The Central Bank of Ireland (CBI) has published Consultation Paper CP173 (Consultation Paper).

It sets out proposed Guidance on Good Practices for the Sound Management of Third-Party Risks (Guidance). Once finalised, the Guidance will replace the CBI’s Cross-Industry Guidance on Outsourcing published in December 2021 (2021 Guidance). The consultation will remain open for eight weeks, closing on 3 December 2026.This follows the publication by the European Banking Authority (EBA) of its final Guidelines on the sound management of third-party risk regarding non-ICT services (2026 EBA Guidelines), which we considered in our earlier article here.

In this article, we look at the objectives of the Guidance, how it aligns with the 2026 EBA Guidelines, and the practical differences between the Guidance and the 2021 Guidance.

The Digital Operational Resilience Act (DORA) applies to critical and non-critical ICT enabled/ICT services provided on an ongoing basis to a financial entity, subject to very limited exceptions. The Guidance applies to all other critical and non-critical third party services (i.e. services outside of DORA) provided on an on-going basis to a financial entity, subject to very limited exceptions.

Objectives of the Guidance

The CBI has identified six objectives for the updated Guidance:

• Broader scope: to address material arrangements creating a reliance or dependency, including partnerships, joint ventures, cloud services, fintech collaborations and shared services that may fall outside traditional definitions of outsourcing.
• Alignment with international standards: consistency with evolving international frameworks particularly the 2026 EBA Guidelines and DORA.
• Enhanced clarity: clearer guidance on risk areas identified through supervisory engagement, including governance, risk assessment and concentration risk.
• Operational resilience focus: more explicit integration of third-party risk management within firms’ operational resilience frameworks.
• Proportionality: a flexible, outcomes-based approach that firms of all sizes can apply proportionately.
• Simplification: effective and efficient regulation, with proportionality, predictability and a focus on outcomes at its core.

These objectives demonstrate the CBI’s intention to align its domestic approach with the pan-European approach to third-party risk management. The Guidance draws on the 2026 EBA Guidelines, DORA and the European Securities Markets Authority’s Principles on Third-Party Risks. It also draws on international standards set by the Basel Committee on Banking Supervision and the Financial Stability Board.

Status of the Guidance

The Guidance is not legally binding, which is also the position under the 2021 Guidance. It sets out the CBI’s opinion and advice on good practice and does not create new legal obligations or replace firms’ obligations under European or sectoral frameworks.

However, the CBI is clear that the Guidance will inform its supervisory activity and that firms should actively consider it, even though they are not required to adhere rigidly to it. In practice, a firm that adopts a different approach should be able to show the CBI how that approach appropriately manages the relevant risks.

Alignment with the 2026 EBA Guidelines and DORA

The Guidance follows the approach taken in the 2026 EBA Guidelines, under which competent authorities look at third-party risk management as a whole, beyond the narrower lens of outsourcing.

The aim is to bridge the gap with DORA and capture all third-party services that create a reliance or dependency whether ICT or non-ICT. Third-party risks are framed by reference to any arrangement between a firm and a third-party service provider, including intragroup arrangements, for the provision of services on an ongoing or recurring basis.

The 2026 EBA Guidelines set out minimum contractual provisions for every in-scope third-party arrangement, whether or not it supports a critical or important function. They also set out additional provisions for arrangements supporting critical or important functions. These are similar to the key contractual provisions required under DORA for ICT services, and include requirements on the flow-down of contractual obligations to subcontractors. The Guidance adopts the same approach.

Who is this Guidance aimed at?

The CBI acknowledges that firms subject to DORA and to the 2026 EBA Guidelines may find that the Guidance provides only limited additional insight.

The Guidance is aimed primarily at firms whose regulatory frameworks contain high-level obligations to manage risk such as insurance undertakings and retail credit firms. Those frameworks often lack sufficient detail on how to comply in practice. Firms whose frameworks focus primarily on traditional outsourcing may face greater one-off costs in identifying and assessing a broader range of dependencies.

Practical Differences from the 2021 Guidance

The CBI states that the Guidance builds on and clarifies the 2021 Guidance. Comparing the two documents, we note the following practical differences:

• Scope: the 2021 Guidance applied only to outsourcing, leaving it to firms to decide whether to apply it to other third-party or vendor arrangements as good practice. The Guidance applies to all third-party arrangements that create a reliance, including partnerships and joint ventures. It treats intragroup arrangements in the same manner as external arrangements, while recognising that the assessment of their risks will differ.
• Structure: the 2021 Guidance was organised into ten topic-based sections. The Guidance is built around five lifecycle stages of a third-party arrangement, each supported by foundational and supporting good practices.
• Contracting: the detailed contractual provisions in the 2021 Guidance focused on critical or important arrangements, with other arrangements requiring only appropriate contractual safeguards. The Guidance sets out a baseline list of provisions for all third-party agreements, with further provisions for critical or important functions.
• Dominant providers: the Guidance responds to industry concern about providers offering standard terms on a non-negotiable basis. Where a firm cannot obtain particular protections, it should assess the residual risk, consider available alternatives and implement proportionate mitigating measures. The Consultation Paper adds that firms should document their efforts to secure appropriate terms.
• Critical or important functions: the 2021 Guidance set out a detailed list of factors to consider when determining whether a function is critical or important. The Guidance leaves it to each firm to develop its own effective risk-based process and criteria, and highlights that the status of a function may change over the life of an arrangement.

Next Steps

Responses should be submitted to [email protected] by 3 December 2026.

The CBI also plans an industry workshop and welcomes bilateral meetings. The CBI anticipates publishing the final Guidance in Q1 2027, effective from the date of publication, at which point the 2021 Guidance will be withdrawn.

As explained in our previous article, here, firms currently relying on the 2021 Guidance should now begin mapping their arrangements against the broader definition of third-party  arrangements given the scale of the population likely to be captured for the first time.

How we can help

If you have any queries on the Guidance, or would like help preparing a consultation response, then please do not hesitate to get in touch with any of the Key Contacts listed or your usual William Fry contact.