On 18 September 2026, the European Banking Authority published its final Guidelines on the sound management of third-party risk for non-ICT services, reference EBA/GL/2026/09. Once they apply, they replace the 2019 Guidelines on outsourcing arrangements that most EU banks built their vendor programs around.
For banks, the short version is this. The rules now cover every recurring third-party arrangement, not only outsourcing, and the heaviest requirements land on providers that support critical or important functions. ICT services stay under DORA. Everything else sits under the EBA guidelines, and the EBA expects firms to run the two as one joined-up program.
What the EBA published
The EBA presents the guidelines as part of its simplification work. Its press release says that concentrating on critical or important functions should reduce operational and supervisory burden for less material arrangements without weakening risk management.
The confirmed facts:
- Reference: EBA/GL/2026/09, published 18 September 2026.
- Status: final, awaiting translation into the EU’s official languages. The EBA publication page still lists no application date or compliance deadline.
- Legal basis: Article 74 of the Capital Requirements Directive, also taking PSD2, the Investment Firms Directive, MiFID II and MiCAR into account.
- International alignment: the Basel Committee’s Principles for the Sound Management of Third-Party Risk.
- Lifecycle coverage: risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit.
- Transition: two years.
Who is in scope
The population is wider than in 2019. According to Freshfields’ analysis, addressees include CRD credit institutions and their third-country branches, investment firms other than small and non-interconnected ones, payment institutions (except registered account information service providers), e-money institutions, asset-referenced token issuers, certain mortgage credit creditors, and financial and mixed financial holding companies.
For banking groups, the guidelines apply at individual, sub-consolidated and consolidated level. Centralized group arrangements are allowed: a central register, central pre-contract analysis, a central exit plan. Each entity still has to keep effective oversight and receive the relevant summaries. Large groups that run vendor risk from one central team will need to show how local entities stay in control.
A proportionality principle ties the depth of compliance to each firm’s risk profile, business model, size and complexity.
What changed from the 2019 outsourcing guidelines
The philosophy hasn’t changed much. The perimeter and the level of detail have.
| Area | 2019 outsourcing guidelines | EBA/GL/2026/09 |
| Entry test | Outsourcing: the provider does something the institution would otherwise do itself | Any arrangement supporting a function on a recurring or ongoing basis; outsourcing is a subset |
| ICT and cloud | Included, with detailed cloud provisions | Excluded; ICT third-party risk sits under DORA |
| Critical or important functions | Three-part impairment test | Same test, wording aligned with DORA and cross-referenced to resolution rules (BRRD) |
| Supply chain | Sub-outsourcing, principle-based | Subcontracting, with formal notice, objection and termination triggers |
| Register | Outsourcing register | Aligned with the DORA register; adds arrangement type, recovery objectives and an exit plan flag |
| Due diligence | Standard provider checks | Adds operational and technical track record, geographic dependency and supply-chain risk |
From outsourcing to third-party arrangements
Under the old test, an arrangement only counted if the provider was doing something the bank would otherwise do in-house. That test survives, but it no longer decides whether the guidelines apply. The new entry point is any recurring or ongoing support of a function. Genuinely one-off engagements stay out, as do listed exclusions such as statutory audit, market information services, clearing and settlement, and correspondent banking. A new exclusion covers financial transactions between financial institutions, such as interbank lending.
In practice, arrangements that never made it onto the outsourcing register may now need to be there.
The register moves closer to DORA
Firms must keep a register of all third-party arrangements. Its fields are substantially aligned with the DORA register, with additions like contractual arrangement type, recovery time and recovery point objectives, and whether an exit plan exists. Morrison Foerster notes that where a non-ICT provider supporting a critical function relies on ICT subcontractors, those subcontractors should also be documented. Many banks will end up running one register for both regimes.
Subcontracting gets formal
“Sub-outsourcing” becomes “subcontracting”, defined more broadly as any onward transfer of a function, in whole or in part. The guidelines add formal notice-and-objection procedures and termination rights when a provider subcontracts without approval. Expect this to drive renegotiation of master service agreements.
Management body and accountability
The management body approves the third-party risk strategy and policy and stays fully accountable. It also approves and periodically reviews the business continuity policy and internal audit plan for third-party arrangements. Firms should set up a function to monitor all arrangements, or name a senior manager who answers directly to the management body (Regulation Tomorrow).
The DORA boundary is where much of the work will be
Plenty of services mix ICT and non-ICT elements. The guidelines leave it to each institution to decide whether the ICT element is material enough to bring an arrangement under DORA. The EBA points firms to two DORA Q&As, DORA030 on the definition of ICT services and DORA095 on mixed arrangements, as interpretive guidance. Freshfields expects this classification to be an early and recurring challenge, and an area where supervisors will push back.
An illustrative case: a provider that prints and mails customer statements but also runs a secure portal for document delivery. Which regime applies is the bank’s call. What matters is that the reasoning is written down, applied the same way across business lines, and revisited when the service changes. A classification nobody can explain is hard to defend in a supervisory review.
Non-ICT doesn’t mean no cyber exposure – Sling’s analysis
It’s tempting to read the split as “cyber is DORA’s problem.” That reading leaves a gap. Many non-ICT providers hold bank and customer data, run on email and cloud apps, and employ people whose credentials can be stolen. Depending on how a bank classifies them, that list can include debt collection agencies, call centers, law firms, cash logistics companies and document or mailing houses. A breach at any of them can reach the bank’s customers and operations, even though the contract isn’t an ICT service.
The guidelines don’t prescribe cyber tooling. They do ask for due diligence that covers supply-chain risk and a provider’s operational and technical track record, ongoing monitoring across the relationship, and documented exit strategies for critical arrangements. They also tell supervisors to watch concentration risk at sector level, including providers shared across many institutions.
That’s where point-in-time assessment runs thin. An annual questionnaire tells you what a provider said on one day. It won’t tell you that staff credentials surfaced on a criminal forum in the spring, or that a new internet-facing system went live with a known weakness. For critical providers, an outside-in view between formal reviews gives the risk owner something concrete to act on and to report upward.
There are limits. External monitoring doesn’t replace contract clauses, audit rights, continuity testing or exit planning. It’s one input into ongoing oversight, and what counts as adequate monitoring for a given arrangement is a judgment each bank makes with its compliance function.
Sling was built for this kind of outside-in view. Assessment starts from a provider’s domain, needs no cooperation from the provider, and produces a risk picture within about 24 hours, drawing on more than ten years of in-house Darknet and threat intelligence data. That makes it practical for non-ICT providers that rarely complete detailed technical questionnaires. (Verify with Sling team: approved phrasing for the 24-hour and 10-year claims.)
What banks should do during the two-year transition
Two years sounds generous. The notification requirement changes that: if critical arrangements aren’t reviewed and documented in time, the bank has to tell its supervisor and present a remediation or exit plan. Most of the effort should be front-loaded.
- Re-inventory against the new entry test. Start from the DORA register to set aside ICT arrangements, then look for recurring services that were never classed as outsourcing.
- Classify each arrangement. ICT or non-ICT, recurring or one-off, critical or important. Record the reasoning for every mixed case.
- Put critical arrangements first. Set an internal deadline well ahead of the two-year mark.
- Combine registers where you can. The field alignment with DORA is there to make this possible.
- Repaper contracts. Subcontracting notice and objection rights, termination triggers, audit and access rights, exit provisions. Morrison Foerster suggests DORA contract remediation work is a useful starting point.
- Map subcontracting chains for critical providers, including ICT subcontractors that sit underneath non-ICT services.
- Decide how you’ll monitor critical providers between reviews, in proportion to how critical they are.
- Check governance. Management body approvals, a named accountable senior manager or function, and evidence of how local entities oversee group-level arrangements.
Service providers should expect information requests and contract amendments from their banking customers, and some will start preparing before they’re asked.
What’s still unknown
- The application date. The text is awaiting translation, and the EBA page still shows the application date and compliance deadline as blank.
- National supervisors’ positions. EBA guidelines work on a comply-or-explain basis, so each national competent authority will state whether it intends to comply. (Source needed: cite Article 16(3) of the EBA Regulation.) Watch your own supervisor’s notification.
- How strictly the ICT boundary will be policed. Expect early supervisory feedback to shape market practice.
Frequently asked questions
What are the EBA’s new third-party risk management guidelines? They are EBA/GL/2026/09, final guidelines published on 18 September 2026 on managing third-party risk for non-ICT services. They replace the 2019 outsourcing guidelines and cover the full lifecycle of third-party arrangements, with the strictest requirements for those supporting critical or important functions.
When do the EBA third-party risk guidelines apply? The application date hasn’t been confirmed. The guidelines are final but awaiting translation into EU official languages. Once they apply, firms have two years to review and document existing arrangements that support critical or important functions.
Do the guidelines replace DORA? No. DORA continues to govern ICT third-party risk. The EBA guidelines cover non-ICT services, and the EBA expects firms to manage both in one consistent framework.
Which firms are in scope? CRD credit institutions and their third-country branches, most investment firms, payment and e-money institutions, asset-referenced token issuers, certain mortgage creditors, and financial holding companies. Banking groups apply them at individual, sub-consolidated and consolidated level.
What happens to existing contracts? Arrangements entered into, reviewed or amended after the application date must comply. Existing critical or important arrangements must be reviewed within two years. Other arrangements can be reviewed at their next renewal.
What is a critical or important function? A function whose disruption would materially impair a firm’s compliance with its authorization, its financial performance, or the soundness and continuity of its services. The definition matches the one used under DORA.