# Weekly outsourcing regulatory update — 2026-10-13
Run date/time UTC: 2026-10-13T09:22:28Z
Purpose: Monitoring update for outsourcing, third-party risk management, cloud/ICT outsourcing, operational resilience, critical third parties, registers/notifications, audit/access, sub-outsourcing and exit planning for an Italian bank operating in the UK. Regulatory analysis for Compliance/Legal review; not legal advice.
## Executive summary
- Material source-pack changes found: 25 new or changed authoritative items were downloaded/updated locally.
- Main theme: UK regulators have moved from outsourcing-only reporting toward material third-party arrangement notification/register reporting, effective 18 March 2027, and the UK CTP regime has first provider designations. EU/Italy DORA register/ICT incident materials remain relevant for Italian parent/group alignment.
- Sources checked: 33 successfully fetched; fetch errors: 0.
- Note: active source manifest was missing at the expected path and has been restored/maintained from the archived manifest where necessary.
## New or changed documents
### PRA / Bank of England — SS2/21 landing page
- Status in this run: changed
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ss2-21-landing.html
- Checksum: d8e7eafc050adcdf07dd55119ab35c087c33e2203055d24e1cbccb184101d492
- Binding status: Landing page
- Outsourcing relevance: Relevant to outsourcing/third-party oversight.
- Practical impact for outsourcing registry portal: Review source and update source pack references.
- Actions/evidence needed: Record in OI source register; assess portal/control changes.
### FCA — FCA Handbook SYSC 8 Outsourcing
- Status in this run: changed
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.handbook.fca.org.uk/handbook/SYSC/8/
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-handbook-sysc-8-outsourcing.html
- Checksum: 5016559fd743e9b6f52242f67b9bb2d4326fabb2de6a195605226a31ed7d1799
- Binding status: Handbook rules/guidance
- Outsourcing relevance: Relevant to outsourcing/third-party oversight.
- Practical impact for outsourcing registry portal: Review source and update source pack references.
- Actions/evidence needed: Record in OI source register; assess portal/control changes.
### FCA — FCA Handbook SYSC 15A Operational resilience
- Status in this run: changed
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.handbook.fca.org.uk/handbook/SYSC/15A/
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-handbook-sysc-15a-operational-resilience.html
- Checksum: f4b449203a2283e20790d4e922e895a7d1a67585b8bd569cca11db0271b2dafd
- Binding status: Handbook rules/guidance
- Outsourcing relevance: Relevant to outsourcing/third-party oversight.
- Practical impact for outsourcing registry portal: Review source and update source pack references.
- Actions/evidence needed: Record in OI source register; assess portal/control changes.
### FCA — FCA Handbook CTPS Critical Third Parties sourcebook
- Status in this run: changed
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.handbook.fca.org.uk/handbook/CTPS/
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-handbook-ctps-critical-third-parties.html
- Checksum: a53400f46a863c925635d5ea5d31f712afd46fc5fc20c00e35b99a200dba74a4
- Binding status: Handbook rules/guidance
- Outsourcing relevance: UK Critical Third Parties regime operationalisation and first CTP designations; firms remain accountable for own outsourcing/third-party risk management.
- Practical impact for outsourcing registry portal: Portal should flag designated CTP providers and related contracts/services: AWS EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited.
- Actions/evidence needed: Screen supplier master/register for designated CTPs; tag systemic provider dependencies; evidence concentration/exit/resilience analysis for cloud and technology dependencies.
### EU — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)
- Status in this run: new source copy added/repaired
- Date/version evidence: Regulation (EU) 2022/2554, 14 December 2022; OJ L 333, 27.12.2022; EUR-Lex document 32022R2554; in force. Fetched/extracted 2026-10-13T09:22:28Z.
- URL: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/eu/regulation-eu-2022-2554-dora-eurlex-extract.md
- Checksum: 639c97fa058c8aa002b355a01b4acff97b0731c1e01cb418a6182dc9832f0fb1
- Binding status: EU Regulation / binding law
- Outsourcing relevance: DORA establishes ICT risk management, ICT third-party risk, contractual arrangements/register of information, incident reporting and oversight of critical ICT third-party service providers for EU financial entities; relevant for the Italian parent/group context and for alignment with UK outsourcing/MTP registers.
- Practical impact for outsourcing registry portal: Preserve a DORA ICT-services view in parallel with the UK material third-party arrangement view, including ICT service taxonomy, critical/important functions, register-of-information fields and subcontracting dependencies.
- Actions/evidence needed: Map DORA ICT third-party register fields to UK MTP register fields; evidence entity/sub-consolidated/consolidated register ownership; confirm Italian parent submission expectations with Compliance/Legal.
### Bank of Italy — Circolare n. 285 landing page
- Status in this run: changed
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bancaditalia.it/compiti/vigilanza/normativa/archivio-norme/circolari/c285/index.html
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/italy/bank-of-italy-circular-285-landing.html
- Checksum: d376943166e498ed8a2601cd4487e7f48e9178843880357f9f765cf042ea2d71
- Binding status: Landing page
- Outsourcing relevance: Bank of Italy DORA implementation communications affecting Italian parent/group obligations for ICT incidents and registers of information.
- Practical impact for outsourcing registry portal: Portal should support Italian/DORA submission calendar evidence and distinguish UK MTP reporting from DORA ICT third-party register obligations.
- Actions/evidence needed: Capture Bank of Italy/DORA register submission deadlines/evidence; align Italian parent ICT third-party inventory with UK outsourcing/MTP register.
### PRA / Bank of England — PS7/26 Operational resilience: Operational incident and third-party reporting
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bankofengland.co.uk/prudential-regulation/publication/2026/march/operational-incident-and-third-party-reporting-policy-statement
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ps7-26-operational-incident-third-party-reporting.html
- Checksum: 41f7cf94291f892b36acda350e7d2b8da3b66242e3fb74693a6cc356e15c9090
- Binding status: Policy Statement / final policy landing page
- Outsourcing relevance: Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements.
- Practical impact for outsourcing registry portal: Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances.
- Actions/evidence needed: Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence.
### PRA / Bank of England — PS7/26 Appendix 1 - Notification of Third-Party Arrangements and Operational Incident Reporting Instrument 2026
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: Thu, 19 Mar 2026 11:45:28 GMT; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2026/march/ps726app1.pdf
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ps7-26-app1-notification-third-party-operational-incident-reporting-rules.pdf
- Checksum: 8b3e0f752c7b37d571b5ebcd77bc6a4bc6b70a283e888e01ba77a6405871c9f4
- Binding status: Rules / Instrument appendix
- Outsourcing relevance: Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements.
- Practical impact for outsourcing registry portal: Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances.
- Actions/evidence needed: Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence.
### PRA / Bank of England — PS7/26 Appendix 7 - Changes to the reporting fields document
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: Thu, 19 Mar 2026 11:45:28 GMT; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2026/march/ps726app7.pdf
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ps7-26-app7-reporting-fields-changes.pdf
- Checksum: ee54b44ad24c2b9c0b1a3e055507abda5e3784f6dba4da64e879cc3f52e6a587
- Binding status: Policy appendix / reporting fields
- Outsourcing relevance: Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements.
- Practical impact for outsourcing registry portal: Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances.
- Actions/evidence needed: Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence.
### PRA / Bank of England — PS7/26 Appendix 8 - Changes to the material third-party reporting templates
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: Thu, 19 Mar 2026 11:45:29 GMT; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2026/march/ps726app8.pdf
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ps7-26-app8-material-third-party-template-changes.pdf
- Checksum: 0699589f903eb66f1d7aa49b213910635fc8b3cd21bce0a5c8304859f5837346
- Binding status: Policy appendix / template guidance
- Outsourcing relevance: Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements.
- Practical impact for outsourcing registry portal: Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances.
- Actions/evidence needed: Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence.
### PRA / Bank of England — Material third party notification reporting template Form M
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: Thu, 19 Mar 2026 14:05:41 GMT; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2026/march/form-m.xlsx
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-form-m-material-third-party-notification-template.xlsx
- Checksum: a98ae7484ec9ba0d82246db5da57bf834581a95598fc637e69e060afd975bfb3
- Binding status: Reporting template
- Outsourcing relevance: Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements.
- Practical impact for outsourcing registry portal: Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances.
- Actions/evidence needed: Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence.
### PRA / Bank of England — Material third party arrangements register template
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: Thu, 19 Mar 2026 14:05:33 GMT; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2026/march/mtp-arrangements-register.xlsx
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-material-third-party-arrangements-register-template.xlsx
- Checksum: 8d2e2c8e7665df4ffe27ec58594d59f02b3fadddb757a64b67d5a582446f1a28
- Binding status: Reporting template
- Outsourcing relevance: Introduces/implements UK PRA operational incident and material third-party arrangement notification/register regime, effective 18 March 2027; expands focus from outsourcing to material third-party arrangements.
- Practical impact for outsourcing registry portal: Portal should support Form M-style notifications, annual material third-party arrangement register fields, outsourcing/non-outsourcing classification, intragroup exception logic, and links to important business services/impact tolerances.
- Actions/evidence needed: Map current outsourcing register fields to PRA/FCA MTP template; add workflow trigger for new/significant change; capture whether provider is intra-group and whether external onward provision exists; track annual submission evidence.
### FCA — PS26/2 Operational Incident and Third Party Reporting
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.fca.org.uk/publication/policy/ps26-2.pdf
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-ps26-2-operational-incident-third-party-reporting.pdf
- Checksum: 583673109716c49c5713e46e0276a83ceb1023922cc6d72ec33e2adc979d12ad
- Binding status: Policy Statement / Handbook rules
- Outsourcing relevance: FCA final rules/guidance for operational incident and material third-party reporting; includes SUP 15.19 notification and SUP 16.33 annual register regime from 18 March 2027.
- Practical impact for outsourcing registry portal: Portal should distinguish FCA/PRA scope, store material third-party rationale, maintain register submission extract, and evidence early FCA Connect notification for planned/new/significant changes.
- Actions/evidence needed: Update portal taxonomy for material third-party arrangements; add SUP 15.19/SUP 16.33 evidence fields; add owner attestation that non-outsourcing but material dependencies are captured.
### FCA — FG26/4 Material Third Party Reporting
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.fca.org.uk/publication/finalised-guidance/fg26-4.pdf
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-fg26-4-material-third-party-reporting.pdf
- Checksum: 9021c53718a4a5a6d97e573fdaae3d77aebb0163a640e42005e3858074a6c41b
- Binding status: Finalised Guidance
- Outsourcing relevance: FCA final rules/guidance for operational incident and material third-party reporting; includes SUP 15.19 notification and SUP 16.33 annual register regime from 18 March 2027.
- Practical impact for outsourcing registry portal: Portal should distinguish FCA/PRA scope, store material third-party rationale, maintain register submission extract, and evidence early FCA Connect notification for planned/new/significant changes.
- Actions/evidence needed: Update portal taxonomy for material third-party arrangements; add SUP 15.19/SUP 16.33 evidence fields; add owner attestation that non-outsourcing but material dependencies are captured.
### FCA — Outsourcing and operational resilience
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.fca.org.uk/firms/outsourcing-and-operational-resilience
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-outsourcing-and-operational-resilience.html
- Checksum: e6bd75d453b194af1cfb29f117adafeba32710b9bead1f43dd154f2041f05317
- Binding status: Regulator webpage / guidance landing page
- Outsourcing relevance: Relevant to outsourcing/third-party oversight.
- Practical impact for outsourcing registry portal: Review source and update source pack references.
- Actions/evidence needed: Record in OI source register; assess portal/control changes.
### FCA — Reporting material third party arrangements
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.fca.org.uk/firms/outsourcing-and-operational-resilience/reporting-material-third-party-arrangements
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-reporting-material-third-party-arrangements.html
- Checksum: 879d4633fe33e91b0a90e4a4aa5e6ddae72a776da906d01beb5c5e7e59e2b9f2
- Binding status: Regulator webpage / reporting guidance
- Outsourcing relevance: FCA final rules/guidance for operational incident and material third-party reporting; includes SUP 15.19 notification and SUP 16.33 annual register regime from 18 March 2027.
- Practical impact for outsourcing registry portal: Portal should distinguish FCA/PRA scope, store material third-party rationale, maintain register submission extract, and evidence early FCA Connect notification for planned/new/significant changes.
- Actions/evidence needed: Update portal taxonomy for material third-party arrangements; add SUP 15.19/SUP 16.33 evidence fields; add owner attestation that non-outsourcing but material dependencies are captured.
### FCA — Critical Third Parties: Strengthening UK Financial Services
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.fca.org.uk/firms/critical-third-parties-strengthening-uk-financial-services
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-critical-third-parties-strengthening-uk-financial-services.html
- Checksum: 42d3db2aafb19502c7fae466c043aa37cf3109b2ead78a689b8f98754eaef9f9
- Binding status: Regulator webpage / CTP guidance
- Outsourcing relevance: UK Critical Third Parties regime operationalisation and first CTP designations; firms remain accountable for own outsourcing/third-party risk management.
- Practical impact for outsourcing registry portal: Portal should flag designated CTP providers and related contracts/services: AWS EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited.
- Actions/evidence needed: Screen supplier master/register for designated CTPs; tag systemic provider dependencies; evidence concentration/exit/resilience analysis for cloud and technology dependencies.
### Bank of England / PRA / FCA — Critical Third Parties (CTPs)
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bankofengland.co.uk/financial-stability/operational-resilience-of-the-financial-sector/critical-third-parties
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/boe-critical-third-parties.html
- Checksum: c1d5c821cd3dce4b7f71cc8c0aa441e6d30d1c72bd3d7c4026b95f49b2a33d6f
- Binding status: Regulator webpage / CTP oversight page
- Outsourcing relevance: UK Critical Third Parties regime operationalisation and first CTP designations; firms remain accountable for own outsourcing/third-party risk management.
- Practical impact for outsourcing registry portal: Portal should flag designated CTP providers and related contracts/services: AWS EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited.
- Actions/evidence needed: Screen supplier master/register for designated CTPs; tag systemic provider dependencies; evidence concentration/exit/resilience analysis for cloud and technology dependencies.
### HM Treasury — UK financial system strengthened with new safeguards for major technology providers
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.gov.uk/government/news/uk-financial-system-strengthened-with-new-safeguards-for-major-technology-providers
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/hmt-ctps-designation-2026-news.html
- Checksum: 706ee83cd6cdf179b7dab4c86076c27a8de20b67d43a85c7d68c75a3011c6a0b
- Binding status: Government announcement
- Outsourcing relevance: UK Critical Third Parties regime operationalisation and first CTP designations; firms remain accountable for own outsourcing/third-party risk management.
- Practical impact for outsourcing registry portal: Portal should flag designated CTP providers and related contracts/services: AWS EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited.
- Actions/evidence needed: Screen supplier master/register for designated CTPs; tag systemic provider dependencies; evidence concentration/exit/resilience analysis for cloud and technology dependencies.
### UK legislation / HM Treasury — The Critical Third Parties (Designation) Regulations 2026
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: Fri, 10 Jul 2026 09:07:46 GMT; fetched 2026-10-13T09:22:28Z.
- URL: https://www.legislation.gov.uk/uksi/2026/777/pdfs/uksi_20260777_en.pdf
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/uk/uksi-2026-777-critical-third-parties-designation-regulations-2026.pdf
- Checksum: e8bd48b9cfcda5bd809091c86456600e30824512898fe2972d0072d4ea085882
- Binding status: Binding law / statutory instrument
- Outsourcing relevance: UK Critical Third Parties regime operationalisation and first CTP designations; firms remain accountable for own outsourcing/third-party risk management.
- Practical impact for outsourcing registry portal: Portal should flag designated CTP providers and related contracts/services: AWS EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Corporation UK Limited.
- Actions/evidence needed: Screen supplier master/register for designated CTPs; tag systemic provider dependencies; evidence concentration/exit/resilience analysis for cloud and technology dependencies.
### EBA / ESAs — Joint Regulatory Technical Standards on subcontracting ICT services supporting critical or important functions
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/operational-resilience/joint-regulatory-technical-subcontracting
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-esas-dora-subcontracting-ict-services-critical-important-functions.html
- Checksum: d81ca386e91c8ae842673c2c2d66b870033c87aec840905284efdf59b3d46d8e
- Binding status: Final draft RTS / technical standards page
- Outsourcing relevance: DORA/ESA materials relevant to Italian/EU group ICT third-party risk, subcontracting and registers of information.
- Practical impact for outsourcing registry portal: Portal should preserve DORA register mapping for ICT services, subcontracting of critical/important functions, and consolidated/group reporting needs.
- Actions/evidence needed: Map UK MTP register fields to DORA register fields where possible; keep a separate DORA ICT-service register view for Italian parent/group oversight.
### EBA — Preparations for reporting of DORA registers of information
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.eba.europa.eu/activities/direct-supervision-and-oversight/digital-operational-resilience-act/preparation-dora-application
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-dora-registers-of-information-preparation.html
- Checksum: 64a53c9a4c24a51610bb8fea393824c6729fe0c0c1d887aa6f5a0485754f1f9b
- Binding status: Supervisory/implementation webpage
- Outsourcing relevance: DORA/ESA materials relevant to Italian/EU group ICT third-party risk, subcontracting and registers of information.
- Practical impact for outsourcing registry portal: Portal should preserve DORA register mapping for ICT services, subcontracting of critical/important functions, and consolidated/group reporting needs.
- Actions/evidence needed: Map UK MTP register fields to DORA register fields where possible; keep a separate DORA ICT-service register view for Italian parent/group oversight.
### Bank of Italy — Comunicazione relativa alle tempistiche per la trasmissione dei registri delle informazioni DORA
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bancaditalia.it/compiti/vigilanza/avvisi-pub/2026.02.13-regolamento-dora/index.html
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/italy/bank-of-italy-dora-register-transmission-timing-2026.html
- Checksum: f005db278f67b74799286a4182e3e3683ccc1adc74bfaad5e6b98a6133f6c2ff
- Binding status: Supervisory communication
- Outsourcing relevance: Bank of Italy DORA implementation communications affecting Italian parent/group obligations for ICT incidents and registers of information.
- Practical impact for outsourcing registry portal: Portal should support Italian/DORA submission calendar evidence and distinguish UK MTP reporting from DORA ICT third-party register obligations.
- Actions/evidence needed: Capture Bank of Italy/DORA register submission deadlines/evidence; align Italian parent ICT third-party inventory with UK outsourcing/MTP register.
### Bank of Italy — Comunicazione tempistiche trasmissione DORA febbraio 2026
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: ven, 13 feb 2026 15:53:21 +0000; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bancaditalia.it/compiti/vigilanza/avvisi-pub/2026.02.13-regolamento-dora/Comunicazione-tempistiche-trasmissione-DORA-febbraio-2026.pdf
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/italy/bank-of-italy-dora-register-transmission-timing-feb-2026.pdf
- Checksum: 7993a49ebeeba98430b17414ffa320e51d68375b8a026b160e2151cbad331e2e
- Binding status: Supervisory communication
- Outsourcing relevance: Bank of Italy DORA implementation communications affecting Italian parent/group obligations for ICT incidents and registers of information.
- Practical impact for outsourcing registry portal: Portal should support Italian/DORA submission calendar evidence and distinguish UK MTP reporting from DORA ICT third-party register obligations.
- Actions/evidence needed: Capture Bank of Italy/DORA register submission deadlines/evidence; align Italian parent ICT third-party inventory with UK outsourcing/MTP register.
### Bank of Italy — Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
- Status in this run: new
- Date/version evidence: type/date from regulator page or document title where available; HTTP Last-Modified: not provided; fetched 2026-10-13T09:22:28Z.
- URL: https://www.bancaditalia.it/compiti/vigilanza/dora-incidenti/index.html?com.dotmarketing.htmlpage.language=1
- Local path: /data/workspace/outsourcing-initiative/01-source-regulation/italy/bank-of-italy-dora-major-ict-incident-reporting.html
- Checksum: 4ad03aa06cefc5aba8e2fdc74459fb07d30984d69f8ec9f1312747cceacc4238
- Binding status: Supervisory/implementation webpage
- Outsourcing relevance: Bank of Italy DORA implementation communications affecting Italian parent/group obligations for ICT incidents and registers of information.
- Practical impact for outsourcing registry portal: Portal should support Italian/DORA submission calendar evidence and distinguish UK MTP reporting from DORA ICT third-party register obligations.
- Actions/evidence needed: Capture Bank of Italy/DORA register submission deadlines/evidence; align Italian parent ICT third-party inventory with UK outsourcing/MTP register.
## No-change sources checked
- PRA / Bank of England — SS2/21 Outsourcing and third party risk management - March 2026 update (Supervisory Statement). URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/supervisory-statement/2026/ss221-march-2026-update.pdf. Local: /data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ss2-21-outsourcing-third-party-risk-management-march-2026-update.pdf. SHA256: 5ca459fbe677b1f98856da109eca38d23dc763807b3d8186c36b1940376dfbbd. Last-Modified: Mon, 16 Mar 2026 12:42:48 GMT.
- Bank of England / PRA / FCA — PS16/24 Operational resilience: Critical third parties to the UK financial sector (Policy Statement). URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2024/november/ps16-24-operational-resilience-critical-third-parties-to-the-uk-financial-sector.pdf. Local: /data/workspace/outsourcing-initiative/01-source-regulation/uk/boe-pra-fca-ps16-24-critical-third-parties.pdf. SHA256: cec88b786694ed54ecaf7e3d8c2159cf725f5da26756c87317085283817cf0ae. Last-Modified: Tue, 19 Nov 2024 10:54:38 GMT.
- PRA / Bank of England — PS16/24 Appendix 1 - PRA Critical Third Parties Instrument / rules (Rules / Instrument appendix). URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2024/november/ps1624app1.pdf. Local: /data/workspace/outsourcing-initiative/01-source-regulation/uk/pra-ps16-24-appendix-1-critical-third-parties-rules.pdf. SHA256: 7d950f70406d59968ff684f165f2f4bf826fc62b7dced4ab8d18ec1683a70ee6. Last-Modified: Tue, 12 Nov 2024 09:45:13 GMT.
- Bank of England / PRA — PS16/24 Appendix 3 - Supervisory Statement / Statement of Policy material (Supervisory / policy appendix). URL: https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/policy-statement/2024/november/ps1624app3.pdf. Local: /data/workspace/outsourcing-initiative/01-source-regulation/uk/boe-pra-ps16-24-appendix-3-supervisory-material.pdf. SHA256: 5e4a8196d27491cc88448d2b6c7f7820b9dd3fd56ee55d99b482b91850d9143b. Last-Modified: Tue, 12 Nov 2024 09:45:13 GMT.
- FCA — FG16/5 Guidance for firms outsourcing to the cloud and other third-party IT services (Finalised Guidance). URL: https://www.fca.org.uk/publication/finalised-guidance/fg16-5.pdf. Local: /data/workspace/outsourcing-initiative/01-source-regulation/uk/fca-fg16-5-cloud-other-third-party-it-services.pdf. SHA256: da2b2c94f818f3b1ed0a5b69f48214d8ffa53dc8d82541cc9d0dd74b0d765a13. Last-Modified: not provided.
- EBA — EBA Guidelines on outsourcing arrangements EBA/GL/2019/02 (Guidelines). URL: https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf. Local: /data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-gl-2019-02-guidelines-on-outsourcing-arrangements.pdf. SHA256: 96122d88c0a00330c12a47ace506a1d81d877cfa164f3bdbdc6daa39890d882c. Last-Modified: Tue, 10 Dec 2024 13:33:18 GMT.
- EBA — EBA Guidelines on ICT and security risk management EBA/GL/2019/04 (Guidelines). URL: https://www.eba.europa.eu/sites/default/files/document_library/Publications/Guidelines/2020/GLs%20on%20ICT%20and%20security%20risk%20management/872936/Final%20draft%20Guidelines%20on%20ICT%20and%20security%20risk%20management.pdf. Local: /data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-gl-2019-04-ict-security-risk-management.pdf. SHA256: 961448951560007501fa81bbc6980ffe1658e8b00384c63dedbdc8852c31d646. Last-Modified: Fri, 09 Oct 2020 15:40:19 GMT.
- Bank of Italy — Circolare n. 285 del 17 dicembre 2013 - Testo integrale al 51° aggiornamento, 3 febbraio 2026 (Supervisory provisions for banks). URL: https://www.bancaditalia.it/compiti/vigilanza/normativa/archivio-norme/circolari/c285/aggiornamenti/Circ-285-Testo-integrale-al-51-aggto.pdf. Local: /data/workspace/outsourcing-initiative/01-source-regulation/italy/bank-of-italy-circular-285-51-update-full-text.pdf. SHA256: a3911f8a464a0f7f94752820d71c5bb7e54d8afa421f8d16ac8a5b063aa4c690. Last-Modified: mer, 24 giu 2026 10:12:07 +0000.
## Limitations / errors
- No fetch errors recorded for the final retained source set.
- EUR-Lex DORA PDF/direct Python fetch returned an empty body in this runtime. The retained local DORA source is therefore the complete authoritative EUR-Lex HTML text extracted by web_extract and stored as Markdown: /data/workspace/outsourcing-initiative/01-source-regulation/eu/regulation-eu-2022-2554-dora-eurlex-extract.md.
- Search/discovery was limited to authoritative regulator/government/EU/Bank of Italy pages available from the runtime network. Web search snippets were used only to identify authoritative URLs; downloaded source files/pages and checksums provide the update evidence.
## Control/evidence checklist for OI follow-up
- Update registry field mapping for UK MTP notification/register templates, including provider legal entity, outsourcing/non-outsourcing classification, cloud deployment model, notice periods, IBS/impact tolerance references, subcontracting/key sub-contractors, compliance attestation and annual/ad-hoc submission status.
- Add governance workflow for planned new/significant changes to material third-party arrangements, including Legal/Compliance review before FCA Connect/Form M submission.
- Screen supplier inventory for first UK-designated CTPs: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited.
- Maintain a DORA/Bank of Italy view for ICT third-party service contracts and register-of-information submissions; reconcile with UK MTP register to avoid inconsistent provider/service records.
- Evidence ongoing monitoring: due diligence, concentration risk, sub-outsourcing, audit/access rights, data location, exit/termination, resilience testing and incident escalation.