Title V – Guidelines on third-party arrangements risks addressed to competent authorities

When establishing appropriate methods to monitor financial entities ’ compliance with the conditions for initial authorisation, competent authorities should aim at identifying if third-party arrangements amount to a material change to the conditions and obligations of financial entities ’ initial authorisation.

Competent authorities should be satisfied that they can effectively supervise financial entities, including that financial entities have ensured within their third-party arrangements that TPSPs are obliged to grant audit and access rights to the competent authority and the entity, in line with Section 12.2.

The analysis of financial entities’ third-party risk should be performed at least within the SREP or, with regard to payment institutions, as part of other supervisory processes, including ad-hoc requests or onsite inspections.

Further to the information recorded within the register, as referred to in Section 10, competent authorities may ask financial entities for additional information, in particular for arrangements with TPSPs supporting critical or important functions, such as:

• a. the detailed risk analysis;
• b. information on whether the TPSP has a business continuity plan that is suitable for the services provided to the financial entity;
• c. the exit strategy for use if the third-party arrangement is terminated by either party or if there is a disruption to the provision of the services; and
• d. the resources and measures in place to adequately monitor the activities performed by TPSPs.

In addition to the information required under Section 10, competent authorities may require financial entities to provide detailed information on any third-party arrangement, even if the function concerned is not considered critical or important.

Competent authorities should assess the following on a risk-based approach:

• a. whether financial entities monitor and manage appropriately third-party arrangements, in particular those supporting critical or important functions;
• b. whether financial entities have sufficient resources in place to monitor and manage third-party arrangements supporting critical or important functions;
• c. whether financial entities identify and manage all relevant risks; and
• d. whether financial entities identify, assess, and appropriately manage conflicts of interest with regard to any third-party arrangement, e.g. in the case of intragroup agreements or arrangements within the same institutional protection scheme.

Competent authorities should ensure that EU/EEA financial entities are not operating as an ‘empty shell’, including situations where financial entities use back -to-back transactions or intragroup transactions to transfer part of the market risk and credit risk to a non-EU/EEA entity, and should ensure that they have appropriate governance and risk management arrangements in place to identify and manage their risks.

Within their assessment, competent authorities should take into account all risks, in particular (⁵⁹ ):

• a. operational risks posed by the third-party arrangement;
• b. reputational risks;
• c. the step-in risk that could require the institution to bail out a TPSP, in the case of significant institutions;
• d. concentration risks within the institution, including on a consolidated basis, caused by multiple third-party arrangements with a single TPSP or closely connected TPSPs or multiple third-party arrangements within the same business area;
• e. concentration risks at the sectoral level, e.g. where multiple financial entities make use of a single TPSP or a small group of TPSPs;
• f. the extent to which the financial entity controls the TPSP or has the ability to influence its actions, and the reduction of risks that may result from a higher level of control and if the service provider is included in the consolidated supervision of the group; and
• g. conflicts of interest between the financial entity and the TPSP.

⁵⁹ For institutions subject to Directive 2013/36/EU, see also the EBA Guidelines on SREP: https://eba.europa.eu/regulation-and-policy/supervisory-review-and-evaluation-srep-and-pillar-2.

Where concentration risks are identified, competent authorities should monitor the development of such risks and evaluate both their potential impact on other financial entities and the stability of the financial system. Moreover, competent authorities should inform, where appropriate, the resolution authority of new potentially critical functions (⁶⁰ ) that have been identified during this assessment.

⁶⁰ As defined under Article 2(1), point (35) of the BRRD.

Where concerns are identified that lead to the conclusion that a financial entity no longer has robust governance arrangements in place or does not comply with regulatory requirements, competent authorities should take appropriate actions, which may include limiting or restricting the scope of the non-ICT services supporting critical or important functions provided by TPSPs or requiring exit from one or more third-party arrangements. Considering the need of the financial entity to operate on a continuous basis, the termination or the temporary suspension of contracts could be required if the supervision and enforcement of regulatory requirements cannot be ensured by other measures.

Competent authorities should be satisfied that they are able to perform effective supervision, particularly when services supporting critical or important functions for financial entities are provided by TPSPs and undertaken outside the EU/EEA.

Competent authorities should closely cooperate among themselves and should, in a timely manner, mutually exchange all relevant information, especially regarding non-ICT services supporting critical or important functions provided by TPSPs, which are necessary for them to carry out their respective duties under this Title V, including in relation to concentration risk at sector level.