EBA Releases New Third-Party Risk Guidelines
The European Banking Authority sets fresh standards for managing non-ICT service provider risks.
Updated on Oct. 28, 2026 in Financial Services
Live Poll
Do you believe stricter financial regulations on third-party service providers improve overall banking system stability?
On 18 September 2026, the European Banking Authority published final guidelines on third-party risk management for non-ICT services. These rules establish a unified governance framework for financial entities across the European Union.
Why it matters
The guidelines update existing protocols to address the evolving regulatory landscape and promote a more comprehensive approach to managing third-party risks. By standardizing these practices, the EBA aims to ensure business continuity and regulatory compliance for financial firms.
The new guidelines apply to a broad range of institutions including CRD firms, investment firms, and payment institutions. Financial entities are required to complete full reviews of all arrangements supporting critical functions within two years of the application date.
The players
European Banking Authority
This is an EU regulatory agency that works to ensure effective and consistent prudential regulation and supervision across the European banking sector.
The details
Financial entities must now maintain a rigorous risk management process, including due diligence and ongoing monitoring, for all third-party arrangements that are non-ICT and support critical functions. The guidelines also require firms to maintain an up-to-date Register of Information and notify competent authorities regarding planned arrangements that impact business continuity.
Timeline
The previous Outsourcing Guidelines were issued in 2019.
The European Banking Authority published the final non-ICT risk guidelines on 18 September 2026.
Firms must review arrangements supporting critical functions within two years of the application date.
Market Landscape
The introduction of these rules marks a shift in how the European financial sector approaches operational resilience by moving beyond solely focusing on technology. It replaces the 2019 Outsourcing Guidelines, signaling a broader regulatory consolidation that forces firms to standardize vendor oversight.
Financial institutions must now allocate resources to update their governance frameworks and registries for all non-ICT service arrangements. Customers should anticipate that these entities will implement more stringent oversight of their external partners to ensure long-term stability.
The takeaway
Financial firms should begin assessing their current third-party contracts to ensure compliance with the new governance requirements. Standardizing these processes early will help entities avoid potential regulatory hurdles before the two-year review window closes.
Further reading
Learn more about the latest regulatory shifts in the Financial Services section.
Source note: This article includes information reported by Legal 500.
Live Poll
Do you believe stricter financial regulations on third-party service providers improve overall banking system stability?
