Digital Operational Resilience Act (DORA) – The EBA publishes its final Guidelines on the management of third-party risk

The European Banking Authority (EBA) published its final Guidelines on the management of third-party risk, delivering a more proportionate and consistent framework aligned with DORA.

As part of the European Banking Authority’s (EBA) ongoing efforts to simplify its regulatory framework, the Guidelines focus on third-party arrangements supporting critical or important functions (CIFs) namely the disruption of which would materially impair the performance of a financial entity. „By concentrating on these higher-risk arrangements, the Guidelines reduce unnecessary operational and supervisory burdens for less material ones while maintaining sound risk management.” – according to the press release.

„The Guidelines promote a holistic approach to third-party risk management across ICT and non-ICT services and cover the full lifecycle of third-party arrangements, including risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies.” – EBA said.

They reflect stakeholders feedback received during the public consultation and through targeted outreach activities and take into account international standards, including the Basel Committee on Banking Supervision (BCBS) Principles for the Sound Management of Third-Party Risk.

A two-year transitional period will support a smooth and proportionate implementation.