On 8 October 2026, the Central Bank of Ireland (CBI) opened a consultation on draft ‘Guidance on Good Practices for the Sound Management of Third Party Risks’ (Draft Guidance) (see the consultation paper and Draft Guidance). When finalised, the Draft Guidance will replace the CBI’s existing Cross-Industry Guidance on Outsourcing (December 2021) (Existing Guidance). The consultation period will close on 3 December 2026.
Background
The CBI considers that updated guidance is necessary for several reasons:
to reflect the increasing reliance on third-party arrangements for a wide range of services and the related concentration risk
to ensure consistency with EU and international guidelines and standards, including for example, the European Banking Authority’s recently published final report on ‘Guidelines on the Sound Management of third-party risk related to non-ICT services’, the European Securities and Markets Authority’s ‘Principles on third-party risk supervision’ and the Digital Operational Resilience Act (DORA)
to provide clear guidance that is based on a proportionate and outcomes-based approach
to ensure that third-party risk management is more explicitly integrated within firms' operational resilience frameworks
to further the CBI’s commitment to regulatory and supervisory simplification
The CBI expects boards, senior management and relevant staff within regulated firms to consider the Draft Guidance within their firm’s operations, including staff involved in the oversight, management, risk management, or provision of third-party services.
Scope of the consultation
The CBI is seeking views on:
the Draft Guidance
the regulatory impact assessment relating to the Draft Guidance (section 2 of the consultation paper)
the CBI’s response to specific concerns raised by industry regarding the Existing Guidance (section 4 of the consultation paper)
Implementation timeframe
The CBI intends to publish the new guidance in final form in Q1 2027 and to apply it from the date of publication.
Key features of the Draft Guidance
The consultation paper states that the Draft Guidance builds on and clarifies, rather than fundamentally changes, the Existing Guidance. Firms already subject to European Supervisory Authority guidelines will find significant alignment.
Key features of the Draft Guidance include:
Holistic scope: The Draft Guidance applies to outsourcing arrangements and other third-party arrangements that create a reliance by a regulated firm on a third party, including, for example, partnerships and joint ventures.
Outcomes-based approach: Instead of prescriptive expectations, the Draft Guidance is structured in discrete blocks of outcomes to be achieved and examples of good practices that allow firms to benchmark the maturity of their risk management practices.
Lifecycle perspective: The Draft Guidance is sequenced to align with the lifecycle of outsourcing and third-party arrangements. The blocks of outcomes and good practices are set out under separate sections that cover governance, due diligence and risk assessment, contracting, risk management and monitoring, and incident and termination management.
Tiered good practices: The examples of good practices are presented in two tiers:
Foundational good practices (core practices that form the foundation of sound third-party risk management).
Supporting good practices (additional practices that enhance and support the foundational practices).
A tiered approach is intended to support proportionate application, allowing firms to prioritise foundational practices while implementing supporting practices as appropriate to the nature, scale and complexity of their business.
Key enhancements from the Existing Guidance
The Draft Guidance enhances the Existing Guidance in several ways:
Broader scope: Covers all third-party arrangements, not just outsourcing.
Outcomes-based structure: Focuses on desired outcomes rather than prescriptive expectations. Designed to be flexible.
Operational resilience integration: Explicit linkages to operational resilience frameworks.
Proportionality: Clearer articulation of how firms can apply the guidance proportionately. Firms should consider the good practices in a manner proportionate to their nature, scale and complexity, business model, risk profile and the nature and materiality of their third-party dependencies.
International alignment: Consistency with evolving EU and international standards.
Comment
Firms should consider benchmarking their current third-party risk management practices against the foundational and supporting good practices in advance of the CBI’s intended publication of the final guidance in Q1 2027, given that it is expected to apply from the date of publication. Our Financial Regulation Advisory team would be happy to assist firms in assessing their existing frameworks against the Draft Guidance or in preparing a response to the consultation.
If you would like to discuss a gap analysis or how the Draft Guidance may affect your firm, please contact Eoin O’Connor, Partner, Patrick Brandt, Partner, Eimear O’Brien, Partner, Louise Hogan, Partner, Sarah Lee, Senior Practice Development Lawyer or your usual ALG contact.
Date published: 13 October 2026
