Weekly Outsourcing Regulatory Update — 2026-10-17

Run date/time (UTC): 2026-10-17T09:17:27Z

Scope: outsourcing, third-party risk management, ICT/cloud outsourcing, DORA, operational resilience, critical third parties, registers/notifications, audit/access, sub-outsourcing and exit planning for an Italian bank operating in the UK.

Regulatory-analysis note: this is not legal advice; conclusions are for Compliance/Legal review.

Executive summary

• Material new source added to the source pack: EBA Final report on Guidelines on the sound management of third-party risk regarding non-ICT services, EBA/GL/2026/09, dated 18 September 2026. Local copy downloaded and manifest updated.
• Main practical impact: the OI register / portal should be capable of managing non-ICT third-party arrangements as a broader population than traditional outsourcing, alongside DORA ICT third-party records. EBA expects a holistic third-party risk approach, but DORA remains the framework for ICT services.
• Existing authoritative PDFs/templates checked: no checksum change identified for core PRA/FCA/BoE PDFs/templates, EBA GL 2019/02, EBA ICT GL 2019/04, Bank of Italy Circular 285 full text, UK CTP designation regulations, or PRA/FCA 2026 third-party reporting PDFs/templates.
• Landing-page checksum changes detected: several regulator HTML pages changed hash/bytes. Based on this run, these are treated as monitoring changes, not confirmed substantive regulatory updates, except where they led to the new EBA final report above. Some may reflect dynamic webpage/cookie/cache content.
• Limitations: EUR-Lex direct programmatic fetch for DORA returned an empty/202 response; the DORA local source was restored from the authoritative EUR-Lex page extracted via the web extraction tool. EBA pages returned 403 through web extraction, but direct retrieval with a user-agent succeeded.

New or changed authoritative documents

1. EBA — Guidelines on sound management of third-party risk regarding non-ICT services

• Regulator / authority: European Banking Authority (EBA).
• Title: Final report on Guidelines on the sound management of third-party risk regarding non-ICT services.
• Reference / date: EBA/GL/2026/09, 18 September 2026.
• URL: https://www.eba.europa.eu/sites/default/files/2026-09/dc9ccbb3-79b9-493d-b693-c21adeffbcc9/Final%20report%20on%20GL%20on%20third-party%20risk%20management.pdf
• Local path: `/data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-final-report-guidelines-third-party-risk-management-2026.pdf`
• Checksum: `a040e96bb3c300b6a635be9ad03ae616dcba39b9d695db5b9098ce270fb390fb`
• Binding status: EBA Guidelines under Article 16 of Regulation (EU) No 1093/2010. The document states that competent authorities and financial institutions must make every effort to comply; competent authorities notify EBA whether they comply or intend to comply. Source: EBA, Final report EBA/GL/2026/09, section 3, “Status of these Guidelines”, paras 1-4, 18 September 2026.
• Scope / applicability: non-ICT services provided by third-party service providers (TPSPs) supporting functions, with focus on critical or important functions. ICT services within DORA are excluded. Source: EBA/GL/2026/09, paras 5-7.
• Outsourcing relevance: outsourcing is a subset of “third-party arrangements”; the framework expands governance beyond outsourcing to broader recurrent or ongoing non-ICT TPSP support. Source: EBA/GL/2026/09, definitions, para 17.
• Key obligations / expectations:

- management body responsibility and no delegation of accountability; sufficient resources and substance; no “empty shell” / letter-box outcome. Source: EBA/GL/2026/09, paras 41-46.

- third-party risk policy for non-ICT services supporting critical or important functions, reviewed at least annually. Source: EBA/GL/2026/09, para 47.

- documentation/register of third-party arrangements, including intragroup arrangements; central group register must allow each entity to obtain its individual register without undue delay. Source: EBA/GL/2026/09, para 28(d).

- access, audit and information rights for financial entities and competent authorities. Source: EBA/GL/2026/09, executive summary/background, para 28; section 12.2.

- subcontracting conditions and termination right where planned changes/subcontracting adversely affect critical or important functions. Source: EBA/GL/2026/09, executive summary/background, para 29; section 12.1.

- exit strategies for arrangements supporting critical or important functions. Source: EBA/GL/2026/09, paras 46(f), 142 and section 14.

- concentration risk monitoring at entity and supervisory level. Source: EBA/GL/2026/09, paras 30-31 and definition of concentration risk.

• Implementation / repeal: the extracted final report contains placeholders for the date of application and repeal date; it states that the 25 February 2019 EBA Guidelines on outsourcing will be repealed with effect from “[date]”. Source: EBA/GL/2026/09, paras 18-22. Action: monitor EBA for the final application/repeal date and any compliance table / national competent authority implementation.
• Impact for Italian bank in UK:

- For the Italian/EU parent and Bank of Italy/ECB context, this is a material change to the EU baseline for non-ICT third-party risk management.

- For the UK entity/branch, it is not UK binding law by itself, but it may be relevant for group standards, intra-group services, EU parent governance, and consolidated third-party risk oversight.

- The OI portal should not treat this as replacing UK PRA SS2/21 / FCA rules for the UK perimeter; it should map it as an EU/group overlay.

2. EBA — Guidelines on third party risk management landing page

• Regulator / authority: EBA.
• Title: Guidelines on third party risk management.
• URL: https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-third-party-risk-management
• Local path: `/data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-guidelines-third-party-risk-management.html`
• Checksum: `c74e364db4c8b04ac1a58013760b7e93d24007c7d19865ef796574418378354e`
• Binding status: regulator landing page / final report page; not itself binding, but links to the final EBA Guidelines package.
• Observed status: page timeline shows “Final Report” and “Not yet applicable” at time of fetch.

Existing source URL checks — changed checksums / monitoring signals

These were downloaded and manifest metadata was updated. No new PDF/rule text was confirmed from these checksum-only changes during this run.

• PRA / Bank of England — SS2/21 landing page: checksum changed; no SS2/21 PDF checksum change.
• FCA Handbook — SYSC 8 outsourcing: checksum/bytes changed; Handbook page re-fetched. Practical impact not confirmed from this automated run; requires legal/rules diff if materiality is suspected.
• FCA Handbook — SYSC 15A operational resilience: checksum/bytes changed; no confirmed material conclusion in this run.
• FCA Handbook — CTPS sourcebook page: checksum/bytes changed; no confirmed material conclusion in this run.
• Bank of Italy — Circular 285 landing page: checksum/bytes changed; full-text Circular 285 PDF unchanged.
• PRA — PS7/26 landing page: checksum/bytes changed; PS7/26 appendices/templates unchanged.
• FCA — Outsourcing and operational resilience webpage; Reporting material third party arrangements webpage; Critical Third Parties webpage: checksum/last-modified changed on fetch; no underlying FCA PS26/2 or FG26/4 PDF checksum change.
• Bank of England — Critical Third Parties webpage: checksum changed by one byte; no material update confirmed.
• HM Treasury CTP designation news page: ETag/checksum changed; UKSI 2026/777 PDF unchanged.
• EBA DORA subcontracting RTS page and DORA register preparation page: checksum changed; no downloaded RTS/ITS PDF change identified in this run.
• Bank of Italy DORA register timing and major ICT incident reporting pages: checksum changed; linked DORA register timing PDF unchanged.

No-change sources checked

• PRA SS2/21 Outsourcing and third-party risk management — March 2026 update PDF.
• BoE/PRA/FCA PS16/24 Operational resilience: Critical third parties to the UK financial sector PDF and PRA appendices.
• FCA FG16/5 cloud and third-party IT services PDF.
• EBA GL/2019/02 Guidelines on outsourcing arrangements PDF.
• EBA GL/2019/04 ICT and security risk management PDF.
• EU DORA Regulation (EU) 2022/2554 local text restored to prior authoritative EUR-Lex extracted checksum; no substantive change evidenced.
• Bank of Italy Circular 285 full text PDF, 51st update.
• PRA PS7/26 Appendix 1 rules, Appendix 7 fields, Appendix 8 template changes, Form M and MTP register templates.
• FCA PS26/2 Operational Incident and Third Party Reporting PDF.
• FCA FG26/4 Material Third Party Reporting PDF.
• UKSI 2026/777 Critical Third Parties (Designation) Regulations 2026 PDF.
• Bank of Italy February 2026 DORA register timing PDF.

Practical impact for the outsourcing registry portal

• Add / confirm a third-party arrangement type field covering:

- ICT third-party service / DORA arrangement;

- non-ICT third-party arrangement under EBA/GL/2026/09;

- outsourcing subset;

- intra-group third-party arrangement;

- subcontracted chain.

• Add / confirm critical or important function classification aligned to DORA / EBA definition, while preserving PRA/FCA material outsourcing/material third-party classifications for the UK perimeter.
• Add a regime applicability matrix per record: UK PRA/FCA, EU/EBA/DORA, Bank of Italy, group policy.
• Add or validate fields for third-country provider, intra-group provider, centralised group monitoring, individual entity register extract, competent-authority access/audit rights, termination rights, subcontracting approval/notification, exit strategy, concentration risk, annual policy review, and management body approval/oversight.
• Add a control to flag arrangements supporting critical or important functions where review/documentation is incomplete, pending EBA final application/transitional dates.

Actions / evidence needed

• Compliance/Legal: confirm the final EBA application date once published/updated and assess whether EBA/GL/2026/09 supersession of EBA/GL/2019/02 affects group outsourcing policy wording.
• OI portal owner: add EU non-ICT third-party risk regime mapping and avoid treating all third-party arrangements as outsourcing only.
• Procurement / Vendor Management: prepare evidence of pre-contractual analysis, risk assessment, due diligence, contractual clauses, subcontracting controls, audit/access rights, termination rights and exit strategies for non-ICT critical/important functions.
• Group Governance: confirm how individual UK and Italian/EU entity registers are extracted from any central register and how intra-group TPSP arrangements are documented.
• Operational Resilience: check concentration-risk reporting across UK MTP/PRA-FCA and EU/EBA non-ICT/DORA dimensions.

Files created / updated

• Markdown report: `/data/workspace/outsourcing-initiative/04-outputs/regulatory-updates/2026-10-17-weekly-outsourcing-regulatory-update.md`
• PDF report: `/data/workspace/outsourcing-initiative/04-outputs/regulatory-updates/2026-10-17-weekly-outsourcing-regulatory-update.pdf`
• HTML source for PDF: `/data/workspace/outsourcing-initiative/04-outputs/regulatory-updates/2026-10-17-weekly-outsourcing-regulatory-update.html`
• Updated manifest: `/data/workspace/outsourcing-initiative/01-source-regulation/metadata/source_manifest.json`
• Fetch evidence: `/data/workspace/outsourcing-initiative/04-outputs/regulatory-updates/2026-10-17-fetch-results.json`
• New EBA source evidence: `/data/workspace/outsourcing-initiative/04-outputs/regulatory-updates/2026-10-17-new-eba-tprm-added.json`