10 Documentation requirements

As part of their risk management framework, financial entities should maintain an updated register of information on all third-party arrangements that are within the scope of these guidelines, at individual and, where applicable, at sub-consolidated, and consolidated levels, as set out in Section 2, and should appropriately document all current third-party arrangements, distinguishing between arrangements supporting critical or important functions and other third-party arrangements. Where direct TPSPs of financial entities provide non-ICT services and said TPSPs use ICT subcontractors effectively underpinning such non-ICT services supporting critical or important functions as defined under Regulation (EU) 2022/2554, those should be documented in the register in line with the present guidelines.

Financial entities should also maintain the documentation of ended third-party arrangements within the register and the supporting documentation for an appropriate period.

Taking into account the application of proportionality as referred to in Title I of the Guidelines, and under the conditions set out in paragraph 28(d), financial entities within a group, institutions permanently affiliated to a central body, or financial entities that are members of the same institutional protection scheme may keep the register centrally and collect the information at the highest level of consolidation.

Taking into account the application of proportionality under Title I of the Guidelines, the register should be consistent to the extent possible, with the register of information under Article 28(3) of DORA. Financial entities are encouraged to avoid any discrepancies between those two registers. Financial entities also have the possibility to combine both in one single register. The register for the non-ICT services should include at least the following information for all existing third-party arrangements:

• a. a reference number for each third-party arrangement and the type of contractual arrangement chosen ( ‘ Standalone arrangement ’ , ‘ Overarching arrangement ’ , or ‘ Subsequent or associated arrangement ’ ; for the latter option, the reference number of the overarching arrangement should be specified);
• b. the start date and, as applicable, the next contract renewal date, the end date including the reason of the termination or ending of the contractual arrangement;
• c. where applicable, the financial entities within the scope of the prudential consolidation or institutional protection scheme, that make use of the TPSPs, in accordance with paragraph 60;
• d. whether or not the TPSP or subcontractor is part of the group or a member of the institutional protection scheme (IPS) or is owned by financial entities within the group or is owned by members of an institutional protection scheme;
• e. a brief description of the functions provided by the TPSPs;
• f. whether or not (yes/no) the non-ICT service provided by a TPSP is supporting a critical or important function, including, where applicable, a brief summary of the reasons why the function is considered critical or important
• g. a category assigned by the financial entity that reflects the nature of the functions covered by the third-party arrangement as described within the financial entity ’s own internal categorisation. If an arrangement covers multiple functions, then the financial entity should report as many categories as the functions provided;
• h. the name of the TPSP, an identifier (LEI, EUID for legal persons or other alternative identifiers), the corporate registration number, the registered address and other relevant contact details, and the name of its ultimate parent company and an identifier (if any);
• i. the country or countries where critical or important function is to be performed;

For third-party arrangements supporting critical or important functions, the register should include at least the following additional information:

• a. the governing law of the third-party arrangement;
• b. the dates of the most recent audits;
• c. where applicable, the names of any subcontractors to which material parts of a critical or important function are subcontracted, including the country where the subcontractors are registered, an identifier (LEI, EUID, or legal persons or other alternative identifiers), the type of functions or material part subcontracted, the rank in the chain, the location from where the non-ICT related service is performed;
• d. the outcome and date of the last assessment performed of the TPSP ’s substitutability (as easy, medium, highly complex, or impossible to substitute);
• e. the summary and date of the last assessment performed of the possibility of reintegrating a critical or important function into the financial entity or the impact of discontinuing the critical or important function, together with the recovery time objective of the function and the recovery point objective of the function;
• f. the existence of an exit plan from the TPSP (‘Yes’ or ‘No’);
• g. the identification of alternative TPSPs, where possible, in line with paragraph 61 point (g);
• h. the estimated annual budget cost of the third-party arrangement for the past year, together with the currency.

Financial entities should, upon request, make available to the competent authority either the full register of all existing third-party arrangements (⁵⁴ ) or sections specified thereof. Financial entities should provide this information in a processable electronic form and may use the same format set out under the DORA ITS (e.g. a commonly used database format, comma separated values).

⁵⁴ Please also refer to the EBA Guidelines on supervisory review and evaluation process, available under: https://eba.europa.eu/regulation-and-policy/supervisory-review-and-evaluation-srep-and-pillar-2.

Financial entities should, upon request, make available to the competent authority all information necessary to enable the competent authority to execute the effective supervision of the financial entity, including, where required, a copy of any third-party arrangement. The information, where applicable, can be made available at consolidated or sub-consolidated level.

Financial entities, including payment institutions for the purpose of complying with Article 19(6) of Directive (EU) 2015/2366, should inform competent authorities in a timely manner and, where appropriate, engage in a supervisory dialogue with the competent authorities about any planned contractual arrangement on the provision of critical or important functions by TPSPs as well as when a function performed by a TPSP has become critical or important and provide at least the information specified in paragraphs 61 and 62.

Financial entities should inform competent authorities in a timely manner of material changes and/or severe events regarding their third-party arrangements supporting critical or important functions that could have a material impact on the continuing provision of the financial entities ’ business activities.

Financial entities should appropriately document the assessments made under Title IV and the results of their ongoing monitoring (e.g. level of performance of the TPSP, compliance with agreed service levels, other contractual and regulatory requirements, updates to the risk assessment).