The European Banking Authority issued final guidelines on managing risks from third-party providers of non-information and communications technology services. The framework focuses on governance and risk management when regulated financial firms rely on external providers. It places particular emphasis on services supporting critical or important functions.
The guidelines are addressed to competent authorities and financial institutions across the European Union. Their scope includes banks and specified investment firms, payment institutions, electronic-money institutions, asset-referenced-token issuers and certain mortgage creditors. Services falling within Chapter V of the Digital Operational Resilience Act are excluded.
FRAMEWORK TARGETS NON-ICT DEPENDENCIES
ICT services within DORA’s scope remain governed by DORA’s ICT third-party risk framework, although firms are expected to take a holistic approach across ICT and non-ICT third-party risk. Firms must instead apply the EBA framework to relevant outsourced or externally provided non-ICT services within its scope.
The guidelines set expectations for internal governance, risk assessment and ongoing monitoring. Firms must maintain a register of all third-party arrangements, which may be combined with the register required under DORA.
TRANSITION TO THE NEW FRAMEWORK
The final report follows an earlier consultation and incorporates the EBA’s responses to industry feedback. The EBA said the guidelines deliver a more proportionate and consistent framework aligned with DORA by concentrating on higher-risk arrangements supporting critical or important functions.
The guidelines, which will replace the EBA’s 2019 guidelines on outsourcing arrangements, are awaiting translation into the EU’s official languages, and a two-year transitional period will apply. In-scope firms are expected to review and amend existing third-party arrangements, with those supporting critical or important functions to be reviewed within the transitional period.