EBA and CBI reshape third-party risk management: key actions for firms ahead of 2027

The European Banking Authority (EBA) and Central Bank of Ireland (CBI) plan to replace existing outsourcing frameworks with a broader third-party risk management regime beyond Information and Communication Technology (ICT) services. The proposed framework will apply to a wide range of regulated firms, including credit institutions, investment firms, payment and electronic money institutions, issuers of asset-referenced tokens and certain mortgage lenders.

Regulators are seeking to establish a more comprehensive and integrated approach to managing third-party risk. This reflects the evolving requirements of the Digital Operational Resilience Act (DORA) and financial institutions' increasing reliance on external service providers.

EBA Guidelines on Sound Management of Third-party risk regarding non-ICT services  

On 18 September 2026, the European Banking Authority (EBA) published its Final Guidelines on the Sound Management of Third-party Risk Related to Non-ICT Services. These Guidelines will replace the EBA's 2019 Guidelines on Outsourcing Arrangements, reflecting a broader and more comprehensive approach to the management of third-party risk across the financial sector. While the application date of the Final Guidelines has yet to be confirmed, there will be a two-year transitional period to facilitate implementation and alignment with the new requirements. 

The EBA's Final Guidelines on the Sound Management of Third-Party Risk for non-ICT services are closely aligned with DORA. They distinguish between ICT and non-ICT services while recognising that some third-party arrangements may include both. Where a non-ICT service includes a technology component, firms must assess whether it is significant enough to fall within DORA's scope. To support this, the EBA reinforces the importance of a coordinated and holistic approach to third-party risk management across both frameworks. 

The Guidelines expand third-party risk management to cover all services provided by third parties to an institution. Firms will be expected to maintain a Board approved third-party risk strategy, supported by a documented policy governing non-ICT services that support critical or important functions. This framework must be reviewed at least annually.  

In addition, firms will be required to maintain a register of all in-scope third-party arrangements, with enhanced information recorded for those supporting critical or important functions. The register should be consistent with, and may be integrated into, the register maintained under DORA, reducing duplication across compliance obligations.

CP173: Guidance on Good Practices for the Sound Management of Third-party Risks 

The Central Bank of Ireland (CBI) has launched a consultation on its draft Guidance on Good Practices for the Sound Management of Third-party Risks. The consultation period commenced on 8 October 2026 and will remain open until 3 December 2026. The CBI expects to finalise and publish the guidance in the first quarter of 2027. Once implemented, the new guidance will replace the CBI's existing Cross-Industry Guidance on Outsourcing, reflecting a broader and more integrated approach to the management of third-party risk across regulated firms. 

The Central Bank of Ireland's Draft Guidance covers outsourcing and other third-party relationships involving material reliance on external providers. Adopting an outcomes-based approach, the Draft Guidance is designed to support firms in strengthening their third-party risk management frameworks through a series of clearly defined supervisory expectations. Rather than prescribing detailed requirements, it is structured around key outcomes that firms should seek to achieve and is accompanied by illustrative examples of good practice. This will enable firms to assess and benchmark the maturity of their existing arrangements. 

The proposed framework covers the full lifecycle of third-party risk management. This includes governance, due diligence, contracting, ongoing monitoring, incident management, and exit planning. Through this structure, the CBI aims to promote more robust, proportionate and effective management of third-party dependencies across the financial services sector.  

The CBI Guidance itself is non-binding; it reflects the CBI’s views on good practice in the management of third-party risk. It does not create new legal obligations or amend existing statutory or regulatory requirements. However, the Guidance is intended to promote consistency with relevant EU and international standards, including the EBA’s Guidelines on the Sound Management of Third-Party Risk relating to non-ICT services. While firms retain discretion in how they achieve compliance, the Guidance will inform the CBI’s supervisory engagement. Firms may be expected to explain and justify any material departures from its recommendations.

Conclusion 

As firms prepare for the evolving third-party risk landscape, they should assess their existing frameworks against both the EBA and CBI expectations. This includes identifying third-party arrangements that may fall outside traditional outsourcing classifications and determining whether they are subject to DORA or the new guidelines. It also includes ensuring that third-party risk is embedded within the broader risk management framework through robust governance, supported by a board-approved strategy and policy. 

How Forvis Mazars can help 

As the regulatory expectations governing outsourcing and third-party risk management continue to evolve, firms should take proactive steps to assess the impact of the new requirements ahead of implementation.  

Our prudential risk specialists support firms in navigating this changing landscape, including assessing whether arrangements fall within the scope of DORA or the emerging third-party risk management framework. We also assist firms in embedding third-party risk considerations within their governance and risk management processes, as well as developing and enhancing third-party risk management strategies that align with regulatory expectations.