EBA Guidelines on Non-ICT Third-Party Risk Management

Guidelines on the sound management of third-party risk related to non-ICT services (EBA/GL/2026/09)

The Guidelines set out governance and risk-management requirements for financial entities relying on third-party service providers (TPSPs) for non-ICT services, complementing DORA's separate framework for ICT third-party risk. They apply to credit institutions, investment firms, payment and e-money institutions, issuers of asset-referenced tokens, and certain mortgage credit providers, issued under Article 16 of the EBA Regulation and mandates in the CRD, IFD, MiCAR and PSD2. Management bodies must approve written third-party risk policies, identify whether an arrangement involves a critical or important function, and assess concentration risk and provider substitutability. Entities must conduct due diligence on TPSP financial stability and compliance; contracts must include audit rights, termination clauses, subcontracting restrictions and service-level terms. Entities must maintain arrangement registers, notify authorities of planned critical-function arrangements, monitor TPSP performance, and develop exit strategies. Enhanced safeguards apply to third-country TPSPs; intragroup arrangements follow the same framework. Excluded are regulated financial services, market infrastructure services, and minor goods/utility purchases. Existing critical-function arrangements have a two-year review period.