EBA Outsourcing Guidelines

Title I covers proportionality and the application of the guidelines within groups and institutional protection schemes. Title II covers the assessment of outsourcing arrangements: whether an arrangement is outsourcing, and whether it concerns a critical or important function.

Title III (Sections 5 to 11) covers the governance framework, including sound governance and third party risk, the outsourcing policy, conflicts of interest, business continuity plans, the internal audit function and documentation requirements, including the outsourcing register.

Title IV covers the outsourcing process: pre-outsourcing analysis (supervisory conditions, risk assessment and due diligence), the contractual phase (sub-outsourcing, security of data and systems, access, information and audit rights, and termination rights), oversight of outsourced functions, and exit strategies. Title V is addressed to competent authorities.

For every arrangement the register records, among other items, a reference number, start and renewal dates, a description of the function and data involved, the category of the function, the provider’s name and registration details, the country where the service is performed and data stored, whether the function is critical or important, the date of the last criticality assessment, whether personal data is involved, the parent company, and cloud service and deployment models where relevant.

For critical or important functions, additional information includes the institutions and group entities using the service, whether the provider is part of the group, the date and main results of the most recent risk assessment, who approved the arrangement, the governing law, the dates of the last and next audits, sub-outsourcers, the substitutability of the provider, alternative providers, whether the function supports time-critical business operations, and the estimated annual budget cost.

From 17 January 2025, DORA sets specific requirements for ICT third party arrangements of financial entities, including the register of information and the contractual provisions in Article 30. For institutions in scope of both, ICT outsourcing arrangements must meet DORA, and the EBA Guidelines continue to apply to non-ICT outsourcing.

On 18 September 2026 the EBA published final Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09). Once they apply, they will repeal the 2019 outsourcing guidelines. ICT arrangements covered by DORA fall outside them, and the application date has not yet been set.