Third-party Risk Management: EBA Finalises Guidelines For Non-ICT Services

Quick read

The European Banking Authority (EBA) has published a final report containing its guidelines on the sound management of third-party risk regarding non-information and communication technology (non-ICT) services (Guidelines).

The Guidelines will replace the current EBA outsourcing guidelines, dated February 2019 (Outsourcing Guidelines). The scope of the Guidelines is broader than that of the Outsourcing Guidelines.

Purpose and content of the Guidelines

The Guidelines track the full lifecycle of third-party arrangements. They detail the internal governance arrangements and risk management framework for financial institutions to implement in respect of their use of third-party service providers (TPSPs) to provide non-ICT services supporting functions. There is a particular focus on non-ICT services that support critical or important functions. More extensive provisions apply in relation to these third-party arrangements, on the basis they have the potential to materially