What the Central Bank’s Revised Third-Party Risk Guidance Means for Regulated Firms

On 8 October 2026, the Central Bank of Ireland (the “Central Bank”) published a consultation paper (CP173) seeking stakeholder views on proposed Guidance on Good Practices for the Sound Management of Third-Party Risks (the “Guidance”), closely following the European Banking Authority’s (“EBA”) Guidelines on the Sound Management of Third-Party Risk Regarding Non-ICT Services (EBA/GL/2026/09) published on 18 September 2026. When finalised, the Guidance is to replace the Central Bank’s Cross-Industry Guidance on Outsourcing (December 2021).

Operational risks and resilience have been identified as a persistent, red-rated risk in the Central Bank’s Regulatory and Supervisory Outlook Report 2026. As recently highlighted by Governor Gabriel Makhlouf at the Irish Funds Annual Global Funds Conference on 1 October 2026, increasing reliance by regulated financial service providers (“firms”) on a relatively small number of critical technology and infrastructure providers creates systemic vulnerabilities: a significant outage at a single cloud provider or data management platform could ripple across the industry and, as retail participation grows, across households too. The Governor made clear that firms are expected to have exit strategies, to test them and to ensure that their Boards and senior management understand the dependencies that underpin their operations.

The proposed Guidance represents a move away from prescriptive requirements towards a series of outcomes, each supported by ‘Good Practices’, in recognition of firms’ ownership, responsibility and discretion to achieve those outcomes. The Guidance is non-binding, and the Central Bank states that it does not impose new or more stringent standards; firms may take a different approach provided it manages the relevant risks and meets their legal obligations. The proposed Guidance forms part of the Central Bank’s regulatory simplification agenda, aligning with international (Basel Committee on Banking Supervision, Financial Stability Board) and EU (EBA, ESMA) standards as well as the Digital Operational Resilience Act (“DORA”), and addresses the significant developments in how firms engage with third parties since the 2021 guidance was published.

Increasing Dependencies Require Enhanced Resilience

Firms are increasingly dependent on third-party service providers for cost efficiency, for access to new and advanced technologies and specialised expertise, and to enable firms to maintain focus on their core business activities. Third-party specialists can also help firms adapt to market pressures and regulatory changes.

The Central Bank identifies systemic risk where common vulnerabilities are present across third-party service providers (for example, where several providers rely on the same fourth party or operate from a single geographic region), and where firms overly rely on long-standing service providers and intragroup resources. These risks are amplified from a consumer protection perspective, where service disruption and data breaches directly harm consumers.

Building on the EBA’s approach, the Guidance proposes a horizontal, cross-industry approach applying to all regulated financial service providers, extending the scope beyond traditional outsourcing to include all shared services and other arrangements where a firm depends on a third party for services, processes or functions on an ongoing or recurring basis. This covers partnerships, joint ventures, cloud services, data processing, customer service, fintech collaborations, technology vendors and software providers including – inevitably – AI, as well as formal and traditional outsourced functions, including intragroup arrangements. The Central Bank treats ‘delegation’ and ‘outsourcing’ as the same concept, so relabelling an arrangement will not take it out of scope. Unlike the EBA Guidelines, the Guidance also covers ICT arrangements of firms that fall outside DORA.

The Guidance is structured around the lifecycle of a third-party arrangement (governance and organisational context; pre-engagement; engagement; ongoing management; and termination) and presents two tiers of Good Practices, leaving firms to implement them as best suits the nature, scale and complexity of the firm: Foundational Good Practices, being core practices forming the foundation of sound third-party risk management, and Supporting Good Practices, being additional practices that enhance and support Foundational Good Practices. The Good Practices apply primarily to critical or important arrangements, and firms are expected to apply them more widely where their own risk assessment indicates that it is prudent to do so.

Regulatory Impact Assessment: The consultation includes a Regulatory Impact Assessment (“RIA”), in line with the draft Statement of Approach set out in the Central Bank’s recent consultation on Regulatory Impact Assessments, and the Central Bank’s Approach to Consultation (CP 170), which closed on 30 September 2026. Although the Central Bank notes that an RIA would not normally be required, as the Guidance is non-mandatory advice, the RIA was included based on the particular system-wide significance of third-party risk management and demonstrated interest from industry stakeholders.

Action Required

The consultation period is open until 3 December 2026 and stakeholders are invited to comment on the proposed Guidance, including on the specific questions set out in Section 5 of CP173. Responses should be submitted to TPRMconsultation@centralbank.ie. The Central Bank plans to host an industry workshop during this period and stakeholders may request bilateral meetings. The Central Bank has indicated a timeframe for final Guidance to be published in Q1 2027. As currently proposed, the Guidance would take effect on its date of publication, with no transition period, at which point the 2021 Cross-Industry Guidance on Outsourcing would be withdrawn. The Central Bank is, however, seeking feedback on appropriate implementation and transitional arrangements.

Although the Guidance has yet to be finalised, firms can expect the broad strokes to be retained in the final text. Accordingly, firms should begin to identify, assess and document all arrangements, including intragroup arrangements, where a third party provides services, processes or functions to the firm, and should check that their register of third-party arrangements captures the information the Guidance expects.

Firms should then review their governance and risk management frameworks to ensure the firm:

1. Accurately identifies and classifies the criticality or importance of each third-party arrangement, using a documented methodology that is applied consistently and reviewed periodically, focusing resources on those presenting the highest risk;
2. Includes adequate, risk-based due diligence and risk assessment in the appointment of a third-party service provider, refreshed during the life of the arrangement and ahead of renewal;
3. Maintains appropriate governance and oversight with full visibility of the activities of each third-party service provider, including intragroup providers, offshore jurisdictions and sub-outsourcing chains;
4. Operates robust accountability, strategy and policy frameworks for the management of third-party service providers, with the board retaining ultimate responsibility for third-party risk;
5. Puts in place appropriate contractual safeguards, including audit and access rights for the firm and the Central Bank, and clear conditions for any sub-outsourcing;
6. Sufficient plans and tests for contingencies and exit strategies where disruption or failures arise with a third-party service provider.
   

This review should be undertaken in the context of the firm’s nature, size and complexity as well as its business model, the materiality of its dependency on third-party service providers and the potential impact of disruption or failure of service.

For more information and to discuss this update, please contact David Naughton, Doireann O’Daly and Narita Woods of our Investment Funds and Financial Services Regulation Department.