Share on LinkedInShare on LinkedIn

ARTICLE · 15 JULY 2025

EBA Consultation Opens – Aligning Third-Party Risk Management With DORA

On 8 July 2025, the European Banking Authority ("EBA") began the process to repeal their existing Guidelines on outsourcing arrangements by publishing a consultation paper on ‘the sound management of third-party risk'.

IrelandFinance and Banking

On 8 July 2025, the European Banking Authority ("EBA") began the process to repeal their existing Guidelines on outsourcing arrangements by publishing a consultation paper on 'the sound management of third-party risk'. This consultation marks the beginning of the regulatory journey to align existing guidance on third-party risk frameworks and the governance of non-Information and Communication Technology ("ICT") related third-party service providers ("TPSPs"), with the recent requirements introduced by the Digital Operational resilience Act ("DORA") in relation to ICT risk management frameworks.

"In particular, the conditions for the management of third-party risk and the use of TPSPs for the provision of non-ICT related functions to financial entities are not harmonised to the same extent as for financial entities subject to DORA with regard to ICT services. A close alignment for the management of third-party risk between both frameworks should be made to

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

This article contains a general summary of developments and is not a complete or definitive statement of the law. Specific legal advice should be obtained where appropriate.

See more popular content from