# Weekly outsourcing regulatory update — 2026-10-13 **Run date/time UTC:** 2026-10-13T09:22:28Z **Purpose:** Monitoring update for outsourcing, third-party risk management, cloud/ICT outsourcing, operational resilience, critical third parties, registers/notifications, audit/access, sub-outsourcing and exit planning for an Italian bank operating in the UK. Regulatory analysis for Compliance/Legal review; not legal advice. ## Executive summary - **Material source-pack changes found:** 25 new or changed authoritative items were downloaded/updated locally. - Main theme: UK regulators have moved from outsourcing-only reporting toward **material third-party arrangement** notification/register reporting, effective **18 March 2027**, and the UK CTP regime has first provider designations. EU/Italy DORA register/ICT incident materials remain relevant for Italian parent/group alignment. - **Sources checked:** 33 successfully fetched; **fetch errors:** 0. - Note: active source manifest was missing at the expected path and has been restored/maintained from the archived manifest where necessary. ## New or changed documents ### PRA / Bank of England — SS2/21 landing page - **Status in this run:** changed - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ss2-21-landing.html` - **Checksum:** `d8e7eafc050adcdf07dd55119ab35c087c33e2203055d24e1cbccb184101d492` - **Binding status:** Landing page - **Outsourcing relevance:** Relevant to outsourcing/third-party oversight. - **Practical impact for outsourcing registry portal:** Review source and update source pack references. - **Actions/evidence needed:** Record in OI source register; assess portal/control changes. ### FCA — FCA Handbook SYSC 8 Outsourcing - **Status in this run:** changed - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.handbook.fca.org.uk/handbook/SYSC/8/ - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-handbook-sysc-8-outsourcing.html` - **Checksum:** `5016559fd743e9b6f52242f67b9bb2d4326fabb2de6a195605226a31ed7d1799` - **Binding status:** Handbook rules/guidance - **Outsourcing relevance:** Relevant to outsourcing/third-party oversight. - **Practical impact for outsourcing registry portal:** Review source and update source pack references. - **Actions/evidence needed:** Record in OI source register; assess portal/control changes. ### FCA — FCA Handbook SYSC 15A Operational resilience - **Status in this run:** changed - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.handbook.fca.org.uk/handbook/SYSC/15A/ - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-handbook-sysc-15a-operational-resilience.html` - **Checksum:** `f4b449203a2283e20790d4e922e895a7d1a67585b8bd569cca11db0271b2dafd` - **Binding status:** Handbook rules/guidance - **Outsourcing relevance:** Relevant to outsourcing/third-party oversight. - **Practical impact for outsourcing registry portal:** Review source and update source pack references. - **Actions/evidence needed:** Record in OI source register; assess portal/control changes. ### FCA — FCA Handbook CTPS Critical Third Parties sourcebook - **Status in this run:** changed - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.handbook.fca.org.uk/handbook/CTPS/ - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-handbook-ctps-critical-third-parties.html` - **Checksum:** `a53400f46a863c925635d5ea5d31f712afd46fc5fc20c00e35b99a200dba74a4` - **Binding status:** Handbook rules/guidance - **Outsourcing relevance:** UK Critical Third Parties regime operationalisation and first CTP designations; firms remain accountable for own outsourcing/third-party risk management. - **Practical impact for outsourcing registry portal:** Portal should flag designated CTP providers and related contracts/services: AWS EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited. - **Actions/evidence needed:** Screen supplier master/register for designated CTPs; tag systemic provider dependencies; evidence concentration/exit/resilience analysis for cloud and technology dependencies. ### EU — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) - **Status in this run:** new source copy added/repaired - **Date/version evidence:** Regulation (EU) 2022/2554, 14 December 2022; OJ L 333, 27.12.2022; EUR-Lex document 32022R2554; in force. Fetched/extracted 2026-10-13T09:22:28Z. - **URL:** https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554 - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/eu/regulation-eu-2022-2554-dora-eurlex-extract.md` - **Checksum:** `639c97fa058c8aa002b355a01b4acff97b0731c1e01cb418a6182dc9832f0fb1` - **Binding status:** EU Regulation / binding law - **Outsourcing relevance:** DORA establishes ICT risk management, ICT third-party risk, contractual arrangements/register of information, incident reporting and oversight of critical ICT third-party service providers for EU financial entities; relevant for the Italian parent/group context and for alignment with UK outsourcing/MTP registers. - **Practical impact for outsourcing registry portal:** Preserve a DORA ICT-services view in parallel with the UK material third-party arrangement view, including ICT service taxonomy, critical/important functions, register-of-information fields and subcontracting dependencies. - **Actions/evidence needed:** Map DORA ICT third-party register fields to UK MTP register fields; evidence entity/sub-consolidated/consolidated register ownership; confirm Italian parent submission expectations with Compliance/Legal. ### Bank of Italy — Circolare n. 285 landing page - **Status in this run:** changed - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bancaditalia.it/compiti/vigilanza/normativa/archivio-norme/circolari/c285/index.html - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/italy/bank-of-italy-circular-285-landing.html` - **Checksum:** `d376943166e498ed8a2601cd4487e7f48e9178843880357f9f765cf042ea2d71` - **Binding status:** Landing page - **Outsourcing relevance:** Bank of Italy DORA implementation communications affecting Italian parent/group obligations for ICT incidents and registers of information. - **Practical impact for outsourcing registry portal:** Portal should support Italian/DORA submission calendar evidence and distinguish UK MTP reporting from DORA ICT third-party register obligations. - **Actions/evidence needed:** Capture Bank of Italy/DORA register submission deadlines/evidence; align Italian parent ICT third-party inventory with UK outsourcing/MTP register. ### PRA / Bank of England — PS7/26 Operational resilience: Operational incident and third-party reporting - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bankofengland.co.uk/prudential-regulation/publication/2026/march/operational-incident-and-third-party-reporting-policy-statement - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ps7-26-operational-incident-third-party-reporting.html` - **Checksum:** `41f7cf94291f892b36acda350e7d2b8da3b66242e3fb74693a6cc356e15c9090` - **Binding status:** Policy Statement / final policy landing page - **Outsourcing relevance:** Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements. - **Practical impact for outsourcing registry portal:** Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances. - **Actions/evidence needed:** Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence. ### PRA / Bank of England — PS7/26 Appendix 1 - Notification of Third-Party Arrangements and Operational Incident Reporting Instrument 2026 - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: Thu, 19 Mar 2026 11:45:28 GMT; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2026/march/ps726app1.pdf - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ps7-26-app1-notification-third-party-operational-incident-reporting-rules.pdf` - **Checksum:** `8b3e0f752c7b37d571b5ebcd77bc6a4bc6b70a283e888e01ba77a6405871c9f4` - **Binding status:** Rules / Instrument appendix - **Outsourcing relevance:** Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements. - **Practical impact for outsourcing registry portal:** Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances. - **Actions/evidence needed:** Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence. ### PRA / Bank of England — PS7/26 Appendix 7 - Changes to the reporting fields document - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: Thu, 19 Mar 2026 11:45:28 GMT; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2026/march/ps726app7.pdf - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ps7-26-app7-reporting-fields-changes.pdf` - **Checksum:** `ee54b44ad24c2b9c0b1a3e055507abda5e3784f6dba4da64e879cc3f52e6a587` - **Binding status:** Policy appendix / reporting fields - **Outsourcing relevance:** Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements. - **Practical impact for outsourcing registry portal:** Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances. - **Actions/evidence needed:** Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence. ### PRA / Bank of England — PS7/26 Appendix 8 - Changes to the material third-party reporting templates - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: Thu, 19 Mar 2026 11:45:29 GMT; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2026/march/ps726app8.pdf - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ps7-26-app8-material-third-party-template-changes.pdf` - **Checksum:** `0699589f903eb66f1d7aa49b213910635fc8b3cd21bce0a5c8304859f5837346` - **Binding status:** Policy appendix / template guidance - **Outsourcing relevance:** Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements. - **Practical impact for outsourcing registry portal:** Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances. - **Actions/evidence needed:** Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence. ### PRA / Bank of England — Material third party notification reporting template Form M - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: Thu, 19 Mar 2026 14:05:41 GMT; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2026/march/form-m.xlsx - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-form-m-material-third-party-notification-template.xlsx` - **Checksum:** `a98ae7484ec9ba0d82246db5da57bf834581a95598fc637e69e060afd975bfb3` - **Binding status:** Reporting template - **Outsourcing relevance:** Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements. - **Practical impact for outsourcing registry portal:** Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances. - **Actions/evidence needed:** Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence. ### PRA / Bank of England — Material third party arrangements register template - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: Thu, 19 Mar 2026 14:05:33 GMT; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2026/march/mtp-arrangements-register.xlsx - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-material-third-party-arrangements-register-template.xlsx` - **Checksum:** `8d2e2c8e7665df4ffe27ec58594d59f02b3fadddb757a64b67d5a582446f1a28` - **Binding status:** Reporting template - **Outsourcing relevance:** Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements. - **Practical impact for outsourcing registry portal:** Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances. - **Actions/evidence needed:** Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence. ### FCA — PS26/2 Operational Incident and Third Party Reporting - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.fca.org.uk/publication/policy/ps26-2.pdf - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-ps26-2-operational-incident-third-party-reporting.pdf` - **Checksum:** `583673109716c49c5713e46e0276a83ceb1023922cc6d72ec33e2adc979d12ad` - **Binding status:** Policy Statement / Handbook rules - **Outsourcing relevance:** FCA final rules/guidance for operational incident and material third-party reporting; includes SUP 15.19 notification and SUP 16.33 annual register regime from 18 March 2027. - **Practical impact for outsourcing registry portal:** Portal should distinguish FCA/PRA scope, store material third-party rationale, maintain register submission extract, and evidence early FCA Connect notification for planned/new/significant changes. - **Actions/evidence needed:** Update portal taxonomy for material third-party arrangements; add SUP 15.19/SUP 16.33 evidence fields; add owner attestation that non-outsourcing but material dependencies are captured. ### FCA — FG26/4 Material Third Party Reporting - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.fca.org.uk/publication/finalised-guidance/fg26-4.pdf - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-fg26-4-material-third-party-reporting.pdf` - **Checksum:** `9021c53718a4a5a6d97e573fdaae3d77aebb0163a640e42005e3858074a6c41b` - **Binding status:** Finalised Guidance - **Outsourcing relevance:** FCA final rules/guidance for operational incident and material third-party reporting; includes SUP 15.19 notification and SUP 16.33 annual register regime from 18 March 2027. - **Practical impact for outsourcing registry portal:** Portal should distinguish FCA/PRA scope, store material third-party rationale, maintain register submission extract, and evidence early FCA Connect notification for planned/new/significant changes. - **Actions/evidence needed:** Update portal taxonomy for material third-party arrangements; add SUP 15.19/SUP 16.33 evidence fields; add owner attestation that non-outsourcing but material dependencies are captured. ### FCA — Outsourcing and operational resilience - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.fca.org.uk/firms/outsourcing-and-operational-resilience - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-outsourcing-and-operational-resilience.html` - **Checksum:** `e6bd75d453b194af1cfb29f117adafeba32710b9bead1f43dd154f2041f05317` - **Binding status:** Regulator webpage / guidance landing page - **Outsourcing relevance:** Relevant to outsourcing/third-party oversight. - **Practical impact for outsourcing registry portal:** Review source and update source pack references. - **Actions/evidence needed:** Record in OI source register; assess portal/control changes. ### FCA — Reporting material third party arrangements - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.fca.org.uk/firms/outsourcing-and-operational-resilience/reporting-material-third-party-arrangements - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-reporting-material-third-party-arrangements.html` - **Checksum:** `879d4633fe33e91b0a90e4a4aa5e6ddae72a776da906d01beb5c5e7e59e2b9f2` - **Binding status:** Regulator webpage / reporting guidance - **Outsourcing relevance:** FCA final rules/guidance for operational incident and material third-party reporting; includes SUP 15.19 notification and SUP 16.33 annual register regime from 18 March 2027. - **Practical impact for outsourcing registry portal:** Portal should distinguish FCA/PRA scope, store material third-party rationale, maintain register submission extract, and evidence early FCA Connect notification for planned/new/significant changes. - **Actions/evidence needed:** Update portal taxonomy for material third-party arrangements; add SUP 15.19/SUP 16.33 evidence fields; add owner attestation that non-outsourcing but material dependencies are captured. ### FCA — Critical Third Parties: Strengthening UK Financial Services - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.fca.org.uk/firms/critical-third-parties-strengthening-uk-financial-services - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-critical-third-parties-strengthening-uk-financial-services.html` - **Checksum:** `42d3db2aafb19502c7fae466c043aa37cf3109b2ead78a689b8f98754eaef9f9` - **Binding status:** Regulator webpage / CTP guidance - **Outsourcing relevance:** UK Critical Third Parties regime operationalisation and first CTP designations; firms remain accountable for own outsourcing/third-party risk management. - **Practical impact for outsourcing registry portal:** Portal should flag designated CTP providers and related contracts/services: AWS EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited. - **Actions/evidence needed:** Screen supplier master/register for designated CTPs; tag systemic provider dependencies; evidence concentration/exit/resilience analysis for cloud and technology dependencies. ### Bank of England / PRA / FCA — Critical Third Parties (CTPs) - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/critical-third-parties - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/boe-critical-third-parties.html` - **Checksum:** `c1d5c821cd3dce4b7f71cc8c0aa441e6d30d1c72bd3d7c4026b95f49b2a33d6f` - **Binding status:** Regulator webpage / CTP oversight page - **Outsourcing relevance:** UK Critical Third Parties regime operationalisation and first CTP designations; firms remain accountable for own outsourcing/third-party risk management. - **Practical impact for outsourcing registry portal:** Portal should flag designated CTP providers and related contracts/services: AWS EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited. - **Actions/evidence needed:** Screen supplier master/register for designated CTPs; tag systemic provider dependencies; evidence concentration/exit/resilience analysis for cloud and technology dependencies. ### HM Treasury — UK financial system strengthened with new safeguards for major technology providers - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.gov.uk/government/news/uk-financial-system-strengthened-with-new-safeguards-for-major-technology-providers - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/hmt-ctps-designation-2026-news.html` - **Checksum:** `706ee83cd6cdf179b7dab4c86076c27a8de20b67d43a85c7d68c75a3011c6a0b` - **Binding status:** Government announcement - **Outsourcing relevance:** UK Critical Third Parties regime operationalisation and first CTP designations; firms remain accountable for own outsourcing/third-party risk management. - **Practical impact for outsourcing registry portal:** Portal should flag designated CTP providers and related contracts/services: AWS EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited. - **Actions/evidence needed:** Screen supplier master/register for designated CTPs; tag systemic provider dependencies; evidence concentration/exit/resilience analysis for cloud and technology dependencies. ### UK legislation / HM Treasury — The Critical Third Parties (Designation) Regulations 2026 - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: Fri, 10 Jul 2026 09:07:46 GMT; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.legislation.gov.uk/uksi/2026/777/pdfs/uksi_20260777_en.pdf - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/uk/uksi-2026-777-critical-third-parties-designation-regulations-2026.pdf` - **Checksum:** `e8bd48b9cfcda5bd809091c86456600e30824512898fe2972d0072d4ea085882` - **Binding status:** Binding law / statutory instrument - **Outsourcing relevance:** UK Critical Third Parties regime operationalisation and first CTP designations; firms remain accountable for own outsourcing/third-party risk management. - **Practical impact for outsourcing registry portal:** Portal should flag designated CTP providers and related contracts/services: AWS EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited. - **Actions/evidence needed:** Screen supplier master/register for designated CTPs; tag systemic provider dependencies; evidence concentration/exit/resilience analysis for cloud and technology dependencies. ### EBA / ESAs — Joint Regulatory Technical Standards on subcontracting ICT services supporting critical or important functions - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/operational-resilience/joint-regulatory-technical-subcontracting - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-esas-dora-subcontracting-ict-services-critical-important-functions.html` - **Checksum:** `d81ca386e91c8ae842673c2c2d66b870033c87aec840905284efdf59b3d46d8e` - **Binding status:** Final draft RTS / technical standards page - **Outsourcing relevance:** DORA/ESA materials relevant to Italian/EU group ICT third-party risk, subcontracting and registers of information. - **Practical impact for outsourcing registry portal:** Portal should preserve DORA register mapping for ICT services, subcontracting of critical/important functions, and consolidated/group reporting needs. - **Actions/evidence needed:** Map UK MTP register fields to DORA register fields where possible; keep a separate DORA ICT-service register view for Italian parent/group oversight. ### EBA — Preparations for reporting of DORA registers of information - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.eba.europa.eu/activities/direct-supervision-and-oversight/digital-operational-resilience-act/preparation-dora-application - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-dora-registers-of-information-preparation.html` - **Checksum:** `64a53c9a4c24a51610bb8fea393824c6729fe0c0c1d887aa6f5a0485754f1f9b` - **Binding status:** Supervisory/implementation webpage - **Outsourcing relevance:** DORA/ESA materials relevant to Italian/EU group ICT third-party risk, subcontracting and registers of information. - **Practical impact for outsourcing registry portal:** Portal should preserve DORA register mapping for ICT services, subcontracting of critical/important functions, and consolidated/group reporting needs. - **Actions/evidence needed:** Map UK MTP register fields to DORA register fields where possible; keep a separate DORA ICT-service register view for Italian parent/group oversight. ### Bank of Italy — Comunicazione relativa alle tempistiche per la trasmissione dei registri delle informazioni DORA - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bancaditalia.it/compiti/vigilanza/avvisi-pub/2026.02.13-regolamento-dora/index.html - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/italy/bank-of-italy-dora-register-transmission-timing-2026.html` - **Checksum:** `f005db278f67b74799286a4182e3e3683ccc1adc74bfaad5e6b98a6133f6c2ff` - **Binding status:** Supervisory communication - **Outsourcing relevance:** Bank of Italy DORA implementation communications affecting Italian parent/group obligations for ICT incidents and registers of information. - **Practical impact for outsourcing registry portal:** Portal should support Italian/DORA submission calendar evidence and distinguish UK MTP reporting from DORA ICT third-party register obligations. - **Actions/evidence needed:** Capture Bank of Italy/DORA register submission deadlines/evidence; align Italian parent ICT third-party inventory with UK outsourcing/MTP register. ### Bank of Italy — Comunicazione tempistiche trasmissione DORA febbraio 2026 - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: ven, 13 feb 2026 15:53:21 +0000; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bancaditalia.it/compiti/vigilanza/avvisi-pub/2026.02.13-regolamento-dora/Comunicazione-tempistiche-trasmissione-DORA-febbraio-2026.pdf - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/italy/bank-of-italy-dora-register-transmission-timing-feb-2026.pdf` - **Checksum:** `7993a49ebeeba98430b17414ffa320e51d68375b8a026b160e2151cbad331e2e` - **Binding status:** Supervisory communication - **Outsourcing relevance:** Bank of Italy DORA implementation communications affecting Italian parent/group obligations for ICT incidents and registers of information. - **Practical impact for outsourcing registry portal:** Portal should support Italian/DORA submission calendar evidence and distinguish UK MTP reporting from DORA ICT third-party register obligations. - **Actions/evidence needed:** Capture Bank of Italy/DORA register submission deadlines/evidence; align Italian parent ICT third-party inventory with UK outsourcing/MTP register. ### Bank of Italy — Reporting of major ICT-related incidents and voluntary notification of significant cyber threats - **Status in this run:** new - **Date/version evidence:** type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z. - **URL:** https://www.bancaditalia.it/compiti/vigilanza/dora-incidenti/index.html?com.dotmarketing.htmlpage.language=1 - **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/italy/bank-of-italy-dora-major-ict-incident-reporting.html` - **Checksum:** `4ad03aa06cefc5aba8e2fdc74459fb07d30984d69f8ec9f1312747cceacc4238` - **Binding status:** Supervisory/implementation webpage - **Outsourcing relevance:** Bank of Italy DORA implementation communications affecting Italian parent/group obligations for ICT incidents and registers of information. - **Practical impact for outsourcing registry portal:** Portal should support Italian/DORA submission calendar evidence and distinguish UK MTP reporting from DORA ICT third-party register obligations. - **Actions/evidence needed:** Capture Bank of Italy/DORA register submission deadlines/evidence; align Italian parent ICT third-party inventory with UK outsourcing/MTP register. ## No-change sources checked - **PRA / Bank of England** — SS2/21 Outsourcing and third party risk management - March 2026 update (Supervisory Statement). URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/supervisory-statement/2026/ss221-march-2026-update.pdf. Local: `/data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ss2-21-outsourcing-third-party-risk-management-march-2026-update.pdf`. SHA256: `5ca459fbe677b1f98856da109eca38d23dc763807b3d8186c36b1940376dfbbd`. Last-Modified: Mon, 16 Mar 2026 12:42:48 GMT. - **Bank of England / PRA / FCA** — PS16/24 Operational resilience: Critical third parties to the UK financial sector (Policy Statement). URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2024/november/ps16-24-operational-resilience-critical-third-parties-to-the-uk-financial-sector.pdf. Local: `/data/workspace/outsourcing-initiative/01-source-regulation/uk/boe-pra-fca-ps16-24-critical-third-parties.pdf`. SHA256: `cec88b786694ed54ecaf7e3d8c2159cf725f5da26756c87317085283817cf0ae`. Last-Modified: Tue, 19 Nov 2024 10:54:38 GMT. - **PRA / Bank of England** — PS16/24 Appendix 1 - PRA Critical Third Parties Instrument / rules (Rules / Instrument appendix). URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2024/november/ps1624app1.pdf. Local: `/data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ps16-24-appendix-1-critical-third-parties-rules.pdf`. SHA256: `7d950f70406d59968ff684f165f2f4bf826fc62b7dced4ab8d18ec1683a70ee6`. Last-Modified: Tue, 12 Nov 2024 09:45:13 GMT. - **Bank of England / PRA** — PS16/24 Appendix 3 - Supervisory Statement / Statement of Policy material (Supervisory / policy appendix). URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2024/november/ps1624app3.pdf. Local: `/data/workspace/outsourcing-initiative/01-source-regulation/uk/boe-pra-ps16-24-appendix-3-supervisory-material.pdf`. SHA256: `5e4a8196d27491cc88448d2b6c7f7820b9dd3fd56ee55d99b482b91850d9143b`. Last-Modified: Tue, 12 Nov 2024 09:45:13 GMT. - **FCA** — FG16/5 Guidance for firms outsourcing to the cloud and other third-party IT services (Finalised Guidance). URL: https://www.fca.org.uk/publication/finalised-guidance/fg16-5.pdf. Local: `/data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-fg16-5-cloud-other-third-party-it-services.pdf`. SHA256: `da2b2c94f818f3b1ed0a5b69f48214d8ffa53dc8d82541cc9d0dd74b0d765a13`. Last-Modified: not provided. - **EBA** — EBA Guidelines on outsourcing arrangements EBA/GL/2019/02 (Guidelines). URL: https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf. Local: `/data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-gl-2019-02-guidelines-on-outsourcing-arrangements.pdf`. SHA256: `96122d88c0a00330c12a47ace506a1d81d877cfa164f3bdbdc6daa39890d882c`. Last-Modified: Tue, 10 Dec 2024 13:33:18 GMT. - **EBA** — EBA Guidelines on ICT and security risk management EBA/GL/2019/04 (Guidelines). URL: https://www.eba.europa.eu/sites/default/files/document_library/Publications/Guidelines/2020/GLs%20on%20ICT%20and%20security%20risk%20management/872936/Final%20draft%20Guidelines%20on%20ICT%20and%20security%20risk%20management.pdf. Local: `/data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-gl-2019-04-ict-security-risk-management.pdf`. SHA256: `961448951560007501fa81bbc6980ffe1658e8b00384c63dedbdc8852c31d646`. Last-Modified: Fri, 09 Oct 2020 15:40:19 GMT. - **Bank of Italy** — Circolare n. 285 del 17 dicembre 2013 - Testo integrale al 51° aggiornamento, 3 febbraio 2026 (Supervisory provisions for banks). URL: https://www.bancaditalia.it/compiti/vigilanza/normativa/archivio-norme/circolari/c285/aggiornamenti/Circ-285-Testo-integrale-al-51-aggto.pdf. Local: `/data/workspace/outsourcing-initiative/01-source-regulation/italy/bank-of-italy-circular-285-51-update-full-text.pdf`. SHA256: `a3911f8a464a0f7f94752820d71c5bb7e54d8afa421f8d16ac8a5b063aa4c690`. Last-Modified: mer, 24 giu 2026 10:12:07 +0000. ## Limitations / errors - No fetch errors recorded for the final retained source set. - EUR-Lex DORA PDF/direct Python fetch returned an empty body in this runtime. The retained local DORA source is therefore the complete authoritative EUR-Lex HTML text extracted by `web_extract` and stored as Markdown: `/data/workspace/outsourcing-initiative/01-source-regulation/eu/regulation-eu-2022-2554-dora-eurlex-extract.md`. - Search/discovery was limited to authoritative regulator/government/EU/Bank of Italy pages available from the runtime network. Web search snippets were used only to identify authoritative URLs; downloaded source files/pages and checksums provide the update evidence. ## Control/evidence checklist for OI follow-up - Update registry field mapping for UK MTP notification/register templates, including provider legal entity, outsourcing/non-outsourcing classification, cloud deployment model, notice periods, IBS/impact tolerance references, subcontracting/key sub-contractors, compliance attestation and annual/ad-hoc submission status. - Add governance workflow for planned new/significant changes to material third-party arrangements, including Legal/Compliance review before FCA Connect/Form M submission. - Screen supplier inventory for first UK-designated CTPs: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited. - Maintain a DORA/Bank of Italy view for ICT third-party service contracts and register-of-information submissions; reconcile with UK MTP register to avoid inconsistent provider/service records. - Evidence ongoing monitoring: due diligence, concentration risk, sub-outsourcing, audit/access rights, data location, exit/termination, resilience testing and incident escalation.