On 18 September 2026, the European Banking Authority (the EBA) published its final report on the new “Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09)” (the 2026 Guidelines).

The 2026 Guidelines replace the EBA’s previous guidelines on outsourcing arrangements (EBA/GL/2019/02) (the 2019 Guidelines), which outlined the standards that the EBA expects firms to uphold in relation to their outsourcing arrangements, as well as its supervisory expectations and processes.

The 2026 Guidelines extend beyond outsourcing specifically to the broader concept of third-party arrangements, and widen the range of entities to which they apply. Published against the backdrop of the Digital Operational Resilience Act (DORA), which governs third-party risk for ICT services, the 2026 Guidelines are designed to close the corresponding gap for non-ICT services and to give financial entities and competent authorities a consistent framework across both regimes.

Why update the 2019 Guidelines?

As outlined above, the 2026 Guidelines take into account the implementation of DORA and aim to create a more harmonised framework regarding the sound management of third-party risk.

DORA provides a robust framework for the management of ICT services and third-party ICT service providers. The 2026 Guidelines seek to address the gap that exists relating to the use of third-party providers for the provision of non-ICT services to financial entities.

The EBA aims to closely align the frameworks for ICT services and non-ICT services “to ensure a level playing field and foster supervisory convergence“, enabling financial entities to take a holistic approach across both ICT and non-ICT third-party risk. One example of this practical alignment point is that firms are encouraged to align their register of third-party arrangements, with the register of information required under Article 28(3) of DORA, and potentially even to combine the two.

Much of the substantive detail in the 2026 Guidelines carries over from 2019 with terminology updated to reflect the nature of non-ICT services rather than content changed. For example, the requirements on concentration risk monitoring at both an entity and competent authority level, and on preventing financial entities from becoming “empty shells”, both carry through from the 2019 text largely unchanged. The same is true of the core distinction between critical or important functions and other arrangements, which continues to trigger stricter requirements, and of the obligation to maintain an exit strategy for arrangements supporting those functions.

What has been updated?

The most significant change is one of scope.

The 2019 Guidelines applied to outsourcing arrangements, defined as arrangements under which a service provider performs a function that would otherwise be carried out by the institution itself. However, the 2026 Guidelines apply to the wider category of third-party arrangements, defined as any arrangement, including intragroup, for the support of a function on a recurrent or ongoing basis. Outsourcing is retained as a defined term, but it is now expressly described as a subset of the broader third-party arrangement concept.

In practice, this brings a wider range of vendor and service provider relationships within scope, including arrangements that support a function without fully replacing it, and arrangements that would previously have fallen outside the outsourcing definition on a narrow reading.

Furthermore, akin to DORA, the 2026 Guidelines are now concerned with agreements that support non-critical or non-important functions in addition to those agreements supporting critical or important functions. Where a third-party arrangement is found in-scope the 2026 Guidelines, regardless of the arrangement being critical or non-critical, impose the mandatory inclusion of certain contractual clauses which are akin to the mandatory clauses imposed under the DORA regime for ICT-services (including requirements regarding the flow down of contractual obligations to subcontractors), with the list of clauses required dependant on whether the non-ICT service supports a critical or important function of the financial entity.

A wider group of addressees

While the 2019 Guidelines applied to credit institutions, payment institutions and electronic money institutions, the 2026 Guidelines extends that list to also include:

• certain investment firms;
• issuers of asset-referenced tokens under the Markets in Crypto-Assets Regulation;
• creditors under the Mortgage Credit Directive that are financial institutions;
• third-country branches carrying out banking activities in the EU; and
• financial holding companies and mixed financial holding companies approved under Article 21a of the Capital Requirements Directive.

Timeline and next steps for firms

 It has not been confirmed when the 2026 Guidelines will apply, but it is noted that there will be a two-year transitional period to support a smooth and proportionate implementation:

• a two-year transitional period applies for arrangements supporting critical or important functions; where review and documentation are not complete within that window, the competent authority must be informed, together with planned remedial measures or, where relevant, an exit strategy; and
• arrangements supporting non-critical functions may be reviewed at the point of renewal rather than immediately.

Firms currently relying on the 2019 outsourcing framework should begin mapping their existing arrangements against the broader third-party arrangement definition now, rather than waiting for the application date to be confirmed, given the scale of the population likely to be captured for the first time. This will also allow firms to identify those arrangements which need to be amended to account for the mandated clauses provided under the 2026 Guidelines, many of which may be missing from non-critical arrangements.

From an Irish perspective, given that the pre-existing Central Bank of Ireland’s Cross-Industry Guidance on Outsourcing is largely based on the 2019 Guidance, it is likely that we can expect updates to this too. Updates to the Central Bank of Ireland’s guidance on outsourcing was already highlighted this year as an agenda item and objective for the Central Bank of Ireland.

If you have any queries on the new 2026 Guidelines, or on how to remediate outsourcing contracts, then please do not hesitate to get in touch with any of the Key Contacts listed or your usual William Fry contact.