/p>\n<div class=\"rc-bridge\">\n<div class=\"rc-bridge-mark\"><\/div>\n<div>\n<div class=\"rc-bridge-label\">Related<\/div>\n<h3>Manage third parties by criticality<\/h3>\n<p>The Third-Party Risk Management solution maps due diligence, contract data, subcontractors and monitoring per provider. It supports classification by critical or important function and a register that can be merged with the DORA register of information.<\/p>\n<p><a href=\"https:\/\/swissgrc.com\/ar\/tprm-software\/\">Third-Party Risk Management <span class=\"rc-pfeil\" aria-hidden=\"true\"><\/span><\/a><\/div>\n<\/div>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>The assessment no longer stops at &#8216;not an outsourcing&#8217;: what counts is whether a non-ICT service supports a function on a recurrent basis and whether that function is critical or important.<\/li>\n<li>Identify, review and document first the third-party arrangements that support critical or important functions.<\/li>\n<li>For less material arrangements, a leaner risk-based process is sufficient, and review and documentation may follow at contract renewal.<\/li>\n<li>The register, the policy and the monitoring role may be merged with the corresponding DORA structures.<\/li>\n<li>Two years after the date of application is a notification point: unfinished reviews of critical arrangements must be reported to the supervisor.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">When were the EBA guidelines on non-ICT third-party risk published?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The EBA published the Final Report on Guidelines EBA\/GL\/2026\/09 on 18 September 2026. This is the final version, which, compared to the consultation draft of 8 July 2025, concentrates the enhanced requirements on arrangements that support critical or important functions.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What is a third-party arrangement, and why is outsourcing only a subset?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>A third-party arrangement is any arrangement between a financial entity and an external or intragroup service provider under which that provider supports one or more functions on a recurrent or ongoing basis. Outsourcing, where the provider performs a function the entity would otherwise undertake itself, is included as a subset. A finding of &#8216;not an outsourcing&#8217; therefore no longer takes an arrangement out of scope.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What counts as a critical or important function under the guidelines?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>A critical or important function is one whose disruption would materially impair the financial performance of a financial entity, the soundness or continuity of its services and activities, or its continuing compliance with the conditions of its authorisation. For third-party arrangements that support such functions, the guidelines require enhanced due diligence, clear contracts, monitoring, documentation and exit planning.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">May the new register be merged with the DORA register of information?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Yes. The register for non-ICT arrangements should be consistent, as far as possible, with the register of information under Article 28(3) of DORA, discrepancies should be avoided, and both may be combined into a single register. The policy on contractual arrangements may likewise be merged with the policy under Article 28(10) of DORA.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Do the new guidelines replace the previous 2019 EBA outsourcing guidelines?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Yes, the guidelines repeal the EBA outsourcing guidelines of 25 February 2019 and create a uniform EU framework. Implementation follows the &#8216;comply or explain&#8217; principle applied by the competent authorities of member states.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Which institutions are affected by the EBA guidelines?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Affected are institutions, third-country branches, certain investment firms, payment institutions, e-money institutions, issuers of asset-referenced tokens, and certain lenders under the Mortgage Credit Directive, provided they rely on third-party providers for non-ICT services. Credit intermediaries and account information service providers registered only for that service are not addressed.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Which services are excluded?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Excluded are services under Chapter V of DORA, together with an explicit list: services legally required to be performed by a third party such as the statutory audit, regulated financial services performed by another supervised entity, market information services, interbank transactions, payment network infrastructures, clearing and settlement, supervised global financial messaging infrastructures, correspondent banking services, purchases with no material impact on risk or resilience, and the acquisition of goods and utilities.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/www.eba.europa.eu\/sites\/default\/files\/2026-09\/6b826e13-fecc-4940-ae21-b741cf76eabc\/Final%20report%20on%20GL%20on%20third-country%20risk%20management.pdf\" target=\"_blank\" rel=\"noopener nofollow\">Final report on Guidelines on the sound management of third-party risk related to non-ICT services (EBA\/GL\/2026\/09)<\/a><span class=\"rc-source-pub\">European Banking Authority (EBA)<\/span><\/li>\n<li><a href=\"https:\/\/www.eba.europa.eu\/publications-and-media\/press-releases\/eba-publishes-its-final-guidelines-management-third-party-risk-delivering-more-proportionate-and\" target=\"_blank\" rel=\"noopener nofollow\">The EBA publishes its final Guidelines on the management of third-party risk<\/a><span class=\"rc-source-pub\">European Banking Authority (EBA)<\/span><\/li>\n<li><a href=\"https:\/\/www.regulationtomorrow.com\/2026\/09\/final-report-eba-guidelines-on-the-sound-management-of-third-party-risk-regarding-non-ict-services\/\" target=\"_blank\" rel=\"noopener nofollow\">Final report: EBA guidelines on the sound management of third-party risk regarding non-ICT services<\/a><span class=\"rc-source-pub\">Global Regulation Tomorrow<\/span><\/li>\n<li><a href=\"https:\/\/eba.europa.eu\/publications-and-media\/press-releases\/eba-launches-consultation-its-draft-guidelines-third-party-risk-management-regard-non-ict-related\" target=\"_blank\" rel=\"noopener nofollow\">EBA launches consultation on its draft guidelines on third-party risk management<\/a><span class=\"rc-source-pub\">European Banking Authority (EBA)<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>On 18 September 2026, the EBA published its final guidelines on the management of third-party risk regarding non-ICT services and narrowed the scope compared to the draft to focus on arrangements that support critical or important functions. Institutions should therefore review third-party relationships involving such functions first, before addressing less material arrangements with reduced effort.<\/p>\n","protected":false},"author":5,"featured_media":70643,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Nikolai Tsenov","real_author_title":"Head Solutions & Innovation","real_author_bio":"Sees the SwissGRC Platform as a network of interfaces where GRC, BPM and CLM come together and can be automated. New requirements from governance, risk and compliance are then examined for how they fit into existing systems without adding complexity.","real_author_photo":42203,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[105],"tags":[206,207,155,204,205],"class_list":["post-70642","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulation-supervision","tag-dora-scope","tag-eba-outsourcing-guidelines","tag-third-party-risk-management","tag-non-ict-services","tag-critical-or-important-functions"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ar_AR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"EBA Guidelines: Third-Party Risk in Non-ICT Services\" \/>\n\t\t<meta property=\"og:description\" content=\"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/eba-guidelines-critical-functions-first-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/eba-guidelines-critical-functions-first-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-18T16:09:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-20T08:19:26+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"EBA Guidelines: Third-Party Risk in Non-ICT Services\" \/>\n\t\t<meta name=\"twitter:description\" content=\"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/eba-guidelines-critical-functions-first-swissgrc.webp\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#blogposting\",\"name\":\"EBA Guidelines: Third-Party Risk in Non-ICT Services\",\"headline\":\"EBA Guidelines: Critical Functions First\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/09\\\/eba-guidelines-critical-functions-first-swissgrc.webp\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract control grid graphic in deep teal, category Regulation & Supervision\"},\"datePublished\":\"2026-09-18T18:09:12+02:00\",\"dateModified\":\"2026-09-20T10:19:26+02:00\",\"inLanguage\":\"ar\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#webpage\"},\"articleSection\":\"Regulation &amp; Supervision, DORA scope, EBA outsourcing guidelines, Third-Party Risk Management, non-ICT services, critical or important functions\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"position\":2,\"name\":\"Regulation &amp; Supervision\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#listItem\",\"name\":\"EBA Guidelines: Critical Functions First\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#listItem\",\"position\":3,\"name\":\"EBA Guidelines: Critical Functions First\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/regulation-supervision\\\/#listItem\",\"name\":\"Regulation &amp; Supervision\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/\",\"name\":\"EBA Guidelines: Third-Party Risk in Non-ICT Services\",\"description\":\"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.\",\"inLanguage\":\"ar\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2026\\\/09\\\/eba-guidelines-critical-functions-first-swissgrc.webp\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract control grid graphic in deep teal, category Regulation & Supervision\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/eba-guidelines-critical-functions-first\\\/#mainImage\"},\"datePublished\":\"2026-09-18T18:09:12+02:00\",\"dateModified\":\"2026-09-20T10:19:26+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"ar\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>EBA Guidelines: Third-Party Risk in Non-ICT Services<\/title>\n\n","aioseo_head_json":{"title":"EBA Guidelines: Third-Party Risk in Non-ICT Services","description":"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.","canonical_url":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#blogposting","name":"EBA Guidelines: Third-Party Risk in Non-ICT Services","headline":"EBA Guidelines: Critical Functions First","author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/eba-guidelines-critical-functions-first-swissgrc.webp","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract control grid graphic in deep teal, category Regulation & Supervision"},"datePublished":"2026-09-18T18:09:12+02:00","dateModified":"2026-09-20T10:19:26+02:00","inLanguage":"ar","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#webpage"},"articleSection":"Regulation &amp; Supervision, DORA scope, EBA outsourcing guidelines, Third-Party Risk Management, non-ICT services, critical or important functions"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/ar\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","position":2,"name":"Regulation &amp; Supervision","item":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#listItem","name":"EBA Guidelines: Critical Functions First"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#listItem","position":3,"name":"EBA Guidelines: Critical Functions First","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/#listItem","name":"Regulation &amp; Supervision"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/ar\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/ar\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/75672523c5e2db95feb2c8c3d6cf134b011e26e6f14621731855ff4a8c3327d7?s=96&d=mm&r=g","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#webpage","url":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/","name":"EBA Guidelines: Third-Party Risk in Non-ICT Services","description":"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.","inLanguage":"ar","isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/ar\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/eba-guidelines-critical-functions-first-swissgrc.webp","@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#mainImage","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract control grid graphic in deep teal, category Regulation & Supervision"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/#mainImage"},"datePublished":"2026-09-18T18:09:12+02:00","dateModified":"2026-09-20T10:19:26+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/ar\/#website","url":"https:\/\/swissgrc.com\/ar\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"ar","publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"}}]},"og:locale":"ar_AR","og:site_name":"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"EBA Guidelines: Third-Party Risk in Non-ICT Services","og:description":"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.","og:url":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/","og:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/eba-guidelines-critical-functions-first-swissgrc.webp","og:image:secure_url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/eba-guidelines-critical-functions-first-swissgrc.webp","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-09-18T16:09:12+00:00","article:modified_time":"2026-09-20T08:19:26+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"EBA Guidelines: Third-Party Risk in Non-ICT Services","twitter:description":"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2026\/09\/eba-guidelines-critical-functions-first-swissgrc.webp","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"9 minutes"},"aioseo_meta_data":{"post_id":"70642","title":"EBA Guidelines: Third-Party Risk in Non-ICT Services","description":"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.","keywords":null,"keyphrases":{"focus":{"keyphrase":"EBA guidelines third-party risk","score":85},"additional":[{"keyphrase":"non-ICT services","score":94},{"keyphrase":"critical or important functions","score":94},{"keyphrase":"third-party risk management","score":81},{"keyphrase":"DORA scope","score":74},{"keyphrase":"EBA outsourcing guidelines","score":74}]},"primary_term":null,"canonical_url":null,"og_title":"EBA Guidelines: Third-Party Risk in Non-ICT Services","og_description":"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"EBA Guidelines: Third-Party Risk in Non-ICT Services","twitter_description":"The EBA has focused its guidelines on non-ICT third-party risk on critical functions. Which arrangements institutions should review first.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-09-20 08:19:59","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-09-18 18:09:13","updated":"2026-09-20 12:31:47","focus_keyword":"EBA guidelines third-party risk","additional_keywords":[{"word":"non-ICT services","score":94,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"critical or important functions","score":94,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"third-party risk management","score":87,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":2},"imageKeyphrase":{"score":9}}},{"word":"DORA scope","score":74,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}},{"word":"EBA outsourcing guidelines","score":80,"items":{"introductionKeyword":{"score":6},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":6}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/\" title=\"Regulation &amp; Supervision\">Regulation &amp; Supervision<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tEBA Guidelines: Critical Functions First\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/ar\/"},{"label":"Regulation &amp; Supervision","link":"https:\/\/swissgrc.com\/ar\/category\/regulation-supervision\/"},{"label":"EBA Guidelines: Critical Functions First","link":"https:\/\/swissgrc.com\/ar\/eba-guidelines-critical-functions-first\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70642","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/comments?post=70642"}],"version-history":[{"count":3,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70642\/revisions"}],"predecessor-version":[{"id":70663,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/70642\/revisions\/70663"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media\/70643"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media?parent=70642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/categories?post=70642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/tags?post=70642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}