Our Financial Regulation team examines key implementation challenges and questions whether the new guidelines can truly deliver the simplification gains they promise.
What you need to know
- New guidance: New guidance from the EBA and the Central Bank on third-party risk management will soon extend standards aligned closely with DORA[1] to non-ICT[2] third-party arrangements.
- Outsourcing: When the new guidance takes effect, existing EBA and Central Bank outsourcing guidance will be replaced. Once a standalone concept, ‘outsourcing’ will now become a subset of ‘third-party arrangements.’
- Compliance burden: Both regulators aim to deliver simplification. However, the need for significant scoping and implementation work risks intensifying rather than reducing operational costs and burdens.
- Consultation Paper 173: The Central Bank’s cross-industry draft guidance is open to consultation until 3 December 2026. This offers an important opportunity for firms to highlight uncertainties and potential sources of friction.
- Timing: While formal application dates remain unconfirmed, and despite the prospect of transitional flexibility for existing arrangements, firms should begin their scoping analysis and implementation planning without delay.
New EBA and Central Bank guidance
The EBA published its final Guidelines on third-party risk management in September 2026, followed in October by the Central Bank’s consultation (CP 173) on its Draft Guidance on Good Practices for the Sound Management of Third-Party Risks.
These parallel standards set similar expectations about how in-scope regulated firms should manage the risks associated with relying on third-party service providers (TPSPs) for non-ICT services. They specify internal governance arrangements and sound risk management practices that are aligned broadly with DORA. Together with DORA, the goal is to deliver a harmonised approach to third-party risk management across ICT and non-ICT arrangements.
The new guidance reflects supervisory concern that ineffective third-party risk management could expose market participants and the broader financial system to significant harm. Both regulators endorse a proportionate, risk-based approach, with an emphasis on services supporting critical or important functions.
Once applicable, both sets of guidance will replace outgoing outsourcing guidance, namely the EBA’s 2019 Guidelines on outsourcing arrangements and the Central Bank’s 2021 Cross-Industry Guidance on Outsourcing.
Incoming standards
The new Central Bank and EBA frameworks set expectations related to:
- Registers of information
- The assessment of criticality and importance
- Enhanced pre-contractual due diligence
- Contractual safeguards and mandatory clauses
- Risk assessment of third-party arrangements
- Documented policies, exit strategies and continuity testing
- Managing conflicts of interest
- Integrating ESG/climate risks into the appointment of TPSPs
- Ongoing monitoring and audit rights of third-party arrangements, and
- Board accountability and governance oversight
Practices that attract particular focus due to perceived elevated risk include:
- The sub-contracting of critical or important functions
- Third-party arrangements regarding internal control functions
- Third-party arrangements that augment concentration risk
- Over-reliance on TPSPs
- Arrangements across long or complicated operational chains
- The use of TPSPs for functions that are critical from a resolution perspective, and
- Offshoring of functions to third countries
Simplification or additional compliance burden?
Both regulators position their respective guidance as part of their ongoing regulatory simplification work. Terms like proportionality, risk-alignment, harmonisation and burden reduction are woven throughout both texts. Similarly, the Central Bank states in CP 173 that its draft guidance ‘does not impose new or more stringent standards or practices’.
Nevertheless, firms will need to thoroughly consider whether the scope of the new standards is sufficiently clear, especially in view of existing regulation and guidance. Ultimately, they need to establish whether an incremental compliance burden is in fact being created.
Scoping challenges
Assessing capture
The scope of the EBA’s guidelines is wider than its outgoing outsourcing guidance[3], with additional cohorts of financial entities being swept in. These include:
- Issuers of asset-referenced tokens (ARTs) under MiCAR[4]
- Creditors under the Mortgage Credit Directive, specifically those that are financial institutions
- Certain investment firms under the Investment Firms Regulation[5], and
- Approved financial or mixed financial holding companies
The EBA also confirmed the inclusion of third-country branches of credit institutions. These branches are expected to comply on a proportionate basis, in conjunction with the EBA Guidelines on internal governance under the Capital Requirements Directive.[6]
Financial entities subject to the EBA guidelines must make ‘every effort to comply’. In contrast, the Central Bank’s draft guidance represents non-binding, outcomes-focused advice, which will apply on a cross-industry basis. Unlike the EBA’s guidance, it also covers ICT arrangements for firms outside DORA.
Firms across all sectors will need to take these differences into account when identifying supervisory expectations under the applicable regimes and diagnosing any uplift work needed.
However, this may require considerable effort. Firms in scope of both domestic and EBA guidance should consider the impact of any nuances between the two regimes. This could lead to uncertainty and defensive adoption. Consequently, it could give rise to perceptions of supervisory gold-plating. For example, the good practices set out in the Central Bank's new guidance apply primarily to critical or important arrangements, with firms expected to self-assess whether it is 'prudent' to extend them further. The EBA, by contrast, specifies which requirements apply to all arrangements and which apply primarily to critical or important functions.
More generally, firms should identify incremental changes to outgoing outsourcing guidelines, and how they implement related provisions of existing sectoral regulation, eg PSD2 or AIFMD II.
Group-level considerations could further complicate analysis where firms have footprints in both Ireland and other EU Member State(s). Both pieces of guidance set expectations for individual and consolidated-level compliance. It is also worth noting that intragroup arrangements still fall squarely within scope.
Measuring the compliance burden
Compliance synergies may exist where the expected practices are already familiar or in situ. The Central Bank makes this point in CP 173, stating that it expects the guidance to have ‘limited additional insight’ where ‘comprehensive frameworks’ like DORA and the EBA guidelines already exist.
Therefore, firms falling outside of both DORA and the new EBA Guidelines are likely to feel the incremental burden most acutely. Examples include small insurance undertakings and firms operating in the credit servicing and retail credit sectors.
However, even firms that comply with DORA, or are accustomed to managing critical delegation under other regulatory regimes, will still face the operational strain of expanding their third-party risk management regimes and gapping to existing practices.
Evolution of ‘outsourcing’
While there is minor nuance between the EBA and Central Bank’s respective approaches to defining ‘outsourcing’ and ‘third-party risk,’ they are broadly aligned and their common denominator is the treatment of outsourcing as a sub-set of third-party arrangements. This is a key conceptual shift to which firms will need to acclimatise.
The Central Bank also clarifies that outsourcing and delegation are not considered different concepts.
This means that, in practice, firms must look beyond legacy 'outsourcing' or ‘delegation’ labels and map all external dependencies under a single, unified third-party risk framework.
Uncertain timelines
The application date of the EBA guidelines is not yet confirmed. The Central Bank’s draft guidance will remain open to public consultation until 3 December 2026. Final Central Bank guidance is currently not expected until Q1 2027.
When the EBA guidelines become applicable, in-scope firms will be expected to review and amend, as appropriate, existing third-party arrangements to ensure compliance in line with the following schedule: