The EBA Just Finalized Its Third-Party Risk Guidelines for Non-ICT Services. If You Thought DORA Covered Your EU TPRM Program, Here's What You Missed.

TL;DR

• EBA/GL/2026/09, finalized September 18, 2026, establishes a risk-proportionate TPRM framework specifically for non-ICT third-party arrangements — the category DORA deliberately excludes
• The guidelines replace EBA/GL/2019/02 (outsourcing) and expand scope beyond outsourcing to “third-party arrangements” broadly, capturing vendor relationships that never triggered the old outsourcing definition
• Two-year transition period ends September 2028; enhanced requirements apply to arrangements supporting critical or important functions
• EU financial institutions that built their TPRM programs around DORA now have a parallel framework to implement for every non-technology vendor relationship they have

When DORA took effect in January 2025, compliance teams at EU banks and investment firms ran a familiar drill: inventory your ICT service providers, classify them, map your critical functions to their dependencies, and make sure your contracts and monitoring programs matched the new requirements. Most institutions — especially those with robust TPRM frameworks — had been preparing for years.

What DORA left open was intentional. By design, DORA covers ICT third-party risk. It explicitly excludes non-ICT services. The drafters wanted a focused, technology-specific framework rather than a sprawling catch-all. The explicit exclusion was clear: “third-party services that do not involve ICT services” are outside DORA’s scope.

The question that left was what, exactly, regulated that side of the ledger.

The EBA answered it on September 18, 2026. EBA/GL/2026/09 — the finalized Guidelines on Third-Party Risk Management for Non-ICT Arrangements — establishes the binding framework for everything DORA doesn’t cover. Facilities management. HR services. Legal and compliance outsourcing. Accounting. Physical security. Travel management. The full catalog of non-technology vendor relationships that EU financial institutions rely on to operate.

If you built your TPRM program around DORA and assumed that covered it, read on.

What EBA/GL/2026/09 Actually Covers

The starting point is scope — and the scope is broader than most compliance teams will expect.

The prior EBA framework for third-party relationships was EBA/GL/2019/02, the outsourcing guidelines. Those guidelines applied when a financial institution transferred a task, function, or activity to a third party that the institution would otherwise perform itself. If a bank had never performed a function internally, the outsourcing definition technically didn’t bite. Vendors providing services that financial institutions never did themselves — specialized facilities providers, external legal counsel, environmental compliance consultants — could be categorized as procurement rather than regulated outsourcing.

EBA/GL/2026/09 closes that gap. The guidelines use the concept of “third-party arrangements” — defined broadly to include any contractual arrangement with a third party under which the third party provides a service that is not an ICT service as defined by DORA. You don’t have to have previously performed the activity in-house. The relationship doesn’t have to look like outsourcing in the traditional sense. If you’re paying a third party to provide non-ICT services and those services support your operations, the arrangement is in scope.

The practical categories this captures include:

• Facilities management: building maintenance, HVAC, utilities management, workspace management
• Physical security: security personnel, access control systems (non-ICT components), alarm monitoring (non-ICT)
• HR services: payroll processing (non-ICT), recruitment services, employee training delivery
• Legal services: external legal counsel, regulatory affairs advisors
• Accounting and auditing: external accountants, audit firms (beyond statutory audit where separately regulated)
• Travel management: corporate travel, relocation services
• Print and document management: secure document handling, archiving services
• Environmental and facilities compliance: building safety, environmental reporting

This is not an exhaustive list. The guidelines cover any non-ICT third-party arrangement. Institutions that have a complete DORA inventory but have never systematically catalogued their non-ICT vendor relationships now need to build that catalog.

The Tiered Framework: Critical vs. Non-Critical Functions

Not all non-ICT vendor relationships get the same treatment. EBA/GL/2026/09 establishes a tiered approach based on whether an arrangement supports what the guidelines call a “critical or important function” (CIF).

The CIF classification framework will be familiar to compliance teams that have worked through DORA implementation. A function is critical or important if its disruption, failure, or substandard performance would materially impair the institution’s:

• Financial soundness
• Continuity of regulated activities
• Compliance with applicable regulatory requirements
• Ability to manage and report risk

The classification question matters because the guidelines create two different tiers of requirements.

For arrangements supporting CIFs, institutions must:

• Conduct enhanced due diligence before entering the arrangement
• Ensure contracts contain specific terms (detailed below)
• Maintain ongoing monitoring programs with defined frequency and metrics
• Document and maintain exit strategies
• Assess concentration risk where multiple CIFs depend on related providers

For arrangements not supporting CIFs, institutions apply a lighter-touch framework: proportionate due diligence, basic contractual protections, and risk-based monitoring. The specific requirements scale with the risk profile of each arrangement.

The triage exercise — mapping non-ICT arrangements to CIF status — is itself a significant undertaking. A facilities management provider that maintains the data center’s HVAC system may well support a critical function even though the service itself is not ICT. Physical security arrangements protecting headquarters operations may be critical. The classification requires substantive judgment, not just a checkbox.

What DORA Doesn’t Cover (And EBA/GL/2026/09 Does)

A common misconception about DORA is that it covers everything a cloud provider or software vendor does. It doesn’t. DORA’s scope is ICT services — services involving the development, deployment, operation, or management of information and communication technology.

DORA Article 3 defines ICT services as “digital and data services provided through ICT systems to one or more internal or external users on a continuous basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider.”

Services that don’t fit that definition are outside DORA. Concretely:

The overlap zone — services with both ICT and non-ICT components — requires institutions to parse the arrangement carefully. A payroll provider that uses software to process payroll has an ICT component (covered by DORA) and a service delivery component (covered by EBA/GL/2026/09). Compliance teams need to map which elements of each arrangement fall under which framework.

Contract Requirements for CIF-Supporting Arrangements

For arrangements that support critical or important functions, EBA/GL/2026/09 specifies required contract provisions. The list parallels DORA’s ICT contract requirements but addresses the specific features of non-ICT relationships.

Required provisions include:

Service scope and standards: Clear definition of what service is being provided, with measurable performance standards and service level commitments. The vagueness that DORA compliance teams learned to reject in ICT contracts applies equally here.

Access and audit rights: The institution (and, where applicable, its competent authority) must have the right to audit the service provider’s performance and relevant operational processes. For a facilities management provider managing critical building infrastructure, this means documented audit rights, not just a general “cooperation” clause.

Business continuity and contingency: The provider must maintain and periodically test business continuity plans for services supporting the institution’s CIFs. The institution must have access to those plans and the right to require demonstrable continuity capability.

Data handling and confidentiality: Even for non-ICT services, providers handling sensitive information (HR records, legal files, confidential operational data) must be subject to appropriate confidentiality obligations and data handling requirements.

Exit provisions: Contracts must address what happens when the relationship ends — whether by expiration, termination for cause, or the institution’s election to insource or switch providers. Transition assistance, data return, and cost-certainty on exit are required elements.

Subcontracting: Where the provider can subcontract elements of the service, the contract must require prior approval or at minimum prior notice, and the institution must have equivalent rights against material subcontractors.

For compliance teams that have worked through DORA contract reviews, this checklist will look familiar in structure. The difference is the application: you’re now reviewing facilities management agreements, HR service contracts, and legal services arrangements against a contractual standard that previously applied only to technology vendors.

From EBA/GL/2019/02 to EBA/GL/2026/09: What Changed

EBA/GL/2026/09 replaces EBA/GL/2019/02, the outsourcing guidelines that have governed EU financial institution third-party relationships for the past seven years. Three changes are worth flagging for institutions that built their TPRM programs on the old framework.

1. Scope expansion from outsourcing to third-party arrangements

As described above, the shift from “outsourcing” to “third-party arrangements” meaningfully expands what’s covered. Institutions that audited their vendor portfolios under EBA/GL/2019/02 and concluded that certain relationships didn’t qualify as outsourcing need to revisit that assessment under the new scope.

2. Integration with the DORA framework

EBA/GL/2019/02 predated DORA. The new guidelines are explicitly designed to work alongside DORA — they cover what DORA doesn’t, use aligned terminology where possible, and establish a consistent framework for competent authorities supervising institutions subject to both. The two frameworks are meant to be read together as a complete picture of EU third-party risk governance.

3. Concentration risk requirements

The outsourcing guidelines addressed concentration risk in a limited way. EBA/GL/2026/09 elevates concentration risk assessment to a required element of the TPRM framework, requiring institutions to assess:

• Provider concentration (multiple CIFs dependent on a single non-ICT vendor)
• Geographic concentration (non-ICT service delivery concentrated in specific locations or jurisdictions)
• Alternative provider availability (for each CIF-supporting arrangement, can the institution substitute the provider if the relationship fails?)

This is the non-ICT equivalent of DORA’s ICT concentration risk requirements — and it will surface concentration exposures that many institutions have never systematically assessed.

The Practical Implication: TPRM Programs Need a Non-ICT Annex

For EU financial institutions, the compliance path forward is fairly clear in structure, even if the volume of work is substantial.

Step 1: Build the non-ICT inventory

Most TPRM programs have a reasonably good ICT vendor inventory after DORA implementation. Few have an equivalent inventory for non-ICT services. The starting point is an honest count: every contract with a non-ICT service provider, mapped against the guideline’s scope definition.

Step 2: CIF classification

For each non-ICT arrangement in the inventory, determine whether it supports a critical or important function. This requires the same substantive analysis used for DORA’s ICT service classification — not a quick compliance checkbox.

Step 3: Contract gap analysis

For CIF-supporting arrangements, compare existing contracts against the required provisions. Flag gaps. Prioritize renegotiation based on contract renewal dates and criticality.

Step 4: Due diligence and monitoring

Build or extend the due diligence program to cover non-ICT vendors. For CIF-supporting arrangements, the due diligence requirements are substantive — not a vendor questionnaire, but an assessment of the provider’s operational capability, financial stability, and business continuity posture.

Step 5: Concentration analysis

Map the non-ICT portfolio for concentration risk. Identify where multiple critical functions depend on related providers, where delivery is geographically concentrated, and where alternative options are limited.

The two-year transition period ends in September 2028. That timeline is tight for institutions that need to build non-ICT TPRM capability largely from scratch while also managing ongoing DORA compliance demands. The proposed interagency TPRM guidance from US regulators and the DORA third-party ICT risk framework provide useful reference points for the overall structure of risk-proportionate TPRM programs. The OCC/FDIC/Fed joint statement on core service providers illustrates what a targeted regulatory intervention in vendor contract practices looks like when supervision catches up to market reality.

EBA/GL/2026/09 is that intervention for non-ICT services in the EU. The transition clock started September 18.

Key Sources

• EBA/GL/2026/09: Guidelines on Third-Party Risk Management for Non-ICT Arrangements
• DORA — Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector
• EBA/GL/2019/02: Guidelines on Outsourcing Arrangements (superseded)
• EBA: Third-Party Risk Management Overview
• Allen & Overy: EBA Finalizes Non-ICT Third-Party Risk Management Guidelines