The European Banking Authority has issued final guidelines on managing third-party risk, focusing on critical functions, with a two-year transition period for implementation.
The European Banking Authority (EBA) has published its final Guidelines on the management of third-party risk. These guidelines aim to create a more proportionate and consistent framework aligned with DORA.
The Guidelines focus on third-party arrangements supporting critical or important functions (CIFs), where disruption could materially impair a financial entity’s performance. They aim to reduce operational and supervisory burdens for less material arrangements while ensuring sound risk management.
The guidelines promote a holistic approach to third-party risk management across ICT and non-ICT services, covering the entire lifecycle including risk assessment, due diligence, contracting, monitoring, documentation, and exit strategies.
The Guidelines incorporate stakeholder feedback from public consultation and outreach, and consider international standards such as the Basel Committee Principles for the Sound Management of Third-Party Risk.
A two-year transitional period will support smooth and proportionate implementation.
The Guidelines are developed under the legal framework of Article 74 of Directive 2013/36/EU, along with relevant provisions from PSD2, IFD, MiFID II, MiCAR, and Regulation (EU) No 1093/2010.
