EBA’s new non-ICT third-party risk Guidelines: implications for operating models and transactions

EU RegCORE Client Alert | EU Digital Single Market, financial services and crypto-assets

QuickTake

On 18 September 2026, the European Banking Authority (EBA) published its final Guidelines on the sound management of third-party risk related to non-ICT services (EBA/GL/2026/09) (the 2026 Guidelines). The 2026 Guidelines address services other than information and communication technology (ICT). Once applicable, they will replace the 2019 outsourcing Guidelines and extend the detailed framework to recurring or ongoing third-party support beyond arrangements meeting the outsourcing definition.EBA, Final report on Guidelines on the sound management of third-party risk related to non-ICT services, EBA/GL/2026/09, 18 September 2026 (2026 Guidelines), operative paras 5–7, 17–22 and 31–33, pp 16–17, 19–21 and 24–26; EBA, Guidelines on third party risk man-agement, product page, accessed 13 October 2026. The product page records the Guidelines as final and awaiting translation and the final report as not yet applicable.Show Footnote

Our central reading is that in-scope firms should consider classifying their service dependencies before commissioning contract remediation. The decisions affect which arrangements need enhanced controls, whether a group service model leaves local management with usable evidence, and whether an acquired business can separate from its seller on the agreed timetable. A programme based only on the existing outsourcing register may miss relevant arrangements; imposing the full package for critical or important functions on every supplier could sit uneasily with proportionality and the exclusions.

The EBA aligns the framework with the Digital Operational Resilience Act (DORA), but a completed DORA programme is unlikely to settle the non-ICT work on its own. Mixed services, group service centres and non-ICT providers using ICT subcontractors are likely to need a documented classification and a coherent view of the dependencies behind the direct contract.  2026 Guidelines, operative paras 5–7, 23–25, 31–33 and 38–49, pp 16–17, 22, 24–25 and 27–32. EBA, final-Guidelines press release on third-party risk, 18 September 2026, EBA press release; 2026 Guidelines, operative para 58, p 34.Show Footnote

As at 13 October 2026, the Guidelines are final and awaiting translation, and the final report is not yet applicable. The published text leaves application and repeal dates open. Paragraph 20 sets a point two years after the eventual application date at which unfinished review and documentation of arrangements supporting critical or important functions should be reported to the competent authority, together with planned completion measures or a possible exit strategy. Other arrangements may be reviewed and documented at renewal under paragraph 21, subject to paragraph 18’s application to arrangements entered into, reviewed or amended from the application date. In our view, publication therefore does not itself start the implementation clock.  2026 Guidelines, operative paras 18–22, p 21; EBA product page cited in footnote 1; EBA, final-Guidelines press release, 18 September 2026, EBA press release.Show Footnote

For boards and deal teams, the immediate priority is to identify decisions that could commit the firm to an unworkable service model: centralising a control function, renewing a material service, changing a provider or acquiring a business dependent on seller infrastructure. The analysis below links those decisions to service classification, contractual rights, retained capacity and a resourced continuity or separation plan.