# Weekly Outsourcing Regulatory Update — 2026-10-17

**Run date/time (UTC):** 2026-10-17T09:17:27Z  
**Scope:** outsourcing, third-party risk management, ICT/cloud outsourcing, DORA, operational resilience, critical third parties, registers/notifications, audit/access, sub-outsourcing and exit planning for an Italian bank operating in the UK.  
**Regulatory-analysis note:** this is not legal advice; conclusions are for Compliance/Legal review.

## Executive summary

- **Material new source added to the source pack:** EBA **Final report on Guidelines on the sound management of third-party risk regarding non-ICT services**, **EBA/GL/2026/09**, dated **18 September 2026**. Local copy downloaded and manifest updated.
- **Main practical impact:** the OI register / portal should be capable of managing **non-ICT third-party arrangements** as a broader population than traditional outsourcing, alongside DORA ICT third-party records. EBA expects a holistic third-party risk approach, but DORA remains the framework for ICT services.
- **Existing authoritative PDFs/templates checked:** no checksum change identified for core PRA/FCA/BoE PDFs/templates, EBA GL 2019/02, EBA ICT GL 2019/04, Bank of Italy Circular 285 full text, UK CTP designation regulations, or PRA/FCA 2026 third-party reporting PDFs/templates.
- **Landing-page checksum changes detected:** several regulator HTML pages changed hash/bytes. Based on this run, these are treated as **monitoring changes**, not confirmed substantive regulatory updates, except where they led to the new EBA final report above. Some may reflect dynamic webpage/cookie/cache content.
- **Limitations:** EUR-Lex direct programmatic fetch for DORA returned an empty/202 response; the DORA local source was restored from the authoritative EUR-Lex page extracted via the web extraction tool. EBA pages returned 403 through web extraction, but direct retrieval with a user-agent succeeded.

## New or changed authoritative documents

### 1. EBA — Guidelines on sound management of third-party risk regarding non-ICT services

- **Regulator / authority:** European Banking Authority (EBA).
- **Title:** Final report on Guidelines on the sound management of third-party risk regarding non-ICT services.
- **Reference / date:** **EBA/GL/2026/09**, **18 September 2026**.
- **URL:** https://www.eba.europa.eu/sites/default/files/2026-09/dc9ccbb3-79b9-493d-b693-c21adeffbcc9/Final%20report%20on%20GL%20on%20third-party%20risk%20management.pdf
- **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-final-report-guidelines-third-party-risk-management-2026.pdf`
- **Checksum:** `a040e96bb3c300b6a635be9ad03ae616dcba39b9d695db5b9098ce270fb390fb`
- **Binding status:** EBA Guidelines under Article 16 of Regulation (EU) No 1093/2010. The document states that competent authorities and financial institutions must make every effort to comply; competent authorities notify EBA whether they comply or intend to comply. Source: EBA, Final report EBA/GL/2026/09, section 3, “Status of these Guidelines”, paras 1-4, 18 September 2026.
- **Scope / applicability:** non-ICT services provided by third-party service providers (TPSPs) supporting functions, with focus on critical or important functions. ICT services within DORA are excluded. Source: EBA/GL/2026/09, paras 5-7.
- **Outsourcing relevance:** outsourcing is a subset of “third-party arrangements”; the framework expands governance beyond outsourcing to broader recurrent or ongoing non-ICT TPSP support. Source: EBA/GL/2026/09, definitions, para 17.
- **Key obligations / expectations:**
  - management body responsibility and no delegation of accountability; sufficient resources and substance; no “empty shell” / letter-box outcome. Source: EBA/GL/2026/09, paras 41-46.
  - third-party risk policy for non-ICT services supporting critical or important functions, reviewed at least annually. Source: EBA/GL/2026/09, para 47.
  - documentation/register of third-party arrangements, including intragroup arrangements; central group register must allow each entity to obtain its individual register without undue delay. Source: EBA/GL/2026/09, para 28(d).
  - access, audit and information rights for financial entities and competent authorities. Source: EBA/GL/2026/09, executive summary/background, para 28; section 12.2.
  - subcontracting conditions and termination right where planned changes/subcontracting adversely affect critical or important functions. Source: EBA/GL/2026/09, executive summary/background, para 29; section 12.1.
  - exit strategies for arrangements supporting critical or important functions. Source: EBA/GL/2026/09, paras 46(f), 142 and section 14.
  - concentration risk monitoring at entity and supervisory level. Source: EBA/GL/2026/09, paras 30-31 and definition of concentration risk.
- **Implementation / repeal:** the extracted final report contains placeholders for the date of application and repeal date; it states that the 25 February 2019 EBA Guidelines on outsourcing will be repealed with effect from “[date]”. Source: EBA/GL/2026/09, paras 18-22. **Action:** monitor EBA for the final application/repeal date and any compliance table / national competent authority implementation.
- **Impact for Italian bank in UK:**
  - For the Italian/EU parent and Bank of Italy/ECB context, this is a material change to the EU baseline for non-ICT third-party risk management.
  - For the UK entity/branch, it is not UK binding law by itself, but it may be relevant for group standards, intra-group services, EU parent governance, and consolidated third-party risk oversight.
  - The OI portal should not treat this as replacing UK PRA SS2/21 / FCA rules for the UK perimeter; it should map it as an EU/group overlay.

### 2. EBA — Guidelines on third party risk management landing page

- **Regulator / authority:** EBA.
- **Title:** Guidelines on third party risk management.
- **URL:** https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-third-party-risk-management
- **Local path:** `/data/workspace/outsourcing-initiative/01-source-regulation/eu/eba-guidelines-third-party-risk-management.html`
- **Checksum:** `c74e364db4c8b04ac1a58013760b7e93d24007c7d19865ef796574418378354e`
- **Binding status:** regulator landing page / final report page; not itself binding, but links to the final EBA Guidelines package.
- **Observed status:** page timeline shows “Final Report” and “Not yet applicable” at time of fetch.

## Existing source URL checks — changed checksums / monitoring signals

These were downloaded and manifest metadata was updated. No new PDF/rule text was confirmed from these checksum-only changes during this run.

- PRA / Bank of England — SS2/21 landing page: checksum changed; no SS2/21 PDF checksum change.
- FCA Handbook — SYSC 8 outsourcing: checksum/bytes changed; Handbook page re-fetched. Practical impact not confirmed from this automated run; requires legal/rules diff if materiality is suspected.
- FCA Handbook — SYSC 15A operational resilience: checksum/bytes changed; no confirmed material conclusion in this run.
- FCA Handbook — CTPS sourcebook page: checksum/bytes changed; no confirmed material conclusion in this run.
- Bank of Italy — Circular 285 landing page: checksum/bytes changed; full-text Circular 285 PDF unchanged.
- PRA — PS7/26 landing page: checksum/bytes changed; PS7/26 appendices/templates unchanged.
- FCA — Outsourcing and operational resilience webpage; Reporting material third party arrangements webpage; Critical Third Parties webpage: checksum/last-modified changed on fetch; no underlying FCA PS26/2 or FG26/4 PDF checksum change.
- Bank of England — Critical Third Parties webpage: checksum changed by one byte; no material update confirmed.
- HM Treasury CTP designation news page: ETag/checksum changed; UKSI 2026/777 PDF unchanged.
- EBA DORA subcontracting RTS page and DORA register preparation page: checksum changed; no downloaded RTS/ITS PDF change identified in this run.
- Bank of Italy DORA register timing and major ICT incident reporting pages: checksum changed; linked DORA register timing PDF unchanged.

## No-change sources checked

- PRA SS2/21 Outsourcing and third-party risk management — March 2026 update PDF.
- BoE/PRA/FCA PS16/24 Operational resilience: Critical third parties to the UK financial sector PDF and PRA appendices.
- FCA FG16/5 cloud and third-party IT services PDF.
- EBA GL/2019/02 Guidelines on outsourcing arrangements PDF.
- EBA GL/2019/04 ICT and security risk management PDF.
- EU DORA Regulation (EU) 2022/2554 local text restored to prior authoritative EUR-Lex extracted checksum; no substantive change evidenced.
- Bank of Italy Circular 285 full text PDF, 51st update.
- PRA PS7/26 Appendix 1 rules, Appendix 7 fields, Appendix 8 template changes, Form M and MTP register templates.
- FCA PS26/2 Operational Incident and Third Party Reporting PDF.
- FCA FG26/4 Material Third Party Reporting PDF.
- UKSI 2026/777 Critical Third Parties (Designation) Regulations 2026 PDF.
- Bank of Italy February 2026 DORA register timing PDF.

## Practical impact for the outsourcing registry portal

- Add / confirm a **third-party arrangement type** field covering:
  - ICT third-party service / DORA arrangement;
  - non-ICT third-party arrangement under EBA/GL/2026/09;
  - outsourcing subset;
  - intra-group third-party arrangement;
  - subcontracted chain.
- Add / confirm **critical or important function** classification aligned to DORA / EBA definition, while preserving PRA/FCA material outsourcing/material third-party classifications for the UK perimeter.
- Add a **regime applicability matrix** per record: UK PRA/FCA, EU/EBA/DORA, Bank of Italy, group policy.
- Add or validate fields for **third-country provider**, **intra-group provider**, **centralised group monitoring**, **individual entity register extract**, **competent-authority access/audit rights**, **termination rights**, **subcontracting approval/notification**, **exit strategy**, **concentration risk**, **annual policy review**, and **management body approval/oversight**.
- Add a control to flag arrangements supporting critical or important functions where review/documentation is incomplete, pending EBA final application/transitional dates.

## Actions / evidence needed

- Compliance/Legal: confirm the final EBA application date once published/updated and assess whether EBA/GL/2026/09 supersession of EBA/GL/2019/02 affects group outsourcing policy wording.
- OI portal owner: add EU non-ICT third-party risk regime mapping and avoid treating all third-party arrangements as outsourcing only.
- Procurement / Vendor Management: prepare evidence of pre-contractual analysis, risk assessment, due diligence, contractual clauses, subcontracting controls, audit/access rights, termination rights and exit strategies for non-ICT critical/important functions.
- Group Governance: confirm how individual UK and Italian/EU entity registers are extracted from any central register and how intra-group TPSP arrangements are documented.
- Operational Resilience: check concentration-risk reporting across UK MTP/PRA-FCA and EU/EBA non-ICT/DORA dimensions.

## Files created / updated

- Markdown report: `/data/workspace/outsourcing-initiative/04-outputs/regulatory-updates/2026-10-17-weekly-outsourcing-regulatory-update.md`
- PDF report: `/data/workspace/outsourcing-initiative/04-outputs/regulatory-updates/2026-10-17-weekly-outsourcing-regulatory-update.pdf`
- HTML source for PDF: `/data/workspace/outsourcing-initiative/04-outputs/regulatory-updates/2026-10-17-weekly-outsourcing-regulatory-update.html`
- Updated manifest: `/data/workspace/outsourcing-initiative/01-source-regulation/metadata/source_manifest.json`
- Fetch evidence: `/data/workspace/outsourcing-initiative/04-outputs/regulatory-updates/2026-10-17-fetch-results.json`
- New EBA source evidence: `/data/workspace/outsourcing-initiative/04-outputs/regulatory-updates/2026-10-17-new-eba-tprm-added.json`