The European Banking Authority (EBA) has issued new guidelines on third-party arrangements supporting critical or important functions, as part of efforts to simplify the EU banking sector’s regulatory framework.

The guidelines focus on arrangements where disruption could materially impair the performance of a financial entity, allowing regulators and institutions to concentrate resources on higher-risk activities.

The approach is intended to reduce unnecessary operational and supervisory burdens associated with less material third-party arrangements while maintaining sound risk management.

The guidelines cover both ICT and non-ICT services, taking a holistic approach to third-party risk management.

They apply across the full lifecycle of third-party arrangements, including risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies.

The EBA said the final guidelines reflected feedback received from stakeholders during a public consultation, as well as input gathered through targeted outreach activities.

The framework also takes into account international standards, including the Basel Committee on Banking Supervision’s Principles for the Sound Management of Third-Party Risk.

A two-year transitional period will be provided to support implementation and allow institutions and supervisors to adapt to the new requirements in a smooth and proportionate manner.

The guidelines have been developed under Directive 2013/36/EU, which requires the EBA to further harmonise governance arrangements, processes and mechanisms across institutions in the European Union.

The EBA also took into account several other pieces of EU legislation when developing the final guidelines.

These include the second Payment Services Directive, as well as the Investment Firms Directive.

The legal basis also includes the Markets in Financial Instruments Directive and the Markets in Crypto-Assets Regulation.

In addition, the regulation establishing the EBA was taken into account in preparing the final guidelines.

The new framework is intended to provide a more proportionate approach to third-party risk by directing greater attention towards arrangements that support functions whose disruption could have a significant impact on financial institutions.