Third-Party Risk Register Template (Non-ICT, EBA/GL/2026/09)

Third-Party Risk Register for Non-ICT Services: [Financial entity or group name]

Register of all third-party arrangements for non-ICT services, and its design record, for credit institutions, investment firms, payment and e-money institutions and the other financial entities addressed by the EBA Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09, final report of 18 September 2026). It covers scope and classification, the critical or important function assessment, the register fields of paragraphs 61 and 62, the worked register extract, risk assessment and due diligence, contract and subcontracting checks, monitoring and concentration, exit strategies, notifications and the transition from the 2019 outsourcing guidelines. The Guidelines apply from a date the EBA sets after translation into all official EU languages; until then the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) remain in place. ICT services stay under DORA. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal or regulatory advice; check the current official text and your competent authority's instructions.

Document control

Approvals

Revision history

Contents

1. Scope and addressees
2. Classification of arrangements
3. Critical or important function assessment
4. Register fields
5. Register extract
6. Risk assessment and due diligence
7. Contract, subcontracting, access and termination checks
8. Monitoring and concentration risk
9. Exit strategies
10. Notifications and supervisory requests
11. Governance and data quality
12. Transition plan
13. Jurisdiction notes
14. Glossary and references
15. Standard and licence note

1. Scope and addressees

The Guidelines address (paras 8 to 12): institutions under the CRR, third-country branches, MiFID investment firms other than small and non-interconnected firms, payment institutions and e-money institutions (account information service providers that provide only that service are excluded), issuers of asset-referenced tokens under MiCA, creditors under the Mortgage Credit Directive that are financial institutions, and approved financial holding and mixed financial holding companies. Paras 13 to 15 set the level of application: individual, sub-consolidated and consolidated for CRD institutions; consolidated for Class 2 investment firms under the IFD; individual for payment and e-money institutions; individual and, where applicable, group-wide for ART issuers.

For EU branches of third-country credit institutions, para 10 accepts a service level arrangement or policy with the head undertaking in place of a contract, because the branch is not a separate legal entity.

2. Classification of arrangements

Para 17 defines a third-party arrangement as an arrangement of any form between a financial entity and a third-party service provider (TPSP), including intragroup providers, that supports one or more functions on a recurrent or ongoing basis; outsourcing arrangements are a subset. Para 31 asks three questions, and para 32 deals with mixed ICT and non-ICT services: the financial entity decides whether the ICT element is material and therefore brings the arrangement under DORA.

Para 33 lists services excluded as a general principle, with the reminder that their risks still need managing. In summary:

3. Critical or important function assessment

Para 34 sets three tests, any one of which makes a function critical or important (CIF): disruption, discontinuity, defect or failure would materially impair (a) continuing compliance with authorisation conditions or other obligations under financial services law, (b) financial performance, or (c) the soundness or continuity of services and activities. The Guidelines state that this definition is consistent with DORA. Three further rules apply:

• Para 35: operational tasks of internal control functions are treated as critical or important unless the assessment shows that their failure would not harm the effectiveness of the internal control function.
• Para 36: using a provider for functions of banking activities, payment services or ART issuance to an extent that would require authorisation makes the function critical or important automatically.
• Para 37: for entities under the BRRD, functions needed for critical functions or core business lines are critical or important unless the assessment shows no material impact on their operational continuity.

4. Register fields

4.1 Fields for every arrangement (para 61)

4.2 Additional fields for arrangements supporting critical or important functions (para 62)

Paras 58 and 59 add two design rules: distinguish arrangements supporting critical or important functions from the rest, and keep ended arrangements and their documentation in the register for an appropriate period. Para 58 also asks that ICT subcontractors effectively underpinning a non-ICT service that supports a CIF be documented in this register.

5. Register extract

5.1 All arrangements (para 61 fields)

5.2 Arrangements supporting critical or important functions (para 62 fields)

Totals check: annual cost of CIF arrangements 2.4 + 1.1 + 0.9 + 0.6 = EUR 5.0 million. Excluded services are kept in a separate list (EXC-001 statement printing and mailing) with the reason, so a reviewer can see that they were considered.

6. Risk assessment and due diligence

Example: For the renewal of TPA-003, the scenario analysis tested the provider's insolvency and a regulatory ban on its field agents. Both scenarios lead to a recovery backlog of about EUR 4 million in arrears cases within three months, within the operational risk appetite, provided the exit plan EXP-003 is triggered in the first month.

7. Contract, subcontracting, access and termination checks

Section 12 of the Guidelines (paras 83 to 109) sets the minimum content of every contract (para 84), extra content for arrangements supporting CIFs (para 85), conditions for subcontracting CIFs (paras 87 to 95), access, information and audit rights including pooled audits and certifications (paras 96 to 107) and termination rights with a transfer of the service (paras 108 and 109). Para 97 asks credit institutions to refer to the powers of competent and resolution authorities in every contract, regardless of criticality; for non-CIF arrangements, access and audit rights are risk-based (para 99).

Record each gap as a remediation item with an owner and due date in the risk register, and link it to the transition plan in section 12.

8. Monitoring and concentration risk

Para 110 asks for risk-based monitoring and periodic reporting to the management body on CIF arrangements; para 111 asks for internal concentration risk to be monitored, including through subcontractors; para 112 lists the tools (provider reports, KPIs, key control indicators, service delivery reports, self-certifications, independent reviews, business continuity test reports); para 113 requires corrective action or termination when shortcomings appear.

Concentration view: list providers that support more than one CIF, functions supported by a single provider with "highly complex" or "impossible" substitutability, and dependencies on one country.

Feed the indicators into the KRI Framework Specification (finance/kri-framework-spec) so that third-party KRIs reach the risk committee with the rest of the operational risk profile.

9. Exit strategies

Para 114 requires a documented exit strategy for CIF arrangements covering at least termination, provider failure, concentration and difficult exit, deterioration of quality, material risks to continuous performance and significant breaches by the provider. Para 115 asks for realistic, documented and, where appropriate, tested exit plans and for alternative solutions and transition plans. Para 116 lists what to define: objectives, roles and resources, success criteria for the transfer of services and data, and indicators that trigger exit.

10. Notifications and supervisory requests

Check national requirements as well: some competent authorities set advance notice periods for outsourcing in national rules that implement the guidelines.

11. Governance and data quality

Under paras 38 to 50, the management body defines, approves and regularly reviews a strategy on third-party risk and a policy on arrangements for non-ICT services supporting CIFs; both may be integrated with the DORA ICT third-party strategy and policy (para 49 allows the policy to be merged with the DORA Article 28(10) policy). Sections 7 to 9 add conflicts of interest, business continuity plans and internal audit coverage.

12. Transition plan

Paras 18 to 22: the Guidelines apply from a date to be set to arrangements entered into, reviewed or amended on or after it; existing arrangements are to be reviewed and amended; for CIF arrangements, if the review and documentation are not finished within two years of the date of application, the entity informs its competent authority with the planned measures or a possible exit strategy; non-CIF arrangements may be reviewed at renewal; the 2019 Guidelines on outsourcing are repealed from the date of application.

13. Jurisdiction notes

14. Glossary and references

References (cited by number and title; obtain the official text):

• EBA, Guidelines on the sound management of third-party risk regarding non-ICT services, EBA/GL/2026/09, final report, 18 September 2026: https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-third-party-risk-management
• EBA press release, final Guidelines on the management of third-party risk, 18 September 2026: https://www.eba.europa.eu/publications-and-media/press-releases/eba-publishes-its-final-guidelines-management-third-party-risk-delivering-more-proportionate-and
• EBA, Guidelines on outsourcing arrangements, EBA/GL/2019/02, 25 February 2019 (to be repealed from the date of application of EBA/GL/2026/09).
• Regulation (EU) 2022/2554 (DORA), Articles 3(21) and 28; Commission Implementing Regulation (EU) 2024/2956 (register of information templates). EUR-Lex.
• Prudential Regulation Authority, SS2/21 Outsourcing and third party risk management: https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss
• Board of Governors of the Federal Reserve System, FDIC and OCC, Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920, 9 June 2023: https://www.govinfo.gov/content/pkg/FR-2023-06-09/html/2023-12340.htm

15. Standard and licence note

Based on the EBA Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09, final report of 18 September 2026), with Regulation (EU) 2022/2554 (DORA) for the boundary with ICT services. EBA material is reused with acknowledgement; paragraph numbers are cited and the register fields are paraphrased in original words, with no normative text reproduced. The structure, field IDs, checks, indicators and the Fernhollow Bank example are original; Fernhollow Bank, its providers and every figure are fictional. Check the current official text, the date of application set by the EBA and your competent authority's national requirements before use. This is a documentation format, not legal or regulatory advice.

Template licence: MIT.