CP173: Central Bank Consults on New Third-Party Risk Guidance to Replace its Outsourcing Guidance

What You Need to Know

In October 2026, the Central Bank of Ireland (“Central Bank”) published a consultation paper (“CP173”) on draft Guidance on Good Practices for the Sound Management of Third-Party Risks (the “Draft Guidance”). Once finalised, the Draft Guidance will replace the Central Bank’s Cross-Industry Guidance on Outsourcing published in December 2021 (the “2021 Guidance”).

The Draft Guidance follows the approach taken by the European Banking Authority in its final guidelines on the sound management of third-party risk regarding non-ICT services, published in September 2026 (the “EBA Guidelines”)¹.

Key Changes

The key changes proposed under the Draft Guidance include the following:

• The Draft Guidance is built around 16 outcome principles across five areas: (i) governance; (ii) risk management and due diligence; (iii) contracting; (iv) ongoing risk management and monitoring; and (v) incident and termination management.
• The Draft Guidance is deliberately presented as “non-binding” and “outcomes based”. Firms do not need to adhere rigidly to every good practice and can instead take an approach that appropriately addresses the relevant risks and complies with applicable legal and regulatory requirements.

Some of the detail in the 2021 Guidance has not been retained in the Draft Guidance, including:

• The sector-specific appendix on critical or important functions, which covered fund management companies, administrators and depositaries;
• The detailed notification section, which is replaced by a reference to the Central Bank’s website, which includes details on the notification process; and
• The expectation that the board of directors (“Board”) approves the outsourcing policy at least annually.
• Firms should continue to maintain an outsourcing register (now a register of third-party service provider arrangements). The Draft Guidance sets out some additional data fields that will need to be included for each party listed in the register.

Areas Broadly Unchanged

The core expectations of the 2021 Guidance are carried over largely unchanged, including that:

• The Board retains ultimate accountability, which cannot be outsourced;
• Firms need a documented outsourcing and third-party arrangements strategy and policy;
• Firms need a risk-based methodology for assessing whether a function is critical or important;
• Due diligence is required before entering into an outsourcing or third-party arrangement;
• Ongoing monitoring and internal audit provisions continue to apply; and
• Firms need exit strategies and business continuity planning.
• The Central Bank also maintains its position that “delegation” and “outsourcing” are not different concepts. This is directly relevant to UCITS management companies and AIFMs.

Third Parties and Outsourced Service Providers

The Draft Guidance expressly applies the principle of proportionality. The good practices are primarily intended for critical or important functions and services, but firms should consider whether to apply some of them to non-critical or less important arrangements in line with their own risk assessment. In any case, firms should seek to identify, record and appropriately manage all third-party risks as part of a robust overall risk management strategy.

Group Oversight Arrangements

The Draft Guidance confirms that intragroup arrangements should be approached in the same manner as arrangements with external providers, although the risk assessment will differ. Where a firm relies on centrally provided services or centralised group monitoring, the Draft Guidance expects the following:

• Intragroup risk assessments and due diligence should be carried out with the same rigor as for external providers;
• Arrangements should be at arm’s length and the governance arrangements should provide for resolving conflicts of interest;
• Firms should assess whether group policies are fit for purpose and comply with their legal and regulatory obligations;
• Firms should receive appropriate reporting on matters including pre-appointment due diligence, risk assessment and performance oversight; and
• Firms should be satisfied that remediation or restoration of outsourced services is appropriately prioritised in the event of outages.

The Board should also be able to demonstrate that it has considered whether group arrangements work for the Irish entity.

Contractual Arrangements

Many of the contractual terms expected for critical or important arrangements which were already set out in the 2021 Guidance are being retained. These include key performance indicators, notification of material developments, audit and access rights, business continuity testing and exit provisions.

CP173 also acknowledges that firms may not always be able to obtain particular protections. In those cases, firms should assess the residual risk, consider alternatives and put proportionate mitigating measures in place.

Timing

The Draft Guidance is subject to consultation, and the closing date for submissions is 3 December 2026. Finalised guidance can be expected in early 2027.

How We Can Help

Our Irish Financial Services Regulatory Group has extensive experience in designing effective governance, risk management and business continuity processes and in carrying out operational reviews of existing outsourcing and third-party risk frameworks in line with relevant legal and regulatory requirements and supervisory expectations.

Further Information

If you would like further information, please liaise with your usual Maples Group contact or any of the persons listed on this page.

---

¹ European Banking Authority, Final Report: Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09), 18 September 2026. Once applicable, the EBA Guidelines will replace the EBA’s 2019 Guidelines on outsourcing arrangements.