EBA Finalises Non-ICT Third-Party Risk Guidelines: What Financial Firms Need Beyond DORA
The European Banking Authority is moving regulated financial firms from traditional outsourcing compliance toward a broader third-party risk management framework.
On 18 September 2026, the European Banking Authority (EBA) published final Guidelines on the sound management of third-party risk relating to non-ICT services. The framework covers the full lifecycle of third-party relationships, including risk assessment, due diligence, contracting, subcontracting, monitoring, documentation and exit strategies, with particular attention to services supporting critical or important functions.
The Guidelines are designed to complement, rather than replace, the Digital Operational Resilience Act (DORA). DORA continues to govern ICT third-party risk, while the new EBA framework addresses relevant non-ICT services and brings their governance closer to the operational-resilience model already familiar from DORA.
The change matters for banks, payment institutions, electronic money institutions, certain investment firms and MiCA asset-referenced token issuers. It also matters operationally because the old question — “Is this arrangement outsourcing?” — becomes less decisive. Firms increasingly need to ask a broader question: Does this third-party relationship support a critical or important function, and what would happen if the provider failed?
For readers’ convenience, we have placed the key official EBA and EU regulatory materials at the end of this article.
Publish Date
30 Sep 2026
Reading Time
13 minutes
Category
Legal News
Jurisdiction
EU
The EBA is replacing its 2019 outsourcing framework
The EBA’s existing Guidelines on outsourcing arrangements date from 2019.
Those Guidelines created a harmonised framework for outsourcing by credit institutions, payment institutions, electronic money institutions and other in-scope firms. They focused heavily on identifying whether an arrangement constituted outsourcing and whether the outsourced function was critical or important.
The regulatory environment has changed significantly since then.
DORA has introduced an EU-wide framework for managing ICT third-party risk, while MiCA, the Investment Firms Directive and other sectoral legislation have expanded or changed the population of regulated financial entities.
The EBA is therefore replacing its outsourcing-focused model with a wider framework for non-ICT third-party risk. Its official regulatory page confirms that, once the new Guidelines apply, they will repeal the 2019 Guidelines on outsourcing arrangements.
The new Guidelines are final but not yet applicable
This legal-status distinction is important.
As of 26 September 2026, the EBA lists the Guidelines as final and awaiting translation into the EU official languages. The EBA’s regulatory page currently shows them as not yet applicable, with the application date and compliance deadline not yet populated.
Firms therefore do not have a September 2026 implementation deadline.
However, the final framework is already sufficiently developed for businesses to begin gap analysis and contract mapping.
DORA does not cover every third-party dependency
Many financial firms spent 2024 and 2025 building extensive third-party governance programmes around DORA.
That work remains necessary, but it is not the whole third-party risk framework.
DORA specifically regulates ICT third-party risk. Article 28 requires financial entities to manage ICT third-party risk as an integral part of their ICT risk-management framework and makes clear that firms remain fully responsible for regulatory compliance even when ICT services are outsourced.
The EBA’s new Guidelines address the other side of the dependency map: relevant non-ICT third-party services.
DORA and the EBA Guidelines should operate alongside each other
At a high level, the emerging architecture looks like this:
| Third-party service | Main regulatory framework |
|---|---|
| ICT services | DORA |
| Non-ICT third-party services | EBA Third-Party Risk Guidelines, where the entity and arrangement fall within scope |
| Services supporting critical or important functions | Heightened governance under the applicable framework |
The focus is on critical or important functions
The final Guidelines deliberately concentrate the most significant obligations around third-party arrangements supporting critical or important functions, often shortened to CIFs.
The EBA describes these as functions whose disruption would materially impair the performance of a financial entity.
This reflects a broader proportionality principle.
Not every vendor should require the same level of due diligence, contract negotiation, monitoring or exit planning.
Criticality should be assessed by impact, not vendor category
The analysis should therefore focus on what the service supports.
A seemingly ordinary non-ICT provider may be critical if its failure would materially affect:
- regulated services;
- customers;
- financial soundness;
- authorisation conditions;
- compliance with legal obligations; or
- continuity of important business operations.
Conversely, a commercially significant contract may still be less important from a regulatory-resilience perspective if the service is readily replaceable and does not support a critical function.
The result is a more risk-based procurement model.
The Guidelines cover the full third-party lifecycle
The new framework is not limited to contract wording.
The EBA expressly says that the Guidelines cover the entire lifecycle of a third-party arrangement.
That lifecycle includes:
- risk assessment;
- provider due diligence;
- contractual arrangements;
- subcontracting;
- ongoing monitoring;
- documentation; and
- exit strategies.
For compliance teams, this means third-party risk cannot be delegated entirely to procurement or legal.
Governance needs to begin before the contract is signed and continue until the relationship ends.
Risk assessment comes before contracting
The first question should be whether the contemplated third-party arrangement creates operational, regulatory, concentration or other material risks.
For services supporting critical or important functions, firms should understand what happens if the service is interrupted or the provider becomes unavailable.
Relevant factors can include:
- operational dependency;
- provider substitutability;
- geographic concentration;
- financial stability;
- legal and regulatory risk;
- subcontracting chains;
- data or confidentiality exposure;
- group dependencies; and
- business continuity impact.
The purpose is not simply to assign a vendor-risk score.
The assessment should determine the level of contractual protection, monitoring and exit planning required.
Due diligence must match the importance of the service
The Guidelines continue the EBA’s established principle that firms should understand providers before relying on them.
The intensity of due diligence should be proportionate to the arrangement.
For a provider supporting a critical function, due diligence may need to examine:
- financial capacity;
- corporate structure;
- operational capability;
- internal controls;
- regulatory status;
- reputation;
- continuity arrangements;
- subcontracting model;
- conflicts of interest; and
- ability to meet contractual and regulatory requirements.
This is especially important where the provider sits outside the EU or is difficult to replace.
The EBA’s wider risk work reinforces that point.
On 23 September 2026, the European Supervisory Authorities identified external dependencies as a key vulnerability for the EU financial system and highlighted continuing reliance on non-EU service providers and infrastructures.
Contracts become a regulatory control
For critical arrangements, the contract is not merely a commercial agreement.
It is part of the firm’s risk-management architecture.
The new framework is intended to ensure that firms can monitor the service, obtain necessary information, manage subcontracting and exit the arrangement where required.
That means firms should review whether their agreements provide sufficient rights relating to matters such as:
- service scope;
- performance obligations;
- audit and information rights;
- regulator access;
- business continuity;
- incident notification;
- confidentiality;
- subcontracting;
- termination;
- transition assistance; and
- exit.
A contract that is commercially attractive but impossible to supervise may create a regulatory problem.
Subcontracting chains receive closer attention
Subcontracting is increasingly significant in financial services.
A regulated entity may sign with one provider while the actual service depends on several other businesses further down the chain.
This creates two risks.
First, the regulated firm can become dependent on entities it did not directly select.
Second, operational concentration may be hidden because several apparently different providers ultimately depend on the same subcontractor.
The EBA therefore includes subcontracting as a specific part of the third-party risk lifecycle.
For critical services, firms should understand who actually performs material parts of the service and how changes to the subcontracting chain are controlled.
Monitoring cannot end after onboarding
Vendor due diligence at the start of a relationship does not solve ongoing risk.
A provider’s financial condition, ownership, subcontractors, business model or service quality can change.
The EBA framework therefore requires ongoing monitoring proportionate to the importance of the arrangement.
For critical third parties, firms should consider whether they receive enough information to identify deterioration before service failure becomes a customer or regulatory incident.
Internal ownership also matters.
A contract without a clearly responsible business owner can remain formally compliant while becoming operationally unmanaged.
Exit planning becomes a central requirement
One of the clearest areas of alignment with DORA is the focus on exit strategies.
A firm should know how it would leave a critical third-party arrangement before it urgently needs to do so.
For a critical service, the exit analysis should consider questions such as:
- Is another provider available?
- How long would migration take?
- Can the service be brought back in-house?
- What information or records must be transferred?
- Is provider cooperation required?
- Would the firm remain compliant during transition?
- What happens if the provider fails suddenly rather than cooperatively?
Exit planning should therefore be operational, not simply a clause stating that termination is permitted.
The third-party register becomes more important
The EBA’s earlier consultation work expressly sought consistency between the new non-ICT framework and the DORA register of information.
It contemplated allowing firms to maintain consistent information for ICT and non-ICT services and potentially use one combined register.
This is significant from an implementation perspective.
Many DORA-covered businesses have already invested substantial resources in:
- provider inventories;
- criticality assessments;
- service mapping;
- subcontractor information;
- contract records; and
- exit documentation.
Rather than creating a disconnected non-ICT system, firms should consider whether the same governance infrastructure can support both frameworks.
One register does not mean identical requirements
ICT and non-ICT services remain subject to different legal instruments.
A combined internal register should therefore preserve the information required under each framework and clearly identify which rules apply to each arrangement.
The objective should be operational integration without blurring legal distinctions.
Who is affected?
The EBA developed the Guidelines using legal bases across several EU financial-services frameworks.
Its official press release identifies, among others:
- Capital Requirements Directive governance provisions;
- PSD2;
- the Investment Firms Directive;
- MiFID II; and
- Article 34 of MiCA.
In practical terms, the framework is relevant to categories including:
- credit institutions;
- payment institutions;
- electronic money institutions;
- certain investment firms; and
- issuers of asset-referenced tokens under MiCA.
The precise perimeter should still be checked against the final Guidelines and the entity’s regulatory status.
Payment institutions and EMIs should not treat DORA remediation as finished
The new Guidelines are particularly relevant to payment and electronic-money firms.
Many such businesses already rely extensively on third parties for functions including:
- customer onboarding;
- KYC operations;
- card or payment operations;
- fraud support;
- customer service;
- compliance operations;
- cash-management services; and
- other operational processes.
Some of those relationships may be ICT services and therefore subject to DORA.
Others may be non-ICT arrangements.
The compliance task is therefore to classify both the service type and business criticality.
A vendor inventory built only around cloud and software providers is unlikely to be sufficient.
MiCA issuers also need to examine non-ICT dependencies
The Guidelines have direct relevance to MiCA through Article 34, which establishes governance expectations for issuers of asset-referenced tokens.
The EBA expressly included Article 34 MiCA among the legal bases taken into account in developing the Guidelines.
For an ART issuer, relevant non-ICT dependencies could potentially arise around functions such as:
- reserve-related operational services;
- administrative functions;
- compliance support;
- customer operations;
- outsourced control functions; and
- other third-party processes supporting issuance.
The specific arrangement and legal structure will determine whether the Guidelines apply.
CASPs are not automatically brought into the new Guidelines
This point requires particular care.
The existence of MiCA in the EBA’s legal basis does not mean that every crypto-asset service provider becomes directly subject to these Guidelines solely because it is a CASP.
In its separate 24 September 2026 MiCA review response, the EBA itself recommended that Article 73 MiCA be updated to refer to third-party risk management rather than outsourcing and suggested that a mandate could be considered to align non-ICT risk-management expectations for CASPs with other financial institutions.
That recommendation indicates that the current framework is not yet fully harmonised for CASPs.
A CASP may still face third-party requirements through DORA, MiCA Article 73, contractual obligations or another regulatory status.
But businesses should not describe EBA/GL/2026/09 as a universal new CASP third-party regime.
Outsourcing becomes only part of the analysis
One of the conceptual changes is the shift from outsourcing risk to third-party risk.
Historically, firms often began with the question:
“Would we otherwise perform this activity ourselves?”
If the answer was no, the relationship might fall outside the technical outsourcing definition.
Under a broader third-party-risk approach, that is not necessarily the end of the analysis.
The important question becomes whether the external service supports a function important to the regulated firm and whether dependency on the provider creates material risk.
This can bring procurement, operational-resilience and enterprise-risk teams more directly into regulatory compliance.
The Guidelines use proportionality more explicitly
The EBA says the final framework deliberately concentrates requirements on arrangements supporting critical or important functions so that less material relationships do not face unnecessary operational and supervisory burden.
This is significant because regulated firms may have thousands of suppliers.
A framework that treated every office supplier or professional service relationship as equivalent to a provider supporting payments processing would be operationally unrealistic.
Proportionality therefore needs to be documented, not merely assumed.
Firms should be able to explain:
- how arrangements were classified;
- why a provider was or was not considered critical;
- what level of due diligence was applied; and
- why the monitoring approach is proportionate.
There is a two-year transitional period
The EBA has confirmed a two-year transitional period to support implementation.
The earlier consultation materials described that transition as allowing firms to review and amend existing third-party arrangements and update registers for non-ICT services.
However, the clock requires careful description.
The two-year period has not started from 18 September automatically
As of 26 September 2026, the EBA’s official page still records the final Guidelines as not yet applicable and leaves the application date blank.
The two-year transition should therefore not be presented as expiring in September 2028 automatically.
The operative implementation date must be checked once the EBA completes the translation and compliance process and publishes the applicable date.
Until then, the existing 2019 outsourcing Guidelines remain the relevant EBA framework where applicable.
Why firms should start before the application date
The absence of an immediate deadline does not make this a low-priority project.
Third-party remediation can take considerable time.
A bank or payment institution may need to:
- identify additional non-ICT arrangements;
- classify criticality;
- create or extend a register;
- reperform due diligence;
- assign internal ownership;
- renegotiate contract terms;
- map subcontractors;
- build monitoring controls; and
- create credible exit strategies.
Contract renegotiation in particular can become a bottleneck.
Large third-party providers may receive similar amendment requests from many regulated customers simultaneously.
Firms that begin mapping early should have more time to prioritise arrangements supporting critical functions.
DORA work can be reused
The most efficient implementation approach is unlikely to be a completely new compliance programme.
Existing DORA work can provide much of the infrastructure.
For example, firms may already have:
- third-party governance policies;
- criticality methodologies;
- contract review templates;
- risk-assessment procedures;
- provider registers;
- audit-right standards;
- concentration-risk analysis; and
- exit-plan templates.
Those tools can potentially be adapted for non-ICT services.
The legal rules still need to be mapped separately, but the governance architecture does not necessarily need to be rebuilt.
External dependency risk is becoming a wider supervisory theme
The timing of the final Guidelines is notable.
Only five days after publication, the ESAs identified external dependencies among the key vulnerabilities facing the EU financial system.
Their Autumn 2026 risk update highlights reliance on non-EU providers, payment systems and infrastructure and warns that external dependencies can amplify geopolitical and operational disruption.
The EBA’s June 2026 risk assessment also reported that approximately 80% of surveyed banks viewed dependencies on non-EU/EEA ICT providers as a significant challenge, with payment-solution dependencies the next major concern.
Those statistics concern ICT and broader dependencies rather than the non-ICT Guidelines alone.
But they illustrate the supervisory direction: regulators increasingly care about where critical financial services depend on external providers and whether firms can continue operating if those providers fail.
EBA third-party risk framework compared with DORA
| Issue | DORA | New EBA Guidelines |
|---|---|---|
| Primary focus | ICT third-party risk | Non-ICT third-party risk |
| Risk approach | ICT risk management and operational resilience | Wider third-party lifecycle governance |
| Criticality | ICT services supporting critical or important functions receive heightened treatment | Non-ICT arrangements supporting critical or important functions receive heightened treatment |
| Due diligence | Required before relevant ICT arrangements | Central part of third-party lifecycle |
| Contract requirements | Detailed requirements for ICT contracts | Contractual controls proportionate to non-ICT third-party risk |
| Subcontracting | Specific focus under DORA framework | Specific part of lifecycle management |
| Register | DORA register of information | Non-ICT register designed to align where possible with DORA |
| Exit planning | Required for material ICT dependencies | Required as part of third-party risk lifecycle |
| Application | DORA applicable since 17 January 2025 | Final Guidelines not yet applicable as of 26 September 2026 |
What financial firms should do now
Map all third parties, not only existing outsourcing arrangements
Start with the complete vendor population.
A firm that simply exports its 2019 outsourcing register may miss third-party relationships falling within the new broader risk-management approach.
Separate ICT from non-ICT
Identify which arrangements fall under the DORA definition of ICT services.
Those relationships should continue through the DORA governance process.
The remainder should be assessed against the new EBA framework where the entity is in scope.
Identify critical or important functions
Map providers to the internal functions they support.
The criticality assessment should be consistent enough that the business can explain why similar dependencies receive similar treatment.
Reuse the DORA register where practical
Consider whether the DORA register can be expanded into an integrated third-party inventory.
Avoid unnecessary parallel databases where the information can be governed consistently.
Prioritise critical contracts
Not every contract needs to be renegotiated first.
Focus on arrangements where the provider supports a critical or important function, where contractual rights are weak, or where substitutability is limited.
Test exit plans
A written exit strategy should be operationally credible.
Where no realistic alternative provider exists, management should understand the resulting concentration and continuity risk.
Bring procurement into regulatory governance
Procurement teams should understand that provider onboarding can trigger regulatory analysis before signature.
Criticality classification should happen early enough to influence due diligence and negotiation, not after the contract has been executed.
Legasset assists banks, fintechs, payment institutions, electronic money institutions and crypto businesses with regulatory outsourcing and third-party risk frameworks, DORA gap analysis, vendor governance, contract review, operational-resilience planning and market-entry compliance.
We can also support businesses aligning existing DORA programmes with broader non-ICT third-party governance without duplicating registers, policies and contractual remediation unnecessarily.
EBA Third-Party Risk Guidelines FAQ
What did the EBA publish in September 2026?
On 18 September 2026, the EBA published final Guidelines on the sound management of third-party risk relating to non-ICT services.
They create a lifecycle framework covering risk assessment, due diligence, contracting, subcontracting, monitoring, documentation and exit strategies.
Are the new EBA Guidelines already applicable?
No.
As of 26 September 2026, the EBA lists them as final but not yet applicable and awaiting translation into the EU official languages.
The application date has not yet been populated on the EBA’s official page.
What happens to the 2019 EBA Outsourcing Guidelines?
The EBA states that the 2019 Guidelines on outsourcing arrangements will be repealed once the new third-party risk Guidelines become applicable.
Do the Guidelines replace DORA?
No.
DORA remains the primary EU framework for ICT third-party risk.
The new EBA Guidelines address relevant non-ICT third-party services and are designed to align their governance more closely with DORA.
What is a critical or important function?
At a high level, it is a function whose disruption would materially impair the performance of the financial entity.
The classification is important because the EBA framework places particular emphasis on third-party arrangements supporting such functions.
Do the Guidelines only apply to outsourcing?
No.
The framework represents a move toward broader third-party risk management, rather than limiting the analysis to traditional outsourcing arrangements.
Outsourcing remains relevant, but firms need to examine non-ICT third-party dependencies more widely.
Do the Guidelines apply to payment institutions and EMIs?
Yes, the EBA developed the framework taking into account the relevant PSD2 and sectoral governance requirements, and payment and electronic-money firms form part of the population affected by the third-party framework.
Do the Guidelines apply to MiCA firms?
They have direct MiCA relevance particularly for issuers of asset-referenced tokens, with Article 34 MiCA among the legal bases expressly taken into account by the EBA.
Do all CASPs automatically fall under the Guidelines?
No.
CASPs should not be treated as directly subject to these Guidelines solely because they hold a MiCA CASP authorisation.
In its September 2026 MiCA review response, the EBA separately recommended that Article 73 MiCA be updated from an outsourcing concept toward third-party risk management and suggested a future mandate to align expectations for CASPs.
Is there a transition period?
Yes.
The EBA has announced a two-year transitional period to support implementation.
However, the application date has not yet been set, so firms should not assume that the transition automatically ends in September 2028.
Can firms use one register for DORA and non-ICT third parties?
The EBA’s development of the framework specifically sought consistency with the DORA register and contemplated the possibility of using a single register for ICT and non-ICT third-party information.
The register still needs to preserve the information required under each applicable legal framework.
What should firms prioritise first?
The most practical first steps are to map all third-party arrangements, separate ICT from non-ICT services, identify which providers support critical or important functions, compare the existing register with the new framework and prioritise high-risk contracts for remediation.
EBA Third-Party Risk: Official DORA and Regulatory Materials
The EBA’s 18 September 2026 announcement explains the final framework for non-ICT third-party services, its focus on critical or important functions, the full lifecycle approach and the two-year transitional period.
II. European Banking Authority — Guidelines on Third-Party Risk Management
The EBA’s official regulatory page provides the current status of the final Guidelines, including their pending translations, non-applicable status and the planned replacement of the 2019 outsourcing framework.
III. EUR-Lex — Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector
DORA establishes the EU framework for ICT risk and ICT third-party risk, including governance, responsibility for outsourced ICT services, criticality assessments and contractual requirements.
IV. European Banking Authority — Consultation on Third-Party Risk Management for Non-ICT Services
The EBA’s consultation materials explain the development of the framework, the intended alignment with DORA, the approach to third-party registers and the rationale for the two-year transition.
V. European Supervisory Authorities — Autumn 2026 Risk Update on External Dependencies
The ESAs identify external dependencies as a key vulnerability for the EU financial system and highlight continuing reliance on non-EU providers, infrastructure and payment systems.
VI. European Banking Authority — Risk Assessment Report June 2026
The report provides current supervisory context on operational resilience and third-party dependencies, including banks’ exposure to non-EU/EEA ICT providers and payment infrastructure.
VII. European Banking Authority — MiCA Review Priorities
The EBA’s September 2026 MiCA review work provides additional context for crypto firms, including the Authority’s recommendation to move CASP regulation from a narrow outsourcing concept toward broader third-party risk management in future MiCA reforms.
