New Non-ICT Third-Party Risk Guidelines Take Effect
Financial firms must formalize risk management processes for non-ICT providers that support critical business functions.
Updated on Oct. 28, 2026 in Financial Services
Live Poll
Do you believe stricter financial regulations on third-party service providers improve overall banking system stability?
On 18 September 2026, the European Banking Authority published final guidelines on third-party risk management for non-ICT services. These rules mandate that financial institutions establish structured oversight for non-digital service providers that support critical or important business functions.
Why it matters
These guidelines replace 2019 standards to provide a more holistic approach to managing risks outside of the traditional information technology scope. Financial firms must now integrate these specific non-ICT arrangements into their broader governance and risk monitoring frameworks to ensure regulatory compliance.
The new framework mandates a two-year review window for arrangements supporting critical functions, replacing the 2019 Outsourcing Guidelines. The rules apply to a broad scope of firms, including CRD institutions, payment providers, and MiCAR issuers.
The players
European Banking Authority
An EU regulatory agency that manages standard-setting and supervision across the European banking sector.
The details
Financial entities must assess whether their non-ICT service arrangements are recurrent and support critical functions, such as those impacting business continuity or regulatory compliance. Once identified, firms are required to implement a full lifecycle management process, including pre-contractual due diligence, continuous monitoring, and the maintenance of an up-to-date Register of Information for all such third-party providers.
Timeline
2019: Issuance of previous EBA Outsourcing Guidelines.
18 September 2026: EBA published final non-ICT third-party risk guidelines.
Within two years of application: Deadline for reviewing arrangements supporting critical functions.
Market Landscape
The new guidelines extend the regulatory oversight previously codified in the 2019 EBA Outsourcing Guidelines. This shift reflects a broader trend toward requiring financial institutions to treat all critical third-party dependencies as core operational risks.
Firms should immediately audit their non-ICT service contracts to identify those supporting critical or important business functions. Compliance teams must prepare for the mandatory creation of a comprehensive Register of Information before the two-year implementation window expires.
The takeaway
Operational resilience now requires formalizing oversight for vendors that fall outside of traditional ICT services. Compliance managers should begin mapping these non-digital critical functions against the new EBA governance requirements to align internal processes before the application date is set.
Further reading
For broader context on European regulatory changes, see the Financial Services section.
Source note: This article includes information reported by Legal 500.
Live Poll
Do you believe stricter financial regulations on third-party service providers improve overall banking system stability?
