EBA Finalises Third-Party Risk Guidelines Alongside DORA

On 18 September 2026, the EBA published its final Guidelines on the management of third-party risk. The Guidelines are not a DORA technical standard: their legal basis is Article 74 of the Capital Requirements Directive (CRD, Directive 2013/36/EU), and they apply to credit institutions and investment firms. But the EBA frames them explicitly as "delivering a more proportionate and consistent framework aligned with DORA," and they close a gap DORA itself leaves open: DORA's third-party risk rules under Articles 28-30 cover only ICT arrangements, while the new Guidelines extend a comparable governance standard to non-ICT third-party arrangements as well.

What the Guidelines cover

The Guidelines set out the full lifecycle of managing a third-party arrangement, whether or not it involves ICT: pre-contract risk assessment and due diligence, contracting, ongoing monitoring, documentation, and exit planning. Arrangements supporting a critical or important function (CIF) draw a stricter tier of requirements, closely mirroring the structure DORA already applies to ICT contracts:

• quantitative and qualitative performance targets written into the contract,
• unrestricted audit and inspection rights for the institution (and its supervisor),
• a mandatory, documented exit strategy, and
• detailed conditions governing subcontracting, including visibility into subcontracting chains.

Institutions have a two-year transitional period to bring existing arrangements into line.

Why this matters even though it is not a DORA instrument

Banks and investment firms already build a register of information and manage concentration risk for their ICT providers under DORA. The EBA's Guidelines effectively ask the same institutions to apply the same discipline, contractual audit rights, exit planning, subcontracting visibility, to non-ICT critical or important functions too: things like non-ICT business process outsourcing, facilities supporting critical operations, or other services that do not fit DORA's ICT-provider definition but still carry real operational dependency.

For a compliance function that has spent two years building ICT third-party governance around DORA, the practical read is straightforward: the methodology does not change, the scope does. The same criticality assessment, contract-review checklist, and exit-planning discipline used for ICT providers now need to be run against the non-ICT vendor population as well, on a two-year clock.

What to do now

• Inventory non-ICT arrangements supporting critical or important functions. Most institutions have this list somewhere in procurement or vendor management, but it is rarely held to the same standard as the ICT register of information.
• Check existing non-ICT contracts for the CIF-tier terms. Audit rights, performance targets, and exit provisions are common gaps in contracts that were never drafted with a DORA-style review in mind.
• Extend the exit-strategy and subcontracting review already built for ICT vendors. Our Article 30 contractual provisions checklist and subcontracting RTS guide cover the ICT-side equivalent of what the EBA now expects for non-ICT arrangements.
• Track the two-year transitional deadline separately from DORA's own timelines, since it runs from the Guidelines' application date, not from any DORA compliance date already on the calendar.

Our TPP register generator builds a first-draft ICT third-party register in the EBA's own structure; the same discipline, provider, service, criticality, exit strategy, is the right starting template for a non-ICT critical-function inventory too.

Sources

• EBA, The EBA publishes its final Guidelines on the management of third-party risk, delivering a more proportionate and consistent framework aligned with DORA, 18 September 2026.
• Regulation (EU) 2022/2554 (DORA), Articles 28-30, third-party risk management, EUR-Lex.

Last updated: 19 September 2026.