← Standards
EBA/GL/2019/02EBA

Guidelines on outsourcing arrangements

The European framework for banking outsourcing: register of arrangements, criticality analysis, due diligence, mandatory contract clauses, audit rights and exit strategies. DORA adopted and tightened this architecture for ICT providers.

Official text

Who it applies to

  • Financial sector procurement
  • Contract lawyers
  • Third-party risk managers

Structuring points

  • The exit strategy must be documented and testable before signature, not after
  • The register must flag critical or important functions
  • Sub-outsourcing must be explicitly authorised and tracked

Any outsourcing arrangement entered into by an institution, critical or not.