CBI consults on new guidance for managing third-party risk

The Central Bank of Ireland (“CBI”) has published a Consultation Paper (CP173) setting out proposed new Guidance on Good Practices for the Sound Management of Third-Party Risks (the “Guidance”). The Guidance will, once finalised, replace the Cross-Industry Guidance on Outsourcing published in December 2021 (the “2021 Guidance”).

The proposed Guidance significantly broadens the CBI's focus from traditional outsourcing arrangements to a wider range of third-party dependencies, including cloud services, partnerships, joint ventures, fintech collaborations, shared services and other arrangements where firms depend on third parties for services, processes, or functions.

The Guidance reflects the increasing regulatory focus on firms' wider third-party ecosystems and the risks arising from growing reliance on external service providers and technology partners. It follows the recent European Banking Authority (“EBA”) Guidelines on the sound management of third-party risk regarding non-ICT services that were published in September 2026. See our client note on the EBA Guidelines here.

The CBI’s consultation closes on 3 December 2026, with final Guidance expected in Q1 2027.

What arrangements fall within the scope of the Guidance?

The Guidance marks a clear shift from an outsourcing-focused framework to a broader third-party risk management framework. It applies to material third-party arrangements that create a reliance or dependency capable of giving rise to relevant risks, including: outsourcing arrangements (including intra-group arrangements), cloud service providers, partnerships and joint ventures, technology vendors and software providers, data processors, and other arrangements on which firms rely for services, processes or functions.

The Guidance also makes clear that the CBI is focused on the underlying dependency and associated risks rather than the label attached to an arrangement, noting that concepts such as outsourcing, delegation and other third-party arrangements can all create third-party risk requiring effective oversight and management.

For firms whose existing frameworks are built around a narrower outsourcing definition, the broader scope will require them to assess and map which arrangements fall within the revised scope.

Does the Guidance create new obligations for firms?

The Guidance does not introduce new statutory requirements but it will replace the Central Bank’s existing 2021 Cross Industry Guidance on Outsourcing, broadening the framework beyond outsourcing to third-party risk management more generally and potentially increasing firms’ obligations. Firms will therefore need to consider how they manage their arrangements across the wider third-party lifecycle, which covers:

• governance and organisational context – establishing accountability, strategy and policy frameworks;
• pre-engagement – risk assessment and criticality/importance assessment;
• engagement – due diligence, contracting and onboarding;
• ongoing management – oversight, performance and continuity management, risk management, monitoring and assurance; and
• termination – exit planning and execution.

The Guidance is organised around a series of outcomes that firms should seek to achieve across the third-party lifecycle, supported by foundational and supporting good practices that provide practical guidance on how third-party risks can be identified, managed and monitored.

The outcomes cover areas including board oversight, criticality assessments, due diligence, contractual controls, ongoing monitoring, exit planning, business continuity and data governance.

How should firms apply the Guidance when it comes into effect?

Firms are expected to apply the Guidance proportionately, taking into account the firm’s nature, scale and complexity, business model, risk profile and the materiality of its third-party dependencies. Firms can determine whether risks fall within their risk appetite and may depart from a stated good practice where their own approach appropriately manages the relevant risk and satisfies applicable law. However, the Guidance will inform supervisory activities, and the CBI notes that supervisors may discuss with firms how they manage third-party risk and use the Guidance as a source of good practice. Where firms adopt a different approach, they should expect to have to justify this.

The Guidance places particular emphasis on firms identifying which third-party arrangements support “critical or important” functions and services. Firms are expected to develop their own criteria for assessing criticality, keep those assessments under review and apply proportionately stronger controls where disruption could affect core operations, customers or the wider financial system.

How does the Guidance interact with DORA and other ESA Guidelines?

The CBI emphasises that the Guidance is intended to complement, rather than duplicate, existing European frameworks. In particular, it states that where comprehensive third-party risk frameworks already exist, such as those built around the Digital Operational Resilience Act (“DORA”) or European Supervisory Authority (“ESA”) Guidelines (in particular the new EBA Guidelines), the impact for firms is expected to be limited. Instead, the Guidance appears to focus on filling gaps where detailed third-party risk requirements do not already exist. Notwithstanding this, it is a good time for firms to revisit their frameworks to see if any refinements are required particularly as regards the arrangements now in scope.

What should firms be doing now?

The CBI's consultation closes on 3 December 2026 and the final Guidance is expected to be published in Q1 2027. In the meantime, firms can use the consultation period as an opportunity to assess whether their existing third-party risk frameworks remain fit for purpose in light of the Guidance's broader focus on third-party dependencies beyond traditional outsourcing.

In particular, firms should consider:

• Mapping the full population of third-party arrangements, not just those currently classified as “outsourcing”, against the proposed broader scope;
• Reviewing whether existing third-party registers, inventories and governance processes adequately capture information on criticality assessments, locations of service provision, sub-outsourcing arrangements, concentration risks and substitutability;
• Reviewing intra-group arrangements for adequate local substance, oversight and contingency planning;
• Assessing concentration risk exposure, substitutability and exit options for critical or important third parties, including dominant providers where contractual leverage is limited;
• Revisiting offshoring and sub-outsourcing oversight, including notification practices to the CBI for critical or important offshored functions; and
• Assessing whether existing exit plans, business continuity arrangements and testing programmes would allow critical or important services to be transferred to another provider, brought back in-house or otherwise maintained in the event of a third-party failure.

Following the close of the consultation, the CBI will analyse responses, publish a feedback statement, and finalise the Guidance.

If you would like to discuss the potential implications of the proposed Guidance for your organisation, please speak to your usual Simmons & Simmons contact or a member of our Financial Services Regulatory team.