+Guidelines on third party risk management (EBA/GL/2026/09)
---+1. Compliance and reporting obligations
------+Status of these Guidelines
---------+1. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010 …
---------+2. The Guidelines set out the EBA ’s view on appropriate supervisory practices within the European …
------+Reporting requirements
---------+3. In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must …
---------+4. Notifications will be published on the EBA website, in line with Article 16(3).
---+2. Subject matter, scope and definitions
------+Subject matter
---------+5. These Guidelines specify the internal governance arrangements, including sound risk management …
---------+6. The Guidelines specify how the arrangements referred to in the previous paragraph should be …
---------+7. The management of information and communication technology (ICT) risk and the use of TPSPs to …
------+Addressees
---------+8. These Guidelines are addressed to competent authorities as defined in points (i), (vi) and …
---------+9. These Guidelines are also addressed to financial institutions as defined in Article 4(1) of …
---------+10. For EU branches of third country credit institutions (third country branches) within the …
---------+11. Account information service providers that only provide the service in point 8 of Annex I of …
---------+12. For the purpose of these Guidelines, any reference to ‘ payment institutions ’ includes ‘ …
------+Scope of application
---------+13. Without prejudice to Directive 2014/65/EU ( ) and Commission Delegated Regulation (EU) 2017/565 …
---------+14. Without prejudice to Article 8(3) of Directive (EU) 2015/2366 and Article 5(7) of Directive …
---------+15. Issuers of ARTs which are not institutions subject to Directive 2013/36/EU should comply with …
------+Definitions
---------+16. Unless otherwise specified, terms used and defined in Directive 2013/36/EU, Regulation (EU) No …
---------+17. In addition, for the purposes of these Guidelines, the following definitions apply: means an …
---+3. Implementation
------+Date of application
---------+18. These Guidelines apply from [date] to all third-party arrangements entered into, reviewed or …
---------+19. Financial entities should review and amend accordingly existing third-party arrangements with a …
------+Transitional provisions
---------+20. Where the review and the documentation of third-party arrangements supporting critical or …
---------+21. Regarding third-party arrangements supporting non-critical or important functions, their review …
------+Repeal
---------+22. The EBA Guidelines on outsourcing of 25 February 2019 are repealed with effect from [date].
---+4. Guidelines on the sound management of third-party risks
------+Title I – Proportionality: group application and institutional protection schemes
---------+1 Proportionality
------------+23. Financial entities and competent authorities should, when complying or supervising compliance …
------------+24. When applying the provisions set out in these Guidelines, financial entities should take into …
------------+25. When applying the principle of proportionality, financial entities ( ) and competent …
---------+2 Management of third-party risks by financial entities within groups and institutions that are members of an institutional protection scheme
------------+26. In accordance with Article 109(2) of Directive 2013/36/EU, these Guidelines should also apply …
------------+27. Where applicable, financial entities, in accordance with paragraph 26, and institutions that …
------------+28. In addition to paragraph 27, financial entities within a group for which no waivers have been …
------------+29. Where waivers have been granted pursuant to Article 21 of Directive 2013/36/EU or Article …
------------+30. Financial entities that are subsidiaries of an EU parent undertaking or of a parent undertaking …
------+Title II – Assessment of third-party arrangements
---------+3 Sound management of third-party risk
------------+31. As part of the overall internal control framework including internal control mechanisms …
------------+32. Where an arrangement with a TPSP covers multiple functions, financial entities should consider …
------------+33. As a general principle, the following services are excluded from the scope of application of …
---------+4 Critical or important functions
------------+34. Financial entities should always consider a function as critical or important in the following …
------------+35. When relying on a TPSP for operational tasks of internal control functions, financial entities …
------------+36. When financial entities intend to use TPSPs for the provision of functions of banking …
------------+37. In the case of financial entities that are subject to Directive 2014/59/EU ( ), particular …
------+Title III – Governance framework
---------+5 Sound governance arrangements and third-party risk
------------+38. The management body of financial entities should define, approve and regularly review a …
------------+39. The overall internal control framework, including the risk management framework, should enable …
------------+40. Taking into account the application of the principle of proportionality as referred to in Title …
------------+41. The use of TPSPs for the provision of services to support functions cannot result in the …
------------+42. The management body is at all times fully responsible and accountable for at least: a. ensuring …
------------+43. The use of TPSPs should not lower the suitability requirements applied to the members of the …
------------+44. Financial entities should: a. clearly assign the responsibilities for the documentation …
------------+45. Financial entities should maintain at all times sufficient substance and not become ‘ empty …
------------+46. When using a TPSP, financial entities should at least ensure that: a. they can take and …
---------+6 Policy on the contractual arrangement regarding the use of non-ICT services supporting critical or important functions provided by TPSP
------------+47. The management body of a financial entity that has third-party arrangements in place or plans …
------------+48. The policy should include the main phases of the life cycle for the adoption and use of …
------------+49. The policy may be merged with the policy foreseen under Article 28(10) of DORA ( ). However, it …
------------+50. Financial entities should ensure that the policy covers the identification of potential impact …
---------+7 Conflicts of interests
------------+51. Financial entities ( ) should identify, assess, and manage conflicts of interests with regard …
------------+52. Where third-party arrangements create material conflicts of interest, including between …
------------+53. When services supporting critical or important functions are provided by a TPSP that is part of …
---------+8 Business continuity plans
------------+54. Financial entities ( ) should have in place, maintain, and periodically test appropriate …
------------+55. Business continuity plans should take into account the possible event of a failure or …
---------+9 Internal audit function
------------+56. The activities of the internal audit function ( ), where established, or the internal audit …
------------+57. Financial entities should establish a formal follow-up process regarding internal audit …
---------+10 Documentation requirements
------------+58. As part of their risk management framework, financial entities should maintain an updated …
------------+59. Financial entities should also maintain the documentation of ended third-party arrangements …
------------+60. Taking into account the application of proportionality as referred to in Title I of the …
------------+61. Taking into account the application of proportionality under Title I of the Guidelines, the …
------------+62. For third-party arrangements supporting critical or important functions, the register should …
------------+63. Financial entities should, upon request, make available to the competent authority either the …
------------+64. Financial entities should, upon request, make available to the competent authority all …
------------+65. Financial entities, including payment institutions for the purpose of complying with Article …
------------+66. Financial entities should inform competent authorities in a timely manner of material changes …
------------+67. Financial entities should appropriately document the assessments made under Title IV and the …
---------+Title IV – Third-party arrangement process
---------+11 Pre-contractual analysis
------------+68. Before entering into any third-party arrangement, financial entities should: a. assess whether …
---------+11.1 Supervisory conditions for contracting with third-party service providers
------------+69. Financial entities should ensure that the use of TPSPs to provide functions of banking …
------------+70. Without prejudice of the requirements established under Article 32 of the Commission Delegated …
---------+11.2 Risk assessment of third-party arrangements
------------+71. Financial entities should consider, on a risk-based approach, the potential impact of …
------------+72. Financial entities should consider: a. the potential impact of a third-party arrangement on …
------------+73. The risk assessment should include, where appropriate or relevant, scenarios of possible risk …
------------+74. Within the risk assessment, financial entities should also consider the expected benefits and …
------------+75. Where a third-party arrangement supporting critical or important functions includes the …
------------+76. When carrying out the risk assessment prior to the conclusion of the third-party arrangement …
---------+11.3 Due diligence
------------+77. Before entering into third-party arrangements and considering all the relevant risks related to …
------------+78. Factors to be considered when conducting due diligence on a potential TPSP include, but are not …
------------+79. With regard to critical and important functions ( ), financial entities should ensure that the …
------------+80. The planned usage of subcontractors to perform services supporting critical or important …
------------+81. Where the use of a TPSP involves the processing of personal or confidential data, financial …
------------+82. Financial entities should take appropriate steps to ensure that TPSPs act in a manner …
---------+12 Contractual phase
------------+83. The rights and obligations of the financial entity and the TPSP should be clearly allocated and …
------------+84. The contractual arrangement should include at least the following elements: a. a clear and …
------------+85. In addition to the elements referred to in paragraph 84, the third-party arrangement supporting …
------------+86. Without prejudice to the requirements set out under Regulation (EU) 2016/679, financial …
---------+12.1 Subcontracting of critical or important functions
------------+87. The third-party arrangements on the use of services supporting critical or important function …
------------+88. If the subcontracting of services supporting critical or important functions or material parts …
------------+89. If the use of subcontractors supporting critical or important functions or material parts …
------------+90. The written agreement between the financial entities and the TPSPs should specify that the TPSP …
------------+91. The written agreement should include a reasonable notice period by which the financial entity …
------------+92. The TPSP should only enter into new subcontracting arrangements or implement material changes …
------------+93. Where the financial entity is of the opinion that the new subcontracting arrangement or the …
------------+94. Financial entities should ensure that the TPSP appropriately identifies all subcontractors and …
------------+95. The financial entity should ensure in the written agreement with the TPSP that the agreement …
---------+12.2 Access, information and audit rights
------------+96. Financial entities should ensure through the written contractual arrangement that the internal …
------------+97. Regardless of the criticality or importance of the function performed by TPSPs, the written …
------------+98. With regard to contractual arrangements supporting critical or important functions, financial …
------------+99. For services not supporting critical or important functions provided by TPSPs, financial …
------------+100. Financial entities should ensure that the contractual arrangement does not impede or limit the …
------------+101. Financial entities should exercise their access and audit rights, determine the audit …
------------+102. Without prejudice to their final responsibility regarding third-party arrangements, financial …
------------+103. For services supporting critical or important functions provided by TPSPs financial entities …
------------+104. Financial entities should make use of the method referred to in paragraph 102(b) only if they …
------------+105. Before a planned onsite visit, financial entities, competent authorities, and auditors or …
------------+106. When performing audits in multi-client environments, care should be taken to ensure that risks …
------------+107. Where the third-party arrangement carries a high level of complexity, the financial entity …
---------+12.3 Termination rights
------------+108. The financial entity should be able to terminate the third-party arrangements, in accordance …
------------+109. The third-party arrangement should facilitate the transfer of the services supporting a …
---------+13 Monitoring
------------+110. Following a risk-based approach, financial entities should monitor the performance of the …
------------+111. Financial entities should monitor and manage their internal concentration risks caused by …
------------+112. Financial entities should ensure, on an ongoing basis, that third-party arrangements …
------------+113. Financial entities should take appropriate measures if they identify actual or potential …
---------+14 Exit strategies regarding third-party arrangement supporting critical or important functions
------------+114. Financial entities should have a documented exit strategy when services supporting critical or …
------------+115. Financial entities should ensure that they are able to exit third-party arrangements …
------------+116. When developing exit strategies for third-party arrangements supporting critical or important …
---------+Title V – Guidelines on third-party arrangements risks addressed to competent authorities
------------+117. When establishing appropriate methods to monitor financial entities ’ compliance with the …
------------+118. Competent authorities should be satisfied that they can effectively supervise financial …
------------+119. The analysis of financial entities’ third-party risk should be performed at least within the …
------------+120. Further to the information recorded within the register, as referred to in Section 10 …
------------+121. In addition to the information required under Section 10, competent authorities may require …
------------+122. Competent authorities should assess the following on a risk-based approach: a. whether …
------------+123. Competent authorities should ensure that EU/EEA financial entities are not operating as an …
------------+124. Within their assessment, competent authorities should take into account all risks, in …
------------+125. Where concentration risks are identified, competent authorities should monitor the development …
------------+126. Where concerns are identified that lead to the conclusion that a financial entity no longer …
------------+127. Competent authorities should be satisfied that they are able to perform effective supervision …
------------+128. Competent authorities should closely cooperate among themselves and should, in a timely …
 English - European Union - Financial Industry -

Guidelines on third party risk management (EBA/GL/2026/09)

Guidelines on third party risk management (EBA/GL/2026/09)

https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-third-party-risk-management – PDF

1. Overview

,
1. Compliance and reporting obligations

1. Compliance and reporting obligations
2. Subject matter, scope and definitions

2. Subject matter, scope and definitions
3. Implementation

3. Implementation
4. Guidelines on the sound management of third-party risks

4. Guidelines on the sound management of third-party risks

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements

3. Related Standards

Standards

Linked Issues

Issuelinks
is related to Imported: Guidelines on third party risk management (undated-a040e96bb3-cdbf)
is related to Assignments added: Guidelines on third party risk management (undated-a040e96bb3-cdbf) – 12 links
is related to Assignments added: Guidelines on third party risk management (undated-a040e96bb3-cdbf) – 7 links
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/