# EBA Guidelines: Critical Functions First

> Swiss GRC explains the EBA Guidelines EBA/GL/2026/09 on third-party risk for non-ICT services, published on 18 September 2026. The article shows financial institutions which arrangements to review first: those supporting critical or important functions.

- URL: https://swissgrc.com/en/eba-guidelines-critical-functions-first/
- Publisher: SwissGRC®
- Published: 2026-09-18
- Last updated: 2026-09-20

## Key facts

- The EBA published the Final Report on Guidelines EBA/GL/2026/09 on the management of third-party risk regarding non-ICT services on 18 September 2026.
- The guidelines repeal the EBA outsourcing guidelines of 25 February 2019 and replace the notion of outsourcing with the broader notion of a third-party arrangement, of which outsourcing is a subset.
- Enhanced requirements apply only to arrangements supporting critical or important functions, while all other arrangements are governed by a risk-based and proportionate approach.
- For arrangements supporting critical or important functions, the guidelines require enhanced due diligence, clear contractual provisions, a review of subcontracting, ongoing monitoring, complete documentation and exit planning.
- The register of third-party arrangements should be consistent with the DORA register of information under Article 28(3), and the EBA allows both to be combined into a single register.
- An exact application date has not yet been set; two years after it, unfinished reviews of critical or important arrangements must be reported to the competent authority.

On 18 September 2026, the EBA published the [Final Report](https://www.eba.europa.eu/sites/default/files/2026-09/6b826e13-fecc-4940-ae21-b741cf76eabc/Final%20report%20on%20GL%20on%20third-country%20risk%20management.pdf) on Guidelines EBA/GL/2026/09 concerning the management of third-party risk regarding non-ICT services. They repeal the 2019 outsourcing guidelines and no longer work with the notion of outsourcing, but with the broader notion of a third-party arrangement, of which outsourcing is a subset. More is therefore captured than before. At the same time, the final version tiers the effort: the deeper requirements apply to arrangements that support critical or important functions. For institutions, this raises the question of which arrangements need to be reviewed first during implementation.

In short

On 18 September 2026, the EBA published its final Guidelines EBA/GL/2026/09. They capture all third-party arrangements for non-ICT services, but require the enhanced obligations only for those supporting critical or important functions. Institutions should therefore identify and document these arrangements first, and handle the rest through a leaner, risk-based process.

## What changed between the draft and the final version?

The final version tiers what the draft had largely treated alike: the enhanced requirements apply to third-party arrangements supporting critical or important functions, while all others are governed by a risk-based and proportionate approach.

The underlying shift in terminology remains. A third-party arrangement is any arrangement between a financial entity and an external or intragroup service provider under which that provider supports one or more functions on a recurrent or ongoing basis. Outsourcing arrangements are explicitly a subset of these. This brings non-ICT services into scope that were previously not classified as outsourcing. Read together, the two movements give the real picture: the capture is broader, the depth of requirements is graduated.

During the [consultation](https://eba.europa.eu/publications-and-media/press-releases/eba-launches-consultation-its-draft-guidelines-third-party-risk-management-regard-non-ict-related) from 8 July 2025 to 8 October 2025, stakeholders raised concerns about an excessive expansion of scope. The industry association AMAFI criticised that the draft envisaged a regime for third parties with non-critical functions that was practically identical to the one for critical or important functions. The association FIA also pointed out that a scope drawn too broadly could complicate the assessment of critical and important functions and undermine consistency with DORA.

## Which institutions and services do the guidelines apply to?

The guidelines are addressed to the competent authorities of member states and concern institutions, third-country branches, certain investment firms, payment institutions, e-money institutions, issuers of asset-referenced tokens, and certain lenders under the Mortgage Credit Directive, where these rely on third-party providers for non-ICT services. Credit intermediaries and account information service providers registered only for that service are not addressed.

Services falling under Chapter V of DORA are excluded, as a separate regime already exists for ICT third parties. Beyond that, the guidelines set out an explicit list of exclusions: services legally required to be performed by a third party such as the statutory audit, regulated financial services legally required to be performed by another supervised entity, market information services, transactions between financial institutions acting as counterparties, payment network infrastructures, clearing and settlement arrangements, supervised global financial messaging infrastructures, correspondent banking services, and purchases with no material impact on risk exposure or operational resilience such as printing, cleaning, catering or legal opinions, as well as the acquisition of goods and utilities.

The guidelines repeal the EBA outsourcing guidelines of 25 February 2019 and create a uniform EU framework, to be implemented on a ‘comply or explain’ basis. For institutions whose third-party risk governance is already tiered by criticality, the adjustment is likely to be smaller than for those that have so far managed third parties primarily through contracts.

![Views from the Third-Party Risk Management solution of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating](https://swissgrc.com/wp-content/uploads/sites/2/2026/09/Isometric-screenshots-net-background-1024x572.png)

Views from the Third-Party Risk Management solution of the SwissGRC Platform: risk dashboard, service catalogue and criticality rating

## Which third-party relationships should be reviewed first?

Priority applies to arrangements that support critical or important functions, meaning functions whose disruption would materially impair the financial performance of a financial entity, the soundness or continuity of its services and activities, or its continuing compliance with the conditions of its authorisation. The definition is aligned with Article 3(22) of DORA.

The assessment path has three steps: is the service a non-ICT service, does the provider support a function on a recurrent or ongoing basis, and is that function critical or important? A finding of ‘not an outsourcing’ therefore no longer ends the review. Operational tasks of internal control functions are to be treated as critical or important by default, unless the assessment establishes otherwise.

For these arrangements, the guidelines require enhanced due diligence, clear contractual provisions, a review of subcontracting arrangements, ongoing monitoring, complete documentation and exit planning in case a provider needs to be replaced. These requirements show that risk, control and contract are closely linked and rarely fall into place on their own. For arrangements outside this category, the final version reduces the operational and supervisory burden, while still requiring robust, risk-based governance.

## How much time remains for implementation?

An exact application date has not yet been set. From that date, the guidelines apply to all third-party arrangements entered into, reviewed or amended, and existing arrangements are to be brought into line accordingly.

The widely quoted two-year period is more precise than it sounds. Where the review and documentation of arrangements supporting critical or important functions is not finalised two years after the date of application, financial entities must inform their competent authority, including the measures planned to complete the review or a possible exit strategy. For arrangements that do not support a critical or important function, review and documentation may be carried out solely on the occasion of contract renewal. The period is therefore not a deadline for everything, but a notification point for what matters. Institutions that already capture their third-party risks in a structured way as part of Operational Resilience can build on this foundation, since the guidelines are explicitly intended to align with DORA.

## How should institutions proceed now?

The first step is to review the existing supplier register with the aim of flagging each arrangement according to whether it supports a critical or important function.

The second step concerns the register itself. The guidelines require an up-to-date register of all third-party arrangements in scope, distinguishing between those supporting critical or important functions and all others. It should be consistent, as far as possible, with the register of information under Article 28(3) of DORA, discrepancies between the two should be avoided, and the EBA explicitly allows both to be combined into a single register. The same applies to the policy on contractual arrangements, which may be merged with the policy under Article 28(10) of DORA, and to the monitoring role, which may be combined with the role under Article 5(3) of DORA. Institutions that have implemented DORA therefore extend existing structures rather than building a second register world.

For arrangements supporting critical or important functions, the register requires additional entries: the governing law, the dates of the most recent audits, material subcontractors including chain and location, substitutability, an assessment of reintegration with recovery time and recovery point objectives, the existence of an exit plan, alternative providers and the estimated annual cost. These entries cannot be assembled at short notice. Starting early provides more time to negotiate with providers whose contracts need to be amended. Responsibility for this initial review typically lies with the function that maintains the supplier register.

Related

### Manage third parties by criticality

The Third-Party Risk Management solution maps due diligence, contract data, subcontractors and monitoring per provider. It supports classification by critical or important function and a register that can be merged with the DORA register of information.

[Third-Party Risk Management](https://swissgrc.com/en/tprm-software/)

For practice

## Key points

- The assessment no longer stops at ‘not an outsourcing’: what counts is whether a non-ICT service supports a function on a recurrent basis and whether that function is critical or important.
- Identify, review and document first the third-party arrangements that support critical or important functions.
- For less material arrangements, a leaner risk-based process is sufficient, and review and documentation may follow at contract renewal.
- The register, the policy and the monitoring role may be merged with the corresponding DORA structures.
- Two years after the date of application is a notification point: unfinished reviews of critical arrangements must be reported to the supervisor.

FAQ

## Frequently asked questions

When were the EBA guidelines on non-ICT third-party risk published?

The EBA published the Final Report on Guidelines EBA/GL/2026/09 on 18 September 2026. This is the final version, which, compared to the consultation draft of 8 July 2025, concentrates the enhanced requirements on arrangements that support critical or important functions.

What is a third-party arrangement, and why is outsourcing only a subset?

A third-party arrangement is any arrangement between a financial entity and an external or intragroup service provider under which that provider supports one or more functions on a recurrent or ongoing basis. Outsourcing, where the provider performs a function the entity would otherwise undertake itself, is included as a subset. A finding of ‘not an outsourcing’ therefore no longer takes an arrangement out of scope.

What counts as a critical or important function under the guidelines?

A critical or important function is one whose disruption would materially impair the financial performance of a financial entity, the soundness or continuity of its services and activities, or its continuing compliance with the conditions of its authorisation. For third-party arrangements that support such functions, the guidelines require enhanced due diligence, clear contracts, monitoring, documentation and exit planning.

May the new register be merged with the DORA register of information?

Yes. The register for non-ICT arrangements should be consistent, as far as possible, with the register of information under Article 28(3) of DORA, discrepancies should be avoided, and both may be combined into a single register. The policy on contractual arrangements may likewise be merged with the policy under Article 28(10) of DORA.

Do the new guidelines replace the previous 2019 EBA outsourcing guidelines?

Yes, the guidelines repeal the EBA outsourcing guidelines of 25 February 2019 and create a uniform EU framework. Implementation follows the ‘comply or explain’ principle applied by the competent authorities of member states.

Which institutions are affected by the EBA guidelines?

Affected are institutions, third-country branches, certain investment firms, payment institutions, e-money institutions, issuers of asset-referenced tokens, and certain lenders under the Mortgage Credit Directive, provided they rely on third-party providers for non-ICT services. Credit intermediaries and account information service providers registered only for that service are not addressed.

Which services are excluded?

Excluded are services under Chapter V of DORA, together with an explicit list: services legally required to be performed by a third party such as the statutory audit, regulated financial services performed by another supervised entity, market information services, interbank transactions, payment network infrastructures, clearing and settlement, supervised global financial messaging infrastructures, correspondent banking services, purchases with no material impact on risk or resilience, and the acquisition of goods and utilities.

Sources

1. [Final report on Guidelines on the sound management of third-party risk related to non-ICT services (EBA/GL/2026/09)](https://www.eba.europa.eu/sites/default/files/2026-09/6b826e13-fecc-4940-ae21-b741cf76eabc/Final%20report%20on%20GL%20on%20third-country%20risk%20management.pdf)European Banking Authority (EBA)
2. [The EBA publishes its final Guidelines on the management of third-party risk](https://www.eba.europa.eu/publications-and-media/press-releases/eba-publishes-its-final-guidelines-management-third-party-risk-delivering-more-proportionate-and)European Banking Authority (EBA)
3. [Final report: EBA guidelines on the sound management of third-party risk regarding non-ICT services](https://www.regulationtomorrow.com/2026/09/final-report-eba-guidelines-on-the-sound-management-of-third-party-risk-regarding-non-ict-services/)Global Regulation Tomorrow
4. [EBA launches consultation on its draft guidelines on third-party risk management](https://eba.europa.eu/publications-and-media/press-releases/eba-launches-consultation-its-draft-guidelines-third-party-risk-management-regard-non-ict-related)European Banking Authority (EBA)

## Frequently asked questions

### When were the EBA guidelines on non-ICT third-party risk published?

The EBA published the Final Report on Guidelines EBA/GL/2026/09 on 18 September 2026. The consultation on the draft ran from 8 July 2025 to 8 October 2025.

### What is a third-party arrangement under the EBA guidelines?

It is any arrangement between a financial entity and an external or intragroup service provider under which that provider supports one or more functions on a recurrent or ongoing basis. Outsourcing is a subset, so a finding of 'not an outsourcing' no longer ends the review.

### Which third-party arrangements should institutions review first?

Institutions should first review arrangements that support critical or important functions. The definition is aligned with Article 3(22) of DORA, and operational tasks of internal control functions are treated as critical or important by default unless the assessment establishes otherwise.

### Can the register be merged with the DORA register of information?

Yes. The register should be consistent, as far as possible, with the register of information under Article 28(3) of DORA, and the EBA explicitly allows both to be combined into a single register. The contractual policy and the monitoring role may likewise be merged with the corresponding DORA structures.

### How much time do institutions have to implement the guidelines?

An exact application date has not yet been set. Two years after that date, institutions must inform their competent authority if the review of arrangements supporting critical or important functions is not finalised, while other arrangements may be reviewed at contract renewal.