Sign in

Low New document EU

EBA publishes final Guidelines on management of third-party risk aligned with DORA

Original title: EBA E-mail alert 18 September, 2026

Published
Source: eba.europa.eu
Effective
Not stated
Deadline
Not stated
Framework: DORA
Regulation (EU) 2022/2554 source
in 434 days
Commission review of DORA due, including the criteria for designating critical ICT third-party providers (Article 58(1)) source

Why it matters

The EBA has published its final Guidelines on the management of third-party risk, creating a more proportionate and consistent regulatory framework that aligns with DORA requirements. These guidelines provide EU financial institutions with clearer expectations for managing risks associated with third-party service providers and outsourced functions. Organizations subject to DORA and EBA supervision will need to assess their third-party risk management practices against these new guidelines.

What changed

  • EBA releases final Guidelines on third-party risk management that establish a proportionate and consistent framework for EU financial institutions.
  • The guidelines are aligned with DORA requirements, ensuring consistency between third-party risk management expectations and the Digital Operational Resilience Act's provisions.
  • The framework aims to provide clearer regulatory expectations for managing risks related to third-party service providers and outsourced functions across the EU financial sector.

Who is affected

EU financial institutions subject to DORA and EBA supervision, including banks and other regulated entities that rely on third-party service providers and outsourced functions.

What to do

Open the official document

AI-assisted summary of the official document; the official text prevails. Not legal advice.

More changes in DORA