On 8 October 2026, the Central Bank of Ireland (the Central Bank) published Consultation Paper 173 (CP173), seeking stakeholders' views on the proposed Draft Guidance on Good Practices for the Sound Management of Third-Party Risks (the Draft Guidance), the regulatory impact assessment of introducing the Guidance and the Central Bank's response to specific concerns raised by industry in relation to the Central Bank’s Cross-Industry Guidance on Outsourcing from December 2021 (the 2021 Guidance). The 2021 Guidance will be withdrawn and replaced by the finalised Draft Guidance on the date the latter takes effect. On 18 September 2026, the European Banking Authority (EBA) also published its final Guidelines on the sound management of third-party risk regarding non-information and communication technology (ICT) services (EBA Guidelines), which will replace its 2019 guidelines on outsourcing arrangements.
The aim of the Draft Guidance is to reframe supervisory expectations and improve accessibility as part of the Central Bank's regulatory simplification agenda. The Draft Guidance moves the focus from 'outsourcing' to every material third-party dependency, restructures expectations around outcomes and the lifecycle of third-party arrangements and is expressly intended to inform the Central Bank’s supervisory engagement and inspections going forward.
Background and context
The Central Bank continues to regard outsourcing as a key sector risk, and its Regulatory & Supervisory Outlook Report 2026 the Central Bank identified operational risk and resilience as a persistent, red-rated risk. Through its active engagement with the topic of outsourcing and third-party risk management over the course of several years, the Central Bank has identified recurring weaknesses:
- underdeveloped governance and risk management frameworks for third-party arrangements;
- over-dependence on one or a small number of providers that cannot easily be substituted;
- insufficient consideration of intra-group dependencies, including limited visibility of group service resilience and of the firm’s ability to operate if group support becomes unavailable;
- visibility and supervisibility concerns arising from 'offshoring';
- inadequate contingency and exit planning for critical or important arrangements; and
- limited oversight of sub-outsourcing by key service providers.
The Central Bank cites the following six reasons as to why it believes the updated Draft Guidance is necessary:
- to address a broader scope beyond traditional outsourcing;
- to ensure consistency with international standards – there has been significant developments in international regulatory frameworks addressing third-party risk (including the entry into force of the Digital Operational Resilience Act (DORA));
- to provide greater clarity on key risk areas identified by the Central Bank through its supervisory engagement;
- more explicit integration with firms' operational resilience;
- to provide a more flexible, proportionate, outcomes-based approach; and
- furthering regulatory simplification.
Summary of substantive changes
The following is a non-exhaustive list of some of the key areas of reform and the proposed guidance identified in CP173:
Broader scope
Repositioning from outsourcing arrangements to apply to all material third-party arrangements (of which outsourcing are a sub-set), including intra-group arrangements for the provision of services or support on an ongoing or recurring basis.
Where reliance arises, the firm should ensure proper oversight and management of the arrangement, however it is described.
In respect of intra-entity arrangements, good practices may also be relevant for how branches manage the risks to service continuity and firms should consider putting formal arrangements in place so branches can meet their obligations and commitments.
Lifecycle
The Draft Guidance is organised to align with five lifecycle stages of third-party arrangements: Governance and Organisational Context; Pre-Engagement; Engagement; Ongoing Management; and Termination.
Departures from guidance
Firms are best placed to identify and assess their own risks and the Central Bank acknowledges a 'no one-size-fits-all' approach whereby firms are not required to adhere rigidly in all circumstances to the good practices (unless required to do so within their sectoral rules).
The Central Bank may nevertheless require firms to demonstrate appropriate consideration of the topics covered in reaching their decisions and will assess whether the outcomes achieved are sound and effective.
Proportionality is more explicit: smaller firms may adopt simpler arrangements where risk justifies it, but 'proportionality does not mean that third-party risks may be disregarded'. The good practices are aimed mainly at critical or important arrangements, but firms should identify, record and appropriately manage all third-party risks.
Delegation
Standalone section on Delegation is removed. Delegation and outsourcing 'however the arrangement might be described' are not considered to be different concepts and both should be considered within the broader third-party risk framework. The AIFMD and UCITS delegation regimes continue to apply in full.
Assessing the criticality or importance of activities to be outsourced
Deliberately less prescriptive: the Draft Guidance notes "(T)here is no science to the use of the terms ‘critical’ or ‘important’", and it is for each firm to identify the criteria it uses in the context of its business model".
Stress that an arrangement may become critical or important over time, so firms should monitor whether their reliance increases, as well as to determine whether it might be prudent to apply the measures to non-critical or less important arrangements in line with their own risk assessment.
Intra-group
Intra-group arrangements should be approached in the same manner as external ones, although the risk assessment will differ. New practices include:
- applying the same rigour to intra-group risk assessments and due diligence as for external providers where centrally provided governance or critical services are used;
- where a group relies on a central pre-contractual analysis, each firm should receive a summary and consider its own business model, regulatory requirements and risk profile; and
- where the firm relies on a group-level exit, recovery or resolution plan for a critical or important function, it should receive a summary of the plan and be satisfied that it could be effectively executed.
Registers and notifications
While the detailed list of notifiable events, content requirements and supervisory-response commentary in the 2021 Guidance do not carry over, certain firms remain legally required to notify the Central Bank of proposals to outsource critical or important functions.
Register expectations now sit within the ongoing management outcomes section. For critical or important arrangements, the Draft Guidance sets out additional data points, such as a substitutability grading, the date and summary of the last reintegration assessment, the estimated annual budget cost together with the function’s recovery time objective and recovery point objective.
Exits
Exit planning is strengthened and more explicitly tied to operational resilience. New or heightened practices include:
- a Business Impact Analysis of the risk of third-party services (including intra-group) becoming unavailable, identifying the human, technical, time and financial resources needed to implement an exit plan;
- documented impact tolerances and an escalation framework for breaches of those tolerances, up to and including invoking an exit strategy;
- a viable, documented and regularly tested exit strategy that takes account of criticality and substitutability; and
- where group-level exit plans are relied on, confirmation that they are viable and address risks for the firm itself.
Interaction with the EBA guidelines
As part of the EBA's wider simplification effort, the updates to the EBA Guidelines similarly shift non-ICT outsourcing to a broader, DORA-aligned regime applying to third-party arrangements generally, with outsourcing arrangements now treated as only one subset of those arrangements.
The EBA Guidelines apply to credit institutions, including third-country branches carrying out banking activities in the EU, investment firms (except for small and non-interconnected investment firms), payment institutions, electronic money institutions, issuers of asset-referenced tokens (ARTs) under MiCAR, creditors (which are financial institutions under the Mortgage Credit Directive), financial holding companies and mixed financial holding companies. Notably, the EBA Guidelines do not apply to fund management companies (FMCs) or to other entities authorised under Irish domestic legislation. However, respondents to the consultation on the EBA Guidelines raised concerns that FMCs that are subsidiaries of in-scope banking or investment-firm groups would fall indirectly within scope through group-wide requirements. Group policies applied to FMCs should be checked against Irish legal requirements and the Draft Guidance, consistent with the latter's expectation that group policies governing intra-group arrangements are fit for purpose at the level of the local firm.
The effective date of the EBA Guidelines is not yet confirmed.
Timing
The CP173 consultation closes on 3 December 2026, with the Central Bank expecting to publish the final guidance in Q1 2027, effective on publication, with no extended transition period currently proposed. While the Draft Guidance 'does not impose new or more stringent standards or practices' firms should assess their own third-party risk frameworks against the scope of the new guidance, especially in light of the existing sectoral regulations and guidance.
If you have any queries on the publication and/or the impact that it may have on you and your business, please speak to your usual contact or connect with any of the contacts listed below.
