01
What it is
EBA/GL/2026/09
Final guidelines on third-party risk for non-ICT services, published on 18 September 2026. They replace the 2019 outsourcing guidelines from a date of application that is not yet set.
EBA third-party risk guidelines: what changes for Germany
For EBA third-party risk guidelines, the European Banking Authority (EBA) published its final text, EBA/GL/2026/09, on 18 September 2026. It covers any service other than ICT (information and communication technology) services that supports a function on a recurrent or ongoing basis, not only outsourcing, and its date of application is not yet set.
Wider than outsourcing. The new term is the third-party arrangement: any arrangement, also with an intragroup provider, for the support of one or more functions on a recurrent or ongoing basis. Outsourcing becomes a subset. ICT services under the EU Digital Operational Resilience Act (DORA) stay with DORA.
- Legal position
- Final, 18 Sept 2026
- Applies to
- Banks, payment firms
- Reading time
- 15 minutes
- Last updated
- 30 October 2026
The essentials in four points
02
The scope
Third-party arrangements
Recurrent or ongoing support of a function, including by intragroup providers, is in scope. Outsourcing is a subset.
03
The focus
Critical or important functions
The guidelines concentrate on arrangements that support critical or important functions, defined as in Article 3 (22) DORA. The EBA says this reduces the burden for less material arrangements.
04
The clock
Two-year transition
A two-year transitional period applies. According to the final report, the review of critical or important arrangements is due within two years of the date of application.
Who does what: EU and German bodies
Guidelines are not statutes. They work through the supervisors that apply them. This overview helps if your head office is outside Germany and the German structures are new to you.
EBA
The European Banking Authority (EBA) issues the guidelines under Article 16 of Regulation (EU) No 1093/2010. Its press release names Article 74 of Directive 2013/36/EU as the legal basis and refers to the payment, investment firm and crypto-asset rules.
BaFin
BaFin (the German Federal Financial Supervisory Authority, Bundesanstalt für Finanzdienstleistungsaufsicht) decides whether and how the guidelines apply in Germany. As far as we could verify on 30 October 2026, it has not said whether it will implement them through the Minimum Requirements for Risk Management (MaRisk).
Bundesbank
The Deutsche Bundesbank, the German central bank, takes part in the day-to-day supervision of institutions and in the MaRisk.
DORA framework
The EU Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) governs ICT third-party risk. The EBA guidelines cover the rest.
Your institution
The institution classifies its arrangements, decides which support critical or important functions and stays responsible. This includes services from group companies outside Germany.
EBA third-party risk guidelines: what changes
The table compares the 2019 outsourcing guidelines with the final text. The highlighted row is the change that decides the scope of your inventory.
| Topic | 2019 outsourcing guidelines | 2026 third-party risk guidelines |
|---|---|---|
| Scope Key change | Outsourcing: a provider performs an activity that the entity would otherwise perform itself. | Third-party arrangement Any arrangement, also with an intragroup provider, that supports one or more functions on a recurrent or ongoing basis. Outsourcing is a subset. |
| ICT services | Covered as outsourcing. | Excluded. ICT services within DORA’s scope stay with DORA. |
| Critical or important functions | Defined in the outsourcing guidelines. | The definition is identical to Article 3 (22) DORA. |
| Contract content | Detailed clauses mainly for outsourcings of critical or important functions. | Minimum clauses for every in-scope arrangement, with more for critical or important functions. |
| Transition | Not applicable. In force since 2019. | Two years from the date of application for arrangements that support critical or important functions. Other arrangements follow at renewal. |
| Application date | In force. | Not yet set. The final text awaits translation into the official EU languages. |
Key point
Ask who supports a function on a recurrent basis, not who would do the work.
Under the 2019 guidelines, the question was whether the provider performs something the entity would otherwise perform itself. Under the final text, recurrent or ongoing support of a function is enough to be in scope.
The contract row follows law-firm analyses of the final report, which point to paragraphs 84 and 85. Check the paragraphs in the text before you rely on the row.
Deadlines and milestones
Chips in red mark steps that are still ahead.
- July to October 2025
Done. The EBA consults on the draft guidelines.
- 30 June 2026
Done. The ninth MaRisk amendment takes ICT services under DORA out of AT 9, the German outsourcing module.
- 18 September 2026
Done. The EBA publishes the final guidelines EBA/GL/2026/09. They are final but not yet applicable.
- Date not set
Open. The final text is translated, supervisors announce whether they comply and the date of application is set. As far as we could verify on 30 October 2026, none of this has happened yet.
- Two years after application
Open. The review and documentation of arrangements that support critical or important functions are due. If they are not finished, the entity informs its supervisor.
What the guidelines say
Legal nature. The EBA issues guidelines under Article 16 of Regulation (EU) No 1093/2010. They are addressed to supervisors and financial institutions, and supervisors say whether they comply. The legal basis named in the EBA press release is Article 74 of Directive 2013/36/EU, with the payment, investment firm and crypto-asset rules also taken into account. The guidelines therefore reach more than banks.
Scope. A third-party arrangement is an arrangement of any form between a financial entity and a third-party service provider, including an intragroup provider, for the support of one or more functions on a recurrent or ongoing basis (para. 17). Outsourcing remains a defined term and is a subset. Genuinely one-off engagements stay outside.
Focus. The enhanced duties concern arrangements that support critical or important functions. The definition is the one in Article 3 (22) DORA. The guidelines cover the whole lifecycle: risk assessment, due diligence, contracting, subcontracting, monitoring, documentation and exit.
Transition. The EBA provides a two-year transitional period. According to the final report, the review and documentation of arrangements that support critical or important functions are due within two years of the date of application, and the entity informs its supervisor if they are not finished. Other arrangements follow at renewal. The 2019 outsourcing guidelines are repealed from the date of application (para. 22). Until then, they remain in place.
Germany today. For non-ICT outsourcing, § 25b of the German Banking Act (Kreditwesengesetz, KWG) and AT 9 of the MaRisk apply. On our reading, services that AT 9 treats as other external procurement can fall into the scope of the new guidelines if they support a function on a recurrent or ongoing basis. As far as we could verify on 30 October 2026, BaFin has not said how it will implement the guidelines.
ICT services: the DORA line
The guidelines exclude ICT services within the scope of DORA. Those services remain with DORA’s ICT third-party risk rules. The EBA still encourages one holistic approach that covers both.
In practice, each arrangement is either an ICT service under DORA or a non-ICT arrangement under the guidelines. On our reading, a mixed arrangement needs a reasoned split, because each regime covers only its own part.
§ 28 (6) no. 1 of the German Act on the Federal Office for Information Security (BSI-Gesetz, BSIG) says that §§ 30, 31, 32, 35, 36, 38 and 39 BSIG do not apply to financial undertakings under Article 2 (2) DORA, nor to firms to which DORA applies under § 1a (2) and (2a) KWG. For your institution, the DORA path therefore replaces those BSIG duties. On our reading, a provider that is not itself a financial undertaking can fall under the BSIG as an important or essential entity. That is the provider’s own obligation. It does not change which regime your institution applies to its contract.
Duties by function
Different people carry different parts of the preparation. The split below follows the functions that usually exist in a German institution.
Management body
Approves the policy for non-ICT services that support critical or important functions and the plans for business continuity and internal audit.
Third-party risk management
Keeps the inventory and the register, coordinates the criticality assessments and follows the application date.
Business owners and procurement
Report every recurrent or ongoing service at intake, not only outsourcings, and give the facts for the assessment.
ICT risk function
Runs the DORA path for ICT services and agrees with third-party risk management who owns mixed arrangements.
Internal audit
Plans reviews of third-party arrangements and checks that criticality, contracts and exit plans match the register.
What stays with your firm
Stays with you
- The classification of each arrangement and the criticality assessment
- Approval of the policy by the management body
- The decision to enter into, renew or exit a third-party arrangement
- The content of the register and what you report to your supervisor
- Responsibility for the function, whoever performs the task
A provider can prepare and run
- An inventory of third-party arrangements, including recurrent services and group providers
- Drafts of criticality assessments for your sign-off
- A register in a format that fits the DORA register
- A gap analysis of contracts against the minimum clauses
- Exit-plan drafts and monitoring packs for audit
You hand over the task, not the control. Third-party risk is a governance and responsibility question of the supervised firm. A provider can prepare and run the work, but your firm decides and answers for the function.
Typical weak points
These six points recur where third-party risk is still managed as an outsourcing list. They do not replace a review of your own set-up.
Stopping at outsourcing
A service can be in scope even if the institution would not do the work itself, as long as it supports a function on a recurrent or ongoing basis.
EBA/GL/2026/09, para. 17
Waiting for the application date
The two-year clock for critical or important functions runs from a date that is not set. Inventory and criticality work can start now.
EBA/GL/2026/09, para. 22
One list for ICT and non-ICT
ICT services within DORA’s scope stay with DORA. A mixed arrangement needs a documented split.
DORA, EBA/GL/2026/09
Old contracts without the new clauses
Minimum clauses reach non-critical arrangements too. Review at renewal and earlier for critical or important functions.
EBA/GL/2026/09, paras 84 and 85
A register that does not fit DORA
The register for non-ICT arrangements is meant to be consistent with the DORA register. Critical arrangements need extra fields such as governing law and the exit plan.
DORA register
Leaving group providers out
Intragroup providers are part of the definition. Service centres in other countries belong in the inventory.
EBA/GL/2026/09, para. 17
Quick check: where does your institution stand?
Select a status for each of the six questions. Nothing is stored or sent. The check is a self-assessment and does not replace legal advice.
No-regret measures
These six steps hold whatever date the EBA and BaFin set. They build the inventory that every later duty needs.
01
Build one inventory
List every recurrent or ongoing third-party service, with owner, provider, ICT or non-ICT mark and a first criticality view.
02
Apply the DORA definition
Assess critical or important functions with the definition in Article 3 (22) DORA, so that one assessment serves both regimes.
03
Bring group providers in
Treat intragroup providers like external ones in inventory, assessment and contract review.
04
Run a contract gap analysis
Compare contracts for critical or important functions with the minimum clauses and plan the changes at renewal.
05
Align the register
Build the register so that it fits the DORA register and carries the extra fields for critical arrangements.
06
Plan the transition
Set owners and milestones that start the day the application date is announced.
Conclusion: inventory, assess, prepare
Three key messages remain.
Wider than outsourcing
Recurrent or ongoing support of a function is the new test, not the question who would otherwise do the work.
Two regimes, one inventory
ICT under DORA, non-ICT under the EBA guidelines. A single inventory serves both.
Start with critical functions
The two-year clock and the heaviest duties concern critical or important functions.
The EBA third-party risk guidelines reward early inventory work. If you list every recurrent service, separate ICT under DORA from non-ICT, assess criticality once and bring group providers in, you are ready when the date of application is set.
Where this sits in the S+P service model
Compliance as a Service
Outsourced officer functions, including Central Outsourcing Management and Internal Audit, bundled in the S+P Compliance Package.
1st Line Services
Operational work, such as DORA, outsourcing and third-party operations, carried out under your instructions.
RegTech
Tools such as the S+P Compliance Cockpit that support both.
Officer functions and operational services are delivered separately, in organisation and in staffing.
Frequently asked questions
The answers reflect the position on 30 October 2026 and do not replace legal advice in an individual case.
What are the EBA third-party risk guidelines?+−
They are the EBA’s Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09), published on 18 September 2026. They replace the EBA’s 2019 outsourcing guidelines from a date of application that is not yet set, and they cover the whole lifecycle of third-party arrangements: risk assessment, due diligence, contracting, subcontracting, monitoring, documentation and exit.
Do the EBA third-party risk guidelines apply yet?+−
No. They are final, but the EBA lists them as awaiting translation into the official EU languages, and the date of application is not set. Until then, the 2019 outsourcing guidelines remain in place. A two-year transitional period will support implementation.
How do they differ from outsourcing under MaRisk AT 9?+−
On our reading, the test is wider. AT 9 asks whether another company performs an activity that the institution would otherwise perform itself. The EBA guidelines ask whether a provider supports a function on a recurrent or ongoing basis. A service that AT 9 treats as other external procurement can therefore fall into the scope of the guidelines. As far as we could verify on 30 October 2026, BaFin has not said how it will bring the guidelines into the MaRisk.
Do the guidelines cover ICT services such as cloud hosting?+−
No. ICT services within the scope of DORA stay with DORA, which sets its own ICT third-party risk rules. The EBA still encourages one holistic approach across both. A mixed arrangement needs a documented split.
Do they matter for a German branch of a non-EU bank?+−
Possibly. Law-firm analyses report that the final text has more detailed and proportionate provisions for EU branches of third-country banks. We have not checked those paragraphs, so read them in the final report and ask your supervisor how it will apply them.
What does S+P Compliance take over, and what stays with us?+−
S+P Compliance prepares and runs the operational work: inventories, draft criticality assessments, register building, contract gap analyses and exit-plan drafts. Stays with you: the classification, the policy approval by the management body, the decision to enter into, renew or exit an arrangement and the responsibility for the function. You hand over the task, not the control.
Sources
Only official German and EU bodies are linked. The final report PDF is not linked here because it is cited through the EBA pages above.
EBA press release of 18 September 2026. Final guidelines on the management of third-party risk: focus on critical or important functions, lifecycle coverage, legal basis and the two-year transitional period. eba.europa.eu
EBA: Guidelines on third-party risk management. Status page of the guidelines. Final and awaiting translation into the official EU languages. eba.europa.eu
Circular 06/2026 (BA): MaRisk (German). The ninth MaRisk amendment of 30 June 2026 with the DORA line in AT 9. bafin.de
Digital operational resilience for the financial sector (German). EU summary of Regulation (EU) 2022/2554 (DORA). eur-lex.europa.eu
§ 25b Kreditwesengesetz (German). German statutory base for outsourcing today. gesetze-im-internet.de
§ 28 BSI-Gesetz (German). Exclusion of §§ 30, 31, 32, 35, 36, 38 and 39 BSIG for financial undertakings under DORA (§ 28 (6) no. 1). gesetze-im-internet.de
Legal position on 30 October 2026. The guidelines are final but not yet applicable. Check the EBA status page for the date of application before you rely on any date.
Related services and pages
Third-party risk touches several workstreams. These pages connect.
S+P Outsourcing Management
Support for the third-party inventory, the register and the review cycle under your procedures. Classification and criticality decisions stay with your firm and are not handed over.
Information register DORA and XBRL
Support for the DORA register of information, which the non-ICT register is meant to match. Your firm owns the content and the classification.
The overview for firms that move compliance work to Germany.
MaRisk Compliance Officer
Outsourced compliance function under the Minimum Requirements for Risk Management (MaRisk) for institutions in Germany. Decisions stay with your firm.
Internal audit outsourcing
Independent reviews of third-party arrangements. Findings and follow-up decisions stay with your firm.
S+P Compliance Package
Outsourced officer functions for institutions in Germany, bundled in one agreement.
Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.
