EBA expands outsourcing rules, tightens oversight for financial firms
COURBEVOIE, FRANCE — The European Banking Authority (EBA) is proposing new guidelines to enhance the monitoring of third-party risks, allowing for the coverage of ICT services to be extended beyond current limits, as outlined in the Digital Operational Resilience Act (DORA).
The final rules allow financial firms, such as newly in-scope firms and issuers of various assets, two years to come into compliance.
Expanded guidelines fill gaps left by DORA
While DORA focuses on digital resilience, the updated rules ensure financial firms manage risks across all outsourced functions, including those not tied to technology.
Firms must maintain detailed registers of third-party arrangements, with stricter requirements for critical functions.
To comply with DORA, the EBA proposed excluding ICT dealings already regulated by DORA from its outsourcing guidelines.
The new regulations will be extended to cover more areas by increasing their applicability to other non-ICT third-party arrangements, aiming to achieve greater regulatory control.
The step is part of a wider European Union (EU) bid to clamp down as the trend of using external suppliers increases.
Expanded scope to include more entities and activities
A more significant change to the scope of entities regulated is the introduction of asset-referenced tokens and non-bank creditors authorized by MiCAR under the Mortgage Credit Directive.
Earlier, it covered credit institutions and payment firms, but the revision addresses the changing risks in the financial sector.
Newly in-scope firms are required to have effective risk management systems, including an exit strategy for critical third-party services.
Management bodies should be proactive in their supervision, allowing regulators to oversee outsourced functions effectively. Compliance deadlines will follow a two-year transition period after finalization.
The EBA’s move signals tighter scrutiny as financial services grow more interconnected, demanding greater accountability from both firms and their third-party providers.
