EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02), Being Replaced by EBA/GL/2026/09

Why it Matters

Outsourcing lets financial institutions use specialist providers and cloud services, but supervisors expect that it never leaves an institution as an empty shell unable to control its critical functions. The EBA guidelines are the reference European supervisors use for that expectation, and their replacement by EBA/GL/2026/09 means institutions must plan for both the current requirements and the transition to the new third-party risk framework.

Key benefits include:

• One EU-wide framework

Harmonized requirements across credit institutions, investment firms, and payment and e-money institutions replaced fragmented national and sectoral expectations.

• Criticality drives proportionality

Arrangements supporting critical or important functions attract the full requirements, while less material arrangements receive lighter treatment.

• A register supervisors can rely on

The register of outsourcing arrangements gives institutions and competent authorities a single record of what is outsourced, to whom, and with what risk.

• Contracts that secure control

Required contractual terms cover access, information and audit rights, sub-outsourcing, data location, business continuity, and termination.

• Continuity with DORA

The 2026 guidelines align the non-ICT third-party framework with DORA's ICT provisions so institutions can run one third-party risk program.

How it Works

EBA/GL/2019/02 is organized around governance and the outsourcing life cycle. The governance provisions require sound arrangements, an outsourcing policy, management of conflicts of interest, business continuity plans, and an internal audit function that covers outsourcing, with proportionate application to groups and institutional protection schemes. The assessment provisions define outsourcing and critical or important functions and require the register and its documentation. The life cycle provisions cover pre-outsourcing analysis including supervisory conditions, risk assessment, and due diligence; the contractual phase including sub-outsourcing, access, information and audit rights, and termination rights; ongoing monitoring; and exit strategies for arrangements supporting critical or important functions. Competent authorities supervise these arrangements with particular attention to concentration risk.

The 2026 successor, EBA/GL/2026/09, keeps the same life cycle but narrows the scope to non-ICT services, since ICT services are within DORA's scope, and focuses its stricter provisions on third-party arrangements supporting critical or important functions. It requires a register for non-ICT arrangements that is consistent with the DORA register of information and may be combined with it, extends addressees to issuers of asset-referenced tokens and creditors under the Mortgage Credit Directive, and applies to arrangements entered into, reviewed, or amended on or after its application date, with existing critical or important arrangements to be reviewed and documented within two years of that date and non-critical arrangements at renewal. The 2019 guidelines are repealed with effect from the application date.

Within SmartSuite, institutions keep the outsourcing register and the DORA register of information as one connected data set: each arrangement carries its criticality assessment, risk assessment, due diligence evidence, contractual rights, sub-outsourcing chain, monitoring results, and exit strategy, so the transition from EBA/GL/2019/02 to EBA/GL/2026/09 is a change of requirement set rather than a new system.

Key Elements

• Outsourcing policy and governance

The management body approves an outsourcing policy and remains responsible for outsourced functions, with conflicts of interest, business continuity, and internal audit coverage addressed.

• Critical or important functions

Criteria determine which outsourced functions are critical or important, triggering the full requirements including exit strategies and supervisory notification.

• Register of outsourcing arrangements

Institutions maintain a register of all outsourcing arrangements with prescribed data, available to competent authorities.

• Pre-outsourcing analysis and due diligence

Before contracting, institutions assess supervisory conditions, risks, and the provider's suitability, including sub-outsourcing and data location.

• Contractual requirements

Written agreements secure service levels, access, information and audit rights, data protection, sub-outsourcing conditions, business continuity, and termination rights.

• Monitoring and concentration risk

Institutions monitor performance and risk on an ongoing basis, and competent authorities assess concentration at individual and system level.

• Exit strategies

Documented, tested exit plans exist for arrangements supporting critical or important functions.

Framework Scope

EBA/GL/2019/02 applies to credit institutions and investment firms subject to the Capital Requirements Directive and to payment institutions and electronic money institutions, on an individual, sub-consolidated, and consolidated basis, and is addressed to their competent authorities. EBA/GL/2026/09 is addressed to institutions under the CRR, third-country branches, investment firms other than small and non-interconnected firms, payment and e-money institutions, issuers of asset-referenced tokens under MiCAR, and creditors under the Mortgage Credit Directive, and covers non-ICT services provided by third-party service providers, with its stricter provisions applying to arrangements supporting critical or important functions. ICT services fall under DORA.

Framework Objectives

The guidelines exist so that reliance on third parties never weakens an institution's control over its critical functions or a supervisor's ability to oversee them.

Harmonize outsourcing and third-party risk management across EU financial institutions.

Keep the management body responsible for outsourced and third-party-supported functions.

Identify arrangements supporting critical or important functions and apply stricter requirements to them.

Secure access, information, audit, and termination rights through contracts.

Maintain a register that gives institutions and supervisors a complete view of arrangements and concentration risk.

Align non-ICT third-party risk management with the DORA framework for ICT services.

Framework in Context

The EBA outsourcing guidelines are part of the EBA's internal governance rulebook alongside EBA/GL/2019/04 on ICT and security risk management, and they draw on the Basel Committee's principles for the sound management of third-party risk and for operational resilience. Since January 2025 the EU Digital Operational Resilience Act has governed ICT third-party risk, which is why EBA/GL/2026/09 confines the EBA framework to non-ICT services. The guidelines are the EU counterpart of the U.S. Interagency Guidance on Third-Party Relationships and of the UK PRA's outsourcing expectations, and institutions commonly satisfy their due diligence and monitoring requirements with ISO/IEC 27001 certification, SOC 2 reports, and ISO/IEC 27036 supplier security practices.

Common Framework Mappings

The guidelines are commonly mapped to the EU rules and international principles they operate with and to the assurance and supplier security standards used to meet their due diligence requirements.

Mapped frameworks include:

EU DORA

EBA GL/2019/04

PSD2

BCBS Operational Resilience Principles

PRA SS1/21

Interagency TPRM Guidance (2023)

ISO/IEC 27036

ISO 27001:2022

SOC 2

NIST SP 800-161 Rev.1