What happened
The European Banking Authority published its final Guidelines on the sound management of third-party risk on 18 September, and compliance teams across EU banking and payments are working through the detail now. The text, EBA/GL/2026/09, replaces the EBA's 2019 outsourcing guidance and covers non-ICT services delivered by third-party service providers, with particular attention to arrangements that support critical or important functions.
The framing has changed. Outsourcing is now one subset of a wider category the EBA calls a third-party arrangement, which it describes as any arrangement of any form for the support of a function on a recurring or ongoing basis. The Guidelines run across the whole lifecycle: risk assessment and due diligence before contracting, the contract itself, subcontracting, ongoing monitoring, documentation, and documented exit strategies for critical arrangements. ICT services sit outside this text because they are governed by DORA, and the EBA expects institutions to manage both sides as one picture.
Two presumptions tighten the classification test that decides how much work each relationship demands. Tasks performed for internal control functions, including compliance, risk management and internal audit, are presumed critical or important unless the institution can show a failure would not harm their effectiveness, and that reasoning is expected to be documented. Arrangements that amount to regulated activity are treated as critical automatically. A two-year transitional period applies, and institutions that have not finished reviewing and documenting critical arrangements inside that window must notify their competent authority, with planned remediation or a possible exit.
Why this is a GRC story
Two parallel regimes were always going to leak. DORA harmonised technology vendor oversight, while everything else kept running on older, narrower outsourcing rules. The split created arbitrage at the edges. The EBA's answer is a framework built to mirror DORA's structure, including a register aligned with the DORA register, so one view of who supports what is at least possible.
The uncomfortable part is reclassification. Many institutions have relationships they have treated as low risk mainly because they are not technology contracts. The presumptions in the final text narrow the room to keep doing that, and any change in classification pulls a contract, a due diligence file and possibly an exit plan into scope. Proportionality still applies, so intensity of compliance tracks size, business model and complexity, but proportionality is an argument to be made in writing rather than assumed.
Evidence is the deliverable. Due diligence for critical arrangements now looks at the provider's business reputation, internal controls, geographic dependencies, continuity arrangements, regulatory authorisations and auditability. Every contract needs a baseline of protections recorded in writing, and critical ones need service level targets, audit and access rights, contingency testing and an exit that could actually be executed.
What to watch
Watch the confirmed application date and how supervisors treat the notification requirement. The two-year clock looks generous, but contract renegotiation for large or complex vendors rarely moves quickly.
A practical first step is to take the vendor inventory you already keep and test it against the new definition, then mark which relationships are critical or important under the tighter presumptions. If the answer is different from last year, that difference is the work.
Attribution: Analysis based on Compliance Week, the EBA's final report and related public reporting. This article is original commentary, not a repost of the source material.