Outsourcing (EBA Guidelines)Outsourcing is an arrangement in which a service provider performs a process, service or activity that the institution would otherwise perform itself. The EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) set governance, risk assessment, contract and register rules, with stricter terms for critical or important functions.
DORA (Digital Operational Resilience Act)DORA, Regulation (EU) 2022/2554, sets uniform rules on ICT risk management, ICT incident reporting, digital resilience testing and ICT third-party risk for almost all EU financial entities. It has applied since 17 January 2025 and also creates EU oversight of critical ICT third-party providers.
ICT third-party riskICT third-party risk is the risk to a financial entity from relying on external providers of information and communication technology services, such as cloud, software and data centres. DORA requires a strategy, due diligence, mandatory contract terms, monitoring, concentration analysis and exit plans for these arrangements.