# Third-Party Risk Register for Non-ICT Services: [Financial entity or group name]

> Register of all third-party arrangements for non-ICT services, and its
> design record, for credit institutions, investment firms, payment and
> e-money institutions and the other financial entities addressed by the
> EBA Guidelines on the sound management of third-party risk regarding
> non-ICT services (EBA/GL/2026/09, final report of 18 September 2026).
> It covers scope and classification, the critical or important function
> assessment, the register fields of paragraphs 61 and 62, the worked
> register extract, risk assessment and due diligence, contract and
> subcontracting checks, monitoring and concentration, exit strategies,
> notifications and the transition from the 2019 outsourcing guidelines.
> The Guidelines apply from a date the EBA sets after translation into
> all official EU languages; until then the EBA Guidelines on
> outsourcing arrangements (EBA/GL/2019/02) remain in place. ICT
> services stay under DORA. Replace every `[bracketed]` value and every
> row marked *Example*. This is a documentation format, not legal or
> regulatory advice; check the current official text and your competent
> authority's instructions.

<!--
Guidance: How to use this template
- The register itself usually lives in a system (GRC tool, procurement
  platform, database). This document defines what the register holds,
  who keeps it and how it is checked, and contains a worked extract so
  reviewers can see each field filled correctly.
- Build it next to the DORA register of information. Paragraph 61 of
  the Guidelines asks for consistency with the DORA register under
  Article 28(3) of Regulation (EU) 2022/2554 and allows one combined
  register. Reuse identifiers (arrangement references, LEI or EUID,
  function IDs) from the DORA Register of Information
  (`compliance/dora-ict-third-party-register`).
- Work in this order: classify each arrangement (section 2), assess
  criticality (section 3), record the fields (sections 4 and 5), then
  attach the lifecycle evidence (sections 6 to 10).
- Paragraph references (para.) point to the EBA final report
  EBA/GL/2026/09 as published on 18 September 2026. Paragraph numbers
  can shift in the translated versions; check them against the
  official text before you cite them externally.
- The worked example uses the fictional Fernhollow Bank, a mid-sized EU
  credit institution with a payment institution subsidiary, Fernhollow
  Payments. All providers, figures and dates are fictional.
- Related documents: Operational Risk RCSA (`finance/operational-risk-rcsa`),
  KRI Framework Specification (`finance/kri-framework-spec`), Business
  Continuity (`compliance/business-continuity`), Business Impact
  Analysis (`compliance/business-impact-analysis`), Supplier Security
  Assessment (`compliance/supplier-security-assessment`), Risk Register
  (`compliance/risk-register`), Service Level Agreement
  (`ops/service-level-agreement`), Recovery Plan (`finance/recovery-plan`).
-->

## Document control

<!-- Guidance: Identify the entity or group, the level at which the register is kept and the competent authority. Pitfall: a group register that does not show which entity uses each arrangement. -->

| Field | Value |
|---|---|
| Document ID | [TPR-NICT-001] |
| Entity maintaining the register | [Legal name], LEI [20-character LEI] |
| Register level | [Individual / Sub-consolidated / Consolidated / Central for an institutional protection scheme] |
| Entities covered | [List with LEI] *Example:* Fernhollow Bank, Fernhollow Payments |
| Type of entity | [Credit institution / Investment firm (Class 1 minus or Class 2) / Payment or e-money institution / ART issuer / MCD creditor / Financial holding company] |
| Competent authority | [Name] |
| Register system of record | [GRC tool, database] |
| Combined with the DORA register? | [Yes, one register / No, separate with reconciliation] |
| Applicable guidelines | [EBA/GL/2026/09 from its date of application; EBA/GL/2019/02 until then] |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@third-party-risk-lead] |
| Approvers/reviewers | [@cro], [@coo], [@procurement-head], [@compliance], [@internal-audit] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Third-party risk lead (preparer) | [@name] | [Submitted] | YYYY-MM-DD |
| Chief Risk Officer | [@name] | [Approved register design and criticality method] | YYYY-MM-DD |
| Chief Operating Officer | [@name] | [Approved] | YYYY-MM-DD |
| Management body or delegated committee | [@chair] | [Noted in the yearly third-party risk report] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | Gap analysis of the outsourcing register against paras 61 and 62 |
| 0.5 | YYYY-MM-DD | [@name] | *Example:* Non-outsourcing third-party arrangements added; exclusions recorded |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved; CIF arrangements scheduled for review within the transition period |

## Contents

<!-- Guidance: Keep this list aligned with the headings below. -->

1. [Scope and addressees](#1-scope-and-addressees)
2. [Classification of arrangements](#2-classification-of-arrangements)
3. [Critical or important function assessment](#3-critical-or-important-function-assessment)
4. [Register fields](#4-register-fields)
5. [Register extract](#5-register-extract)
6. [Risk assessment and due diligence](#6-risk-assessment-and-due-diligence)
7. [Contract, subcontracting, access and termination checks](#7-contract-subcontracting-access-and-termination-checks)
8. [Monitoring and concentration risk](#8-monitoring-and-concentration-risk)
9. [Exit strategies](#9-exit-strategies)
10. [Notifications and supervisory requests](#10-notifications-and-supervisory-requests)
11. [Governance and data quality](#11-governance-and-data-quality)
12. [Transition plan](#12-transition-plan)
13. [Jurisdiction notes](#13-jurisdiction-notes)
14. [Glossary and references](#14-glossary-and-references)
15. [Standard and licence note](#15-standard-and-licence-note)

## 1. Scope and addressees

<!-- Guidance: Confirm that the Guidelines apply to each entity and at which level. Questions: Which entity types are in the group? Is any investment firm small and non-interconnected (out of scope)? Is there a third-country branch that needs an internal service arrangement instead of a contract? Pitfall: applying the Guidelines only at group level when individual entities are also addressees. -->

The Guidelines address (paras 8 to 12): institutions under the CRR, third-country branches, MiFID investment firms other than small and non-interconnected firms, payment institutions and e-money institutions (account information service providers that provide only that service are excluded), issuers of asset-referenced tokens under MiCA, creditors under the Mortgage Credit Directive that are financial institutions, and approved financial holding and mixed financial holding companies. Paras 13 to 15 set the level of application: individual, sub-consolidated and consolidated for CRD institutions; consolidated for Class 2 investment firms under the IFD; individual for payment and e-money institutions; individual and, where applicable, group-wide for ART issuers.

| Entity | Type | Addressee? | Level of application | Notes |
|---|---|---|---|---|
| Fernhollow Bank *(Example)* | Credit institution | Yes | Individual and consolidated | Parent; keeps the central register (para 60) |
| Fernhollow Payments *(Example)* | Payment institution | Yes | Individual | Uses group-procured providers; its usage is shown per arrangement |
| Fernhollow Insurance Agency *(Example)* | Insurance intermediary | No | Not applicable | Covered by the group policy on a voluntary basis |

For EU branches of third-country credit institutions, para 10 accepts a service level arrangement or policy with the head undertaking in place of a contract, because the branch is not a separate legal entity.

## 2. Classification of arrangements

<!-- Guidance: Decide for each relationship whether it is in scope. Questions: Is the service non-ICT? Is it provided on a recurrent or ongoing basis to support a function? Does an exclusion in para 33 apply? If ICT and non-ICT elements are mixed, is the ICT element material enough to bring the arrangement under DORA? Pitfall: dropping relationships from the register because they are "not outsourcing"; the Guidelines cover all third-party arrangements, with outsourcing as a subset. -->

Para 17 defines a third-party arrangement as an arrangement of any form between a financial entity and a third-party service provider (TPSP), including intragroup providers, that supports one or more functions on a recurrent or ongoing basis; outsourcing arrangements are a subset. Para 31 asks three questions, and para 32 deals with mixed ICT and non-ICT services: the financial entity decides whether the ICT element is material and therefore brings the arrangement under DORA.

```mermaid
flowchart TD
    A["New or existing relationship with a provider"] --> B{"Excluded service under para 33?"}
    B -- "Yes" --> X["Record as excluded with the reason"]
    B -- "No" --> C{"ICT service material to the arrangement?"}
    C -- "Yes" --> D["DORA register of information"]
    C -- "No" --> E{"Supports a function on a recurrent or ongoing basis?"}
    E -- "No" --> F["Outside the register, normal procurement controls"]
    E -- "Yes" --> G["Third-party arrangement: record fields of para 61"]
    G --> H{"Critical or important function? Section 3"}
    H -- "Yes" --> I["Add fields of para 62 and full lifecycle controls"]
    H -- "No" --> J["Proportionate controls, review at renewal"]
```

Para 33 lists services excluded as a general principle, with the reminder that their risks still need managing. In summary:

| Exclusion | Examples given in the Guidelines (paraphrased) |
|---|---|
| Services legally required to be performed by a TPSP | Statutory audit |
| Regulated financial services that must by law be performed by another EU-regulated financial entity | Custody and safekeeping, trading venues |
| Market information services | Market data feeds |
| Financial transactions between financial institutions or with central banks | Interbank lending, central bank deposit and lending facilities |
| Payment network infrastructures | Card schemes and European payment initiatives |
| Clearing and settlement between clearing houses, central counterparties, settlement institutions and their members | |
| Global financial messaging infrastructures under oversight | |
| Correspondent banking services | |
| Services with no material impact on risk exposures or operational resilience, and purchases of goods and utilities | Legal opinions and court representation, cleaning, catering, travel, post room, office supplies, electricity |

| Relationship *(Example)* | Excluded? | ICT material? | Recurrent support of a function? | Result |
|---|---|---|---|---|
| Cash-in-transit and ATM cash replenishment | No | No | Yes | Third-party arrangement |
| Residential property valuations for mortgage lending | No | No | Yes | Third-party arrangement |
| Collection of retail loan arrears | No | No (uses the bank's own systems through a portal) | Yes | Third-party arrangement |
| Compliance monitoring fieldwork by a group service company | No | No | Yes | Third-party arrangement (intragroup) |
| Overflow customer contact centre staffed by a provider | No | Assessed under para 32: telephony platform provided by the bank, so ICT not material | Yes | Third-party arrangement |
| Statement printing and mailing | Yes, goods and services with no material impact | | | Excluded, recorded as EXC-001 |
| Hosted core banking platform | No | Yes | Yes | DORA register |

## 3. Critical or important function assessment

<!-- Guidance: Assess each function, not each contract. Questions: Would a disruption, defect or failure materially impair compliance with authorisation conditions or financial services law, financial performance, or the soundness or continuity of services? Does the arrangement cover operational tasks of an internal control function? Does it support a critical function or core business line under the BRRD? Pitfall: a different answer from the DORA criticality assessment for the same function. -->

Para 34 sets three tests, any one of which makes a function critical or important (CIF): disruption, discontinuity, defect or failure would materially impair (a) continuing compliance with authorisation conditions or other obligations under financial services law, (b) financial performance, or (c) the soundness or continuity of services and activities. The Guidelines state that this definition is consistent with DORA. Three further rules apply:

- Para 35: operational tasks of internal control functions are treated as critical or important unless the assessment shows that their failure would not harm the effectiveness of the internal control function.
- Para 36: using a provider for functions of banking activities, payment services or ART issuance to an extent that would require authorisation makes the function critical or important automatically.
- Para 37: for entities under the BRRD, functions needed for critical functions or core business lines are critical or important unless the assessment shows no material impact on their operational continuity.

| Function ID | Function | Test (a) | Test (b) | Test (c) | Para 35, 36 or 37 rule | CIF? | Same answer as DORA function list? |
|---|---|---|---|---|---|---|---|
| FUN-011 *(Example)* | Cash supply to branches and ATMs | No | No | Yes: cash withdrawals stop within two days | Para 37: supports the core business line retail deposits | Yes | Yes (FUN-011 in the DORA list) |
| FUN-024 *(Example)* | Collateral valuation for mortgage origination | Yes: CRR valuation requirements | No | Yes | No | Yes | Yes |
| FUN-031 *(Example)* | Arrears collection | No | Yes: recoveries | No | No | Yes | Yes |
| FUN-042 *(Example)* | Second-line compliance monitoring | Yes | No | No | Para 35: internal control task | Yes | Yes |
| FUN-055 *(Example)* | Overflow telephone customer service | No | No | No: core contact centre continues | No | No | Yes |

## 4. Register fields

<!-- Guidance: Turn paras 61 and 62 into a field dictionary with owners and validation rules, and map each field to the DORA register where an equivalent exists. Pitfall: free-text fields where the Guidelines expect a choice from a fixed list (contract type, substitutability, exit plan yes/no). -->

### 4.1 Fields for every arrangement (para 61)

| Field ID | Field (para 61 point) | Format and validation | DORA register equivalent (check) | Owner |
|---|---|---|---|---|
| NR-F01 | Reference number and contract type: standalone, overarching, or subsequent or associated, with the reference of the overarching arrangement for the last (a) | Unique ID; list of three values; parent reference mandatory for subsequent | B_02.01 | Procurement |
| NR-F02 | Start date, next renewal date, end date and reason for ending (b) | ISO dates; reason from a list | B_02.02 | Procurement |
| NR-F03 | Entities in the group or IPS that use the provider (c) | LEI list | B_04.01 | Third-party risk |
| NR-F04 | Whether the provider or subcontractor is part of the group or IPS, or owned by group or IPS entities (d) | Yes or no, with owner | B_05.01 | Third-party risk |
| NR-F05 | Brief description of the functions provided (e) | Text up to 300 characters | B_06.01 | Business owner |
| NR-F06 | Supports a critical or important function: yes or no, with a summary of reasons (f) | Yes or no; reason mandatory if yes | B_06.01 | Business owner, checked by risk |
| NR-F07 | Internal category of each function covered; one per function (g) | Code from the internal taxonomy | B_06.01 | Third-party risk |
| NR-F08 | Provider name, identifier (LEI, EUID or alternative), registration number, registered address, contact details, ultimate parent and its identifier (h) | LEI validated against the GLEIF format | B_05.01 | Procurement |
| NR-F09 | Country or countries where the function is performed (i) | ISO 3166 country codes | B_02.02 | Business owner |

### 4.2 Additional fields for arrangements supporting critical or important functions (para 62)

| Field ID | Field (para 62 point) | Format and validation | Owner |
|---|---|---|---|
| NR-F10 | Governing law of the arrangement (a) | Country code | Legal |
| NR-F11 | Dates of the most recent audits (b) | ISO dates | Third-party risk |
| NR-F12 | Subcontractors of material parts: name, country of registration, identifier, type of function or part, rank in the chain, location of performance (c) | One row per subcontractor; rank an integer from 1 | Third-party risk |
| NR-F13 | Outcome and date of the last substitutability assessment: easy, medium, highly complex or impossible to substitute (d) | List of four values; date | Third-party risk |
| NR-F14 | Summary and date of the last assessment of reintegration or of the impact of discontinuing the function, with recovery time objective (RTO) and recovery point objective (RPO) (e) | Text, date, RTO and RPO in hours | Business owner with business continuity |
| NR-F15 | Existence of an exit plan: yes or no (f) | Yes or no; link to the plan | Business owner |
| NR-F16 | Alternative providers identified, where possible (g) | Names or "none identified" | Procurement |
| NR-F17 | Estimated annual budget cost for the past year, with currency (h) | Amount and ISO 4217 code | Finance |

Paras 58 and 59 add two design rules: distinguish arrangements supporting critical or important functions from the rest, and keep ended arrangements and their documentation in the register for an appropriate period. Para 58 also asks that ICT subcontractors effectively underpinning a non-ICT service that supports a CIF be documented in this register.

## 5. Register extract

<!-- Guidance: Show a worked extract so reviewers can test the field rules. Use real field IDs and keep the example internally consistent. Pitfall: an extract that leaves CIF fields blank for a CIF arrangement. -->

### 5.1 All arrangements (para 61 fields)

| NR-F01 Reference and type | NR-F02 Dates | NR-F03 Users | NR-F04 Group? | NR-F05 Function | NR-F06 CIF | NR-F07 Category | NR-F08 Provider | NR-F09 Country |
|---|---|---|---|---|---|---|---|---|
| TPA-001, standalone *(Example)* | 2024-04-01, renewal 2027-03-31 | Fernhollow Bank | No | Cash-in-transit and ATM cash replenishment | Yes, para 37 core business line | CAT-OPS-CASH | Harrowdene Cash Logistics, LEI [LEI] | [Member State A] |
| TPA-002, overarching *(Example)* | 2025-01-01, renewal 2028-01-01 | Fernhollow Bank | No | Residential property valuation panel | Yes, test (a) | CAT-CRD-VAL | Tamsford Property Valuers, LEI [LEI] | [Member State A], [Member State B] |
| TPA-002-01, subsequent to TPA-002 *(Example)* | 2025-06-01, renewal 2028-01-01 | Fernhollow Bank | No | Desktop valuations for remortgages | Yes, test (a) | CAT-CRD-VAL | Tamsford Property Valuers | [Member State A] |
| TPA-003, standalone *(Example)* | 2023-09-01, renewal 2026-12-31 | Fernhollow Bank, Fernhollow Payments | No | Collection of retail arrears | Yes, test (b) | CAT-CRD-COL | Velloway Collections, LEI [LEI] | [Member State B] |
| TPA-004, standalone *(Example)* | 2022-01-01, open-ended | Fernhollow Bank, Fernhollow Payments | Yes, group service company | Compliance monitoring fieldwork | Yes, para 35 | CAT-CTL-CMP | Fernhollow Shared Services, LEI [LEI] | [Member State A] |
| TPA-005, standalone *(Example)* | 2025-03-01, renewal 2027-02-28 | Fernhollow Bank | No | Overflow telephone customer service | No | CAT-CUS-SRV | Sallowmere Contact Services, EUID [EUID] | [Member State C] |
| TPA-099, standalone, ended *(Example)* | 2019-05-01 to 2025-12-31, ended: exit to in-house team | Fernhollow Bank | No | Document archiving | No | CAT-OPS-ARC | [Former provider] | [Member State A] |

### 5.2 Arrangements supporting critical or important functions (para 62 fields)

| Reference | NR-F10 Law | NR-F11 Last audit | NR-F12 Material subcontractors (rank) | NR-F13 Substitutability | NR-F14 Reintegration and RTO/RPO | NR-F15 Exit plan | NR-F16 Alternatives | NR-F17 Annual cost |
|---|---|---|---|---|---|---|---|---|
| TPA-001 *(Example)* | [Member State A] | 2026-05-14 | Armoured vehicle maintenance firm (rank 1), [Member State A] | Medium | Reintegration not feasible within a year; RTO 48 h for ATM cash, RPO not applicable | Yes, EXP-001 | Two national cash logistics firms | EUR 2.4m |
| TPA-002 *(Example)* | [Member State A] | 2026-02-20 | None | Easy | Panel of other valuers can take over; RTO 120 h | Yes, EXP-002 | Three valuation firms on the reserve panel | EUR 1.1m |
| TPA-003 *(Example)* | [Member State B] | 2025-11-03 | Field agent network (rank 1), [Member State B] | Highly complex | In-house recoveries team could take 30% of volume within three months; RTO 240 h, RPO 24 h for case data | Yes, EXP-003 | One identified, not yet assessed | EUR 0.9m |
| TPA-004 *(Example)* | [Member State A] | 2026-06-30 | None | Medium | Reintegration into the bank's compliance function within six months; RTO 720 h | Yes, EXP-004 | External audit firms for interim cover | EUR 0.6m |

Totals check: annual cost of CIF arrangements 2.4 + 1.1 + 0.9 + 0.6 = EUR 5.0 million. Excluded services are kept in a separate list (EXC-001 statement printing and mailing) with the reason, so a reviewer can see that they were considered.

## 6. Risk assessment and due diligence

<!-- Guidance: Before any arrangement, run the pre-contractual analysis of para 68: criticality, supervisory conditions, risk assessment, due diligence and conflicts of interest. Questions: Does the provider need an authorisation to perform the service? Are geographic and supply chain dependencies assessed? Does the assessment include scenarios? Pitfall: due diligence copied from the previous renewal without new evidence. -->

| Step | Para | Questions to answer | Evidence |
|---|---|---|---|
| Criticality | 68(a), section 3 | Is the function critical or important? | Function assessment |
| Supervisory conditions | 68(b), 69 onwards | Does the activity require authorisation and does the provider hold it? Is a third-country provider subject to cooperation arrangements where required? | Licence check, legal memo |
| Risk assessment | 68(c), 71 to 76 | Impact on risk management and clients, size of the business affected, ability to scale, transfer or reintegrate, data protection, concentration at entity level, aggregated risks across functions, step-in risk for significant institutions, subcontracting chain risks, location and political stability | Risk assessment with scenarios (para 73) |
| Due diligence | 68(d), 77 to 82 | Business model, financial soundness, ownership, operational track record, supervision status; for CIFs also reputation, capacity, internal controls, geographic dependencies, continuity plans, authorisations and auditability | Due diligence file |
| Conflicts of interest | 68(e), section 7 | Do group links or other relationships create conflicts? Are intragroup terms at arm's length? | Conflicts assessment |

*Example:* For the renewal of TPA-003, the scenario analysis tested the provider's insolvency and a regulatory ban on its field agents. Both scenarios lead to a recovery backlog of about EUR 4 million in arrears cases within three months, within the operational risk appetite, provided the exit plan EXP-003 is triggered in the first month.

## 7. Contract, subcontracting, access and termination checks

<!-- Guidance: Check each contract against the minimum content for all arrangements and the extra content for CIF arrangements. Questions: Is subcontracting of CIFs allowed, and on what conditions? Do competent and resolution authorities have access and audit rights? Can the entity terminate and transfer the service? Pitfall: audit rights that only allow the entity, not the competent authority, to audit. -->

Section 12 of the Guidelines (paras 83 to 109) sets the minimum content of every contract (para 84), extra content for arrangements supporting CIFs (para 85), conditions for subcontracting CIFs (paras 87 to 95), access, information and audit rights including pooled audits and certifications (paras 96 to 107) and termination rights with a transfer of the service (paras 108 and 109). Para 97 asks credit institutions to refer to the powers of competent and resolution authorities in every contract, regardless of criticality; for non-CIF arrangements, access and audit rights are risk-based (para 99).

| Check ID | Clause area | Applies to | TPA-001 | TPA-002 | TPA-003 | TPA-004 | TPA-005 |
|---|---|---|---|---|---|---|---|
| CON-01 | Description of the function, service levels, start and end dates, notice periods | All | Yes | Yes | Yes | Yes (SLA with group company) | Yes |
| CON-02 | Governing law, location of performance and data, financial obligations | All | Yes | Yes | Yes | Yes | Yes |
| CON-03 | Reference to competent and resolution authority powers | All for CRD institutions | Yes | Yes | Gap, to fix at renewal 2026-12-31 | Yes | Yes |
| CON-04 | Subcontracting permitted or not, conditions, notice and right to object | CIF | Yes | Not applicable, no subcontracting allowed | Yes | Not applicable | Not required |
| CON-05 | Access, information and audit rights for the entity and the authorities, unrestricted | CIF | Yes | Yes | Yes | Yes | Risk-based, yes |
| CON-06 | Business continuity obligations and testing | CIF | Yes | Yes | Partial | Yes | Not required |
| CON-07 | Termination rights and support for transfer | CIF | Yes | Yes | Yes | Yes | Yes |

Record each gap as a remediation item with an owner and due date in the risk register, and link it to the transition plan in section 12.

## 8. Monitoring and concentration risk

<!-- Guidance: Monitor performance against service levels and update the risk assessment. Questions: Which reports does each provider deliver? Which indicators trigger escalation or exit? Where do several functions depend on one provider or one location? Pitfall: monitoring only the contract SLA and missing the provider's financial deterioration. -->

Para 110 asks for risk-based monitoring and periodic reporting to the management body on CIF arrangements; para 111 asks for internal concentration risk to be monitored, including through subcontractors; para 112 lists the tools (provider reports, KPIs, key control indicators, service delivery reports, self-certifications, independent reviews, business continuity test reports); para 113 requires corrective action or termination when shortcomings appear.

| Indicator ID | Arrangement | Indicator | Threshold *(Example)* | Last value *(Example)* | Status |
|---|---|---|---|---|---|
| TPI-001 | TPA-001 | ATM cash-out incidents per month | Amber at 5, red at 10 | 3 | Green |
| TPI-002 | TPA-002 | Valuations delivered within 5 business days | Amber below 95%, red below 90% | 96.5% | Green |
| TPI-003 | TPA-003 | Cure rate of arrears cases after 90 days | Amber below 40%, red below 30% | 37% | Amber |
| TPI-004 | All CIF | Provider credit rating or financial health score | Downgrade by two notches triggers review | No change | Green |

Concentration view: list providers that support more than one CIF, functions supported by a single provider with "highly complex" or "impossible" substitutability, and dependencies on one country.

| Concentration ID | Description *(Example)* | Assessment | Action |
|---|---|---|---|
| CNC-001 | TPA-003 is highly complex to substitute and its field agent subcontractor is in one country | Medium | Assess the alternative provider by YYYY-MM-DD |
| CNC-002 | Group service company TPA-004 also supports the internal audit function under another arrangement | Low, conflicts managed | Annual review of the conflicts assessment |

Feed the indicators into the KRI Framework Specification (`finance/kri-framework-spec`) so that third-party KRIs reach the risk committee with the rest of the operational risk profile.

## 9. Exit strategies

<!-- Guidance: Every CIF arrangement needs a documented exit strategy and a realistic, tested exit plan. Questions: What triggers an exit? Where would the function go? How long would the transition take, and how is data recovered? Pitfall: an exit plan that names an alternative provider nobody has contacted. -->

Para 114 requires a documented exit strategy for CIF arrangements covering at least termination, provider failure, concentration and difficult exit, deterioration of quality, material risks to continuous performance and significant breaches by the provider. Para 115 asks for realistic, documented and, where appropriate, tested exit plans and for alternative solutions and transition plans. Para 116 lists what to define: objectives, roles and resources, success criteria for the transfer of services and data, and indicators that trigger exit.

| Exit plan ID | Arrangement | Exit triggers | Target end state | Transition time | Last test | Success criteria |
|---|---|---|---|---|---|---|
| EXP-001 *(Example)* | TPA-001 | Provider insolvency, licence loss, two red months on TPI-001 | Second national provider under a standby agreement | 8 weeks | Tabletop, 2026-03-12 | ATM availability at least 95% during transition |
| EXP-002 *(Example)* | TPA-002 | Quality failures in sample reviews, conflicts of interest | Reserve panel valuers | 2 weeks | Desk review, 2026-01-20 | No backlog above 5 business days |
| EXP-003 *(Example)* | TPA-003 | Provider failure, conduct breach, red on TPI-003 for three months | Alternative provider plus in-house team for 30% of volume | 6 months | Not yet tested: test planned YYYY-MM-DD | Recovery rate within 5 points of plan, all case data transferred and reconciled |
| EXP-004 *(Example)* | TPA-004 | Group restructuring, sale of the service company | Reintegration into the bank's compliance function | 6 months | Desk review, 2026-07-01 | Monitoring plan delivered on schedule |

## 10. Notifications and supervisory requests

<!-- Guidance: Know what must go to the competent authority and when. Questions: Is a planned CIF arrangement notified in good time? Has a function become critical or important? Has a material change or severe event occurred? Can the full register be produced on request in a processable electronic form? Pitfall: assuming the non-ICT register is submitted yearly like the DORA register; it is provided on request. -->

| Event | Para | What to provide | Timing | Log ID |
|---|---|---|---|---|
| Planned CIF arrangement, or a function becoming critical or important | 65 | At least the information in paras 61 and 62, and supervisory dialogue where appropriate (payment institutions also under PSD2 Article 19(6)) | In a timely manner, before the arrangement starts | NOT-YYYY-NNN |
| Material change or severe event affecting a CIF arrangement | 66 | Description and impact on business continuity | In a timely manner | NOT-YYYY-NNN |
| Request for the register | 63 | Full register or specified sections in processable electronic form (the DORA ITS format may be used) | On request | REQ-YYYY-NNN |
| Request for supervisory information | 64 | Any information needed, including a copy of a contract | On request | REQ-YYYY-NNN |
| CIF review not finished within two years of the date of application | 20 | Fact of the delay, measures to complete the review or possible exit strategy | At the two-year point | NOT-YYYY-NNN |

Check national requirements as well: some competent authorities set advance notice periods for outsourcing in national rules that implement the guidelines.

## 11. Governance and data quality

<!-- Guidance: Show who owns the strategy, the policy and the register, and how data quality is checked. Questions: Has the management body approved the third-party risk strategy and policy? Is the policy reviewed at least yearly? Who signs off register changes? Pitfall: a register with no data owner per field. -->

Under paras 38 to 50, the management body defines, approves and regularly reviews a strategy on third-party risk and a policy on arrangements for non-ICT services supporting CIFs; both may be integrated with the DORA ICT third-party strategy and policy (para 49 allows the policy to be merged with the DORA Article 28(10) policy). Sections 7 to 9 add conflicts of interest, business continuity plans and internal audit coverage.

| Data quality control | Rule | Frequency | Owner | Last result *(Example)* |
|---|---|---|---|---|
| DQ-01 Completeness | Every arrangement has all para 61 fields; every CIF arrangement also has all para 62 fields | Monthly | [@third-party-risk-lead] | 2 CIF records missing RTO, fixed |
| DQ-02 Consistency with DORA | Same provider identifiers and function IDs as the DORA register; no function marked CIF in one and not in the other | Quarterly | [@third-party-risk-lead] | Passed |
| DQ-03 Identifier validity | LEI or EUID format valid and active | Monthly | [@procurement] | Passed |
| DQ-04 Ended arrangements | Ended records kept with end date and reason | Quarterly | [@procurement] | Passed |
| DQ-05 Reconciliation to accounts payable | Every provider paid above [EUR 50,000] a year is classified in the register or the exclusion list | Half-yearly | [@finance] | 3 suppliers added after review |

## 12. Transition plan

<!-- Guidance: Plan the move from the 2019 outsourcing guidelines. Questions: When will the Guidelines apply? Which CIF arrangements need review within two years? Which non-CIF arrangements can wait until renewal? Pitfall: waiting for the date of application before starting the review of CIF contracts. -->

Paras 18 to 22: the Guidelines apply from a date to be set to arrangements entered into, reviewed or amended on or after it; existing arrangements are to be reviewed and amended; for CIF arrangements, if the review and documentation are not finished within two years of the date of application, the entity informs its competent authority with the planned measures or a possible exit strategy; non-CIF arrangements may be reviewed at renewal; the 2019 Guidelines on outsourcing are repealed from the date of application.

| Workstream | Scope | Target date | Owner | Status *(Example)* |
|---|---|---|---|---|
| TR-01 Register gap closure | Add non-outsourcing arrangements and the new fields (contract type, RTO and RPO, exit plan, annual cost) | Before the date of application | [@third-party-risk-lead] | In progress |
| TR-02 CIF contract review | TPA-001 to TPA-004 against section 7 | Within two years of the date of application | [@legal] | TPA-003 scheduled at renewal 2026-12-31 |
| TR-03 Non-CIF arrangements | TPA-005 and others | At next renewal | [@procurement] | Planned |
| TR-04 Policy and strategy update | Combined ICT and non-ICT policy | Before the date of application | [@cro] | Draft |
| TR-05 Exit plan testing | EXP-003 not yet tested | YYYY-MM-DD | [@coo] | Planned |

## 13. Jurisdiction notes

<!-- Guidance: List the equivalent regimes for entities outside the EU. These are dated examples, not a complete survey. Pitfall: assuming EU compliance satisfies another regulator. -->

| Jurisdiction | Basis | Status as of 2026-10 (check the official source) |
|---|---|---|
| EU, non-ICT | EBA/GL/2026/09, Guidelines on the sound management of third-party risk regarding non-ICT services | Final report 2026-09-18; date of application to be set after translation; replaces EBA/GL/2019/02 |
| EU, ICT | Regulation (EU) 2022/2554 (DORA), Article 28 register of information | Applies since 2025-01-17 |
| UK | PRA Supervisory Statement SS2/21, Outsourcing and third party risk management | Current version effective 2024-12-31; an updated version published 2026-03-18 (with PS7/26) is effective from 2027-03-18 |
| US | Interagency Guidance on Third-Party Relationships: Risk Management (Federal Reserve, FDIC, OCC), 88 FR 37920 | Final guidance of 2023-06-06, published 2023-06-09 |

## 14. Glossary and references

<!-- Guidance: Define every abbreviation once and list sources with versions and dates. -->

| Term | Meaning |
|---|---|
| Third-party arrangement | Arrangement of any form with a provider, including intragroup, that supports one or more functions on a recurrent or ongoing basis (para 17) |
| Outsourcing arrangement | A third-party arrangement in which the provider performs a function the entity would otherwise perform itself |
| TPSP | Third-party service provider |
| CIF | Critical or important function |
| IPS | Institutional protection scheme |
| ART | Asset-referenced token under MiCA |
| RTO, RPO | Recovery time objective; recovery point objective |
| EUID | European Unique Identifier for companies registered in EU business registers |
| Substitutability | How easily a provider can be replaced: easy, medium, highly complex or impossible (para 62(d)) |

References (cited by number and title; obtain the official text):

- EBA, Guidelines on the sound management of third-party risk regarding non-ICT services, EBA/GL/2026/09, final report, 18 September 2026: https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-third-party-risk-management
- EBA press release, final Guidelines on the management of third-party risk, 18 September 2026: https://www.eba.europa.eu/publications-and-media/press-releases/eba-publishes-its-final-guidelines-management-third-party-risk-delivering-more-proportionate-and
- EBA, Guidelines on outsourcing arrangements, EBA/GL/2019/02, 25 February 2019 (to be repealed from the date of application of EBA/GL/2026/09).
- Regulation (EU) 2022/2554 (DORA), Articles 3(21) and 28; Commission Implementing Regulation (EU) 2024/2956 (register of information templates). EUR-Lex.
- Prudential Regulation Authority, SS2/21 Outsourcing and third party risk management: https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss
- Board of Governors of the Federal Reserve System, FDIC and OCC, Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920, 9 June 2023: https://www.govinfo.gov/content/pkg/FR-2023-06-09/html/2023-12340.htm

## 15. Standard and licence note

Based on the EBA Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09, final report of 18 September 2026), with Regulation (EU) 2022/2554 (DORA) for the boundary with ICT services. EBA material is reused with acknowledgement; paragraph numbers are cited and the register fields are paraphrased in original words, with no normative text reproduced. The structure, field IDs, checks, indicators and the Fernhollow Bank example are original; Fernhollow Bank, its providers and every figure are fictional. Check the current official text, the date of application set by the EBA and your competent authority's national requirements before use. This is a documentation format, not legal or regulatory advice.

Template licence: MIT.