The EBA's updated guidelines significantly elevate the management body's TPRM responsibilities. Instead of delegating TPRM, the management body must now directly oversee a comprehensive strategy, regularly review third-party risks (especially for critical functions), ensure robust business continuity plans, and approve and review internal audit plans specifically addressing third-party arrangements. This signifies a move towards proactive, strategic TPRM, emphasising accountability and independent verification.

No regret actions:

• The management body must formally approve and regularly review internal audit plans to ensure comprehensive assessment of third-party arrangements. This includes scheduling regular audits of TPSP relationships and establishing a clear process for reviewing material changes to these relationships.
• The TPRM strategy and policy should explicitly outline the management body's responsibilities and include a supplementary Responsibility, Accountability, Consulted, Informed (RACI) matrix to clarify roles and responsibilities across the entire organisation.
• Given the expanded responsibilities, the management body may require training to ensure they possess the necessary expertise and understanding to effectively oversee TPRM.

Firms are obliged to replace their "Outsourcing Policy" with a comprehensive Third-Party Risk Management (TPRM) Strategy and Policy. Given the expanded scope of third-party relationships covered firms should ensure their existing outsourcing policy is updated or a new policy is developed which clearly differentiates between ICT and non-ICT services (highlighting the convergence with DORA where relevant) and between authorised and unauthorised TPSPs (as detailed in paragraph 50 of the Consultation Paper).

No regret actions:

• Firms must update their “Outsourcing Policy” to a TPRM Strategy and Policy which is formally defined, approved, and regularly reviewed by the management body.
• Firms should ensure the additional requirements for identifying, assessing, monitoring, and mitigating associated risks are included in the policy along with clearly defined roles, responsibilities, and reporting lines (as per the governance requirements).

The EBA has transposed from DORA the requirement to keep a register of information, now expanded to include non-ICT third-party arrangements with the same fields and structure as DORA, to enable a unified view of ICT and non-ICT third-party arrangements. This creates a unified register for both ICT and non-ICT TPSPs, enabling consistent monitoring of systemic risk, concentration risk, and critical dependencies, informing the annual designation of Critical Third-Party Providers. The register must include comprehensive information (detailed in Section 10 “Documentation Requirements” of the Consultation Paper) including any function to be subcontracted, updated at least every two years or upon renewal, and retain documentation for terminated arrangements for at least five years. There are additional fields required for non-ICT third-party arrangements e.g. the type of contractual arrangement chosen and the total annual expense or estimated cost of each direct TPSP. For CIF third-party arrangements, the register should also address incremental considerations such as the existence of an exit plan from the TPSP.

No regret actions:

• Identify and categorise all non-ICT third-party arrangements, paying particular attention to any non-outsourcing or intragroup arrangements that may not have been previously subject to TPRM oversight;
• Document all third-party arrangements, including those that are not critical or important in a register aligned to the DORA requirements, and begin to develop a framework to support both the ICT and non-ICT register, and identify how to obtain on a consistent basis the incremental data points required from non-ICT providers (e.g. TPSP responsibility for managing subcontractor risks, including location and parent company assessments).

The EBA consultation paper aligns its definition of Critical or Important Functions (CIFs) with DORA's definition. Significantly, it also expands the risk assessment requirements for CIFs to now include credit risk, market risk, ESG risk, and AML/CFT risk, in addition to the existing considerations of short- and long-term viability, operational resilience, legal and reputational standing, and recovery/resolution planning. This comprehensive assessment must consider both the importance of the function and the potential for disruption caused by TPSPs.

No regret actions:

• Review all existing third-party arrangements to ensure compliance with the upcoming guidelines. This requires reassessing existing arrangements to determine whether they meet the revised definition of a CIF and, if not, removing their CIF designation.
• Expand risk assessments of non-ICT arrangements supporting CIFs to explicitly include credit, market, ESG, and AML/CFT risks (where coverage does not currently exist).
• Review and update existing risk assessment frameworks to incorporate these risk considerations in a proportionate manner.
• Map subcontractor supply chains for all arrangements supporting CIFs.

Unlike the 2019 guidelines, the new proposals set out minimum contractual requirements for all in-scope third-party arrangements – not just those for CIFs. This includes nearly all contracts which do not relate to ICT (as those contracts are already subject to DORA), the only exceptions being a small list of contract types which are expressly excluded (such as very low risk service arrangements, contracts for utilities and arrangements for legally required services). As with DORA it is likely that many in-scope contracts will not be compliant with some of the mandatory requirements, such as the obligation to identify in the written agreement the physical location services will be provided from and where all data is processed.

Following the same approach as DORA, in addition to the generally applicable minimum contractual requirements the proposed guidelines also establish a more stringent set of requirements for CIF-supporting arrangements only. This includes mandatory exit strategies and adequate transition periods within contracts, requiring TPSPs to fully cooperate with wide rights of on-site inspections and audits and an obligation to include precise quantitative and qualitative service levels.

No regret actions

• Whilst it would be premature to begin repapering exercises before the requirements are finalised, entities in-scope should begin the planning process to ensure they can complete the key actions of identifying and updating relevant contract templates, guidance notes and checklists, ensuring the new terms are reflected in new contracts once the guidelines are in force and identifying and repapering all ongoing in-scope contracts within the anticipated two year transition period. Organisations should consider having the ability in their contract tooling to quickly identify contracts that may require uplift when the final guidance is issued.

Financial entities (FEs) must conduct thorough due diligence and risk assessments on all third-party arrangements (TPAs). The principle of proportionality in due diligence is re-emphasised. Financial entities must select and assess prospective TPSPs, ensuring the level of detail in the due diligence process is appropriate to the criticality or importance the function.  The 2019 guidelines are expanded to include the assessment of “other relevant risks” including credit risk, market risk, ESG risk and /AML/CFT risk (as detailed in paragraph 37 of the Consultation Paper).

There are also incremental requirements with regards to CIFs under paragraph 81 of the Consultation Paper emphasising how FEs should ensure that the TPSP has sufficient capacity, resources, expertise and a strong business reputation to deliver the service; appropriate internal controls and risk management procedures, including supply chain risk management; plans to mitigate geographic dependencies and business disruptions; comprehensive contingency and disaster recovery plans; necessary authorisations; and full auditability, including onsite, by the financial entity, third parties, and regulators. Subcontractor usage must also be carefully considered.

No regret actions:

• Determine whether any non-ICT arrangements would require remediation to align with the new requirements. Prioritise your assessment efforts on CIFs, focusing on those with the highest potential for disruption and the most significant impact on the firm's overall resilience and viability.
• Consider expanding the existing risk assessment framework to explicitly include credit risk, market risk, ESG risk, and AML/CFT risk for all TPAs (if not already assessed).
• Formalise and document selection and assessment criteria for TPSPs that explicitly address capacity, resources, expertise, reputation, internal controls, risk management (including supply chain risk management), contingency and disaster recovery planning, authorisations, and auditability.
• Ensure there is a clear audit trail / documentation of all due diligence activities, risk assessments, and mitigation strategies.

The proposed guidelines largely reinforce the oversight requirements from the 2019 framework, though the terminology has shifted from “oversight” to monitoring. The primary expectation remains that financial entities will monitor third parties on an ongoing, risk-based basis, with a particular focus on CIFs. The most significant change is to scope – the oversight principles now apply to the broader universe of third-party arrangements covered by the proposed new guidelines.

No regret actions

• Assess whether your current oversight processes and tools can be scaled to cover the wider scope of third-party arrangements, beyond outsourcings.
• Evaluate whether the KPIs you have in place are sufficiently versatile to measure the performance of a wider variety of service types.

The consultation proposals for exit strategies are substantively similar to the 2019 guidelines, with additions requiring financial entities to consider in their exit planning the concentration risk at entity level and the possibility of significant breaches by a TPSP of applicable laws, regulations or contractual terms. There is also an increased emphasis on ensuring exit plans are realistic, based on plausible scenarios and reasonable assumptions. The key change is again the broader scope of the guidelines, with the requirements applying to the widened scope of third-party arrangements.

No regret actions

• Identify whether the change in scope, from outsourcings to all third-party agreements, gives rise to any gaps in your organisation’s compliance with the requirement to have exit strategies in place covering CIFs performed by TPSPs.
• Begin to plan testing of the exit strategies against the new requirements, ensuring you have considered elements such as concentration risk.