Home›EBA Third-Party Risk Management
EBA/GL/2019/02 — EU Credit Institutions & Investment Firms

EBA Outsourcing Guidelines:
The Compliance Register Built In

The EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02) require EU financial institutions to maintain a comprehensive outsourcing register, conduct documented due diligence, and produce it for supervisors on request. VendorAuditly is the outsourcing register — live, audit-ready, and always current.

Build your EBA register free → Register requirements
EBA/GL/2019/02 — What supervisors check

EBA outsourcing register — what it must contain

The EBA outsourcing register is the centrepiece of EBA compliance. Supervisors can request it at any time. The guidelines specify exactly what fields it must include — for every outsourcing arrangement, whether critical or not.

Register field What it requires VendorAuditly
Arrangement type Category of service outsourced (IT, compliance, operations) ✓ Vendor category
Critical / important flag Whether the function is classified as critical or important (C/I) under EBA definition ✓ Risk tier (Critical/High)
Service provider details Legal name, registration number, LEI, country of establishment ✓ Vendor profile
Contract start & end dates Date arrangement began, contract expiry, renewal notice period ✓ Contract tracking
Data storage countries Countries where data is processed or stored, including sub-processors ● Manual entry
Last review date Date of most recent assessment or review of the arrangement ✓ Assessment history
Exit strategy Evidence of exit/contingency plan for critical or important functions ● Actions tracker

● = supported via manual entry or actions. ✓ = auto-populated from VendorAuditly data.

EBA classification

Critical or important functions — the EBA distinction that matters most

EBA guidelines apply to all outsourcing arrangements, but they impose significantly enhanced requirements on anything classified as a “critical or important function.” Getting this classification right is where most institutions need to focus.

The definition

What makes a function “critical or important” under EBA

A function is critical or important if: a defect or failure in its performance would materially impair the firm’s compliance with regulatory requirements, financial performance, or the soundness or continuity of its services to customers. Cloud infrastructure, core banking, payments processing, and compliance monitoring services will almost always qualify.

Supervisors expect all cloud services to be assessed for C/I classification
Enhanced requirements for C/I functions

What EBA requires additionally for critical or important outsourcing

For C/I outsourcing you must: notify the competent authority before entering the arrangement, conduct deeper pre-contract due diligence (financial stability, security certifications, sub-contractor mapping), include specific contract provisions (audit rights, regulatory access, termination rights), establish an exit strategy, and conduct at least annual reviews with documented outcomes.

Sub-outsourcing

Fourth-party risk — EBA’s sub-outsourcing requirements

EBA requires that when a service provider sub-outsources part of a critical or important function, the institution must be notified and must assess whether the sub-provider meets the same standards. Contracts must include provisions giving the institution visibility into the sub-outsourcing chain. This is now reinforced by DORA’s ICT concentration risk requirements.

EBA & DORA overlap

How EBA guidelines and DORA interact in practice

From January 2025, DORA creates a specific framework for ICT third-party risk that sits alongside EBA outsourcing guidelines. For ICT service providers, DORA Article 28 requirements are the primary framework. For non-ICT outsourcing (legal services, facilities, HR), EBA guidelines continue to apply independently. Most institutions need to manage both — and the outsourcing register must reflect both frameworks. See our DORA vendor management guide for ICT-specific requirements.

EBA compliance coverage

What VendorAuditly covers — and what it doesn’t

VendorAuditly automates the outsourcing register and evidence generation. Here is exactly what it covers against EBA requirements — and where manual input is still needed.

Automated by VendorAuditly
✓Live outsourcing register with all required fields
✓Risk tier classification (Critical / High / Medium / Low)
✓Pre-contract due diligence questionnaires with timestamps
✓Contract expiry tracking with 90/60/30-day alerts
✓ISO 27001 & SOC2 certificate storage and expiry monitoring
✓Continuous breach watchlist & website monitoring
✓Annual review scheduling with dated evidence records
✓One-click evidence pack for supervisor submission
Still requires manual input
●Data storage countries for each provider
●Supervisor notification for new C/I outsourcing
●Exit strategy documentation for critical functions
●Sub-outsourcing chain mapping per critical provider
●Legal review of contract provisions against EBA requirements

VendorAuditly automates the operational burden of EBA outsourcing compliance — the register, the due diligence, the monitoring, and the evidence generation. The legal and governance decisions (C/I classification, supervisor notification, exit strategies) remain with your compliance team, but are supported by the evidence VendorAuditly produces.

Common questions

EBA outsourcing guidelines — FAQ

What are the EBA outsourcing guidelines for third-party risk?
The EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02) require EU credit institutions and investment firms to maintain a register of all outsourcing arrangements, conduct risk assessments before entry, implement contractual safeguards, and review outsourced functions periodically. Critical or important function outsourcing requires enhanced oversight including supervisor notification.
Who do EBA outsourcing guidelines apply to?
EBA outsourcing guidelines apply to credit institutions, investment firms, and payment institutions across EU member states. They are implemented through national competent authority rules in each country. For ICT outsourcing specifically, DORA (effective January 2025) now provides a more specific overlay. Most firms need to comply with both — see the EBA/DORA interaction section above.
What is the EBA outsourcing register requirement?
EBA requires a comprehensive register of all outsourcing arrangements including: arrangement type, critical/important classification, service provider legal details, contract start and end dates, data storage countries, last review date, and exit strategy evidence. The register must be available to supervisors on request — typically produced within 24–48 hours of a supervisory request.
How do EBA guidelines interact with DORA for vendor risk?
DORA (effective January 2025) creates a specific ICT third-party risk framework that applies alongside EBA outsourcing guidelines. For ICT service providers, DORA Article 28 requirements take precedence. For non-ICT outsourcing, EBA guidelines continue to apply independently. Most financial institutions maintain a single outsourcing register that captures both frameworks — exactly what VendorAuditly supports.
How does VendorAuditly support EBA outsourcing compliance?
VendorAuditly maintains a live outsourcing register with risk classification, records pre-contract due diligence with timestamps, tracks contract provisions and certificate expiry, schedules periodic reviews, and generates evidence packs for supervisor reviews — covering EBA outsourcing register requirements and DORA Article 28 in one platform at $49/month.

Related guides

EBA/GL/2019/02 — outsourcing register ready

Your EBA outsourcing register, always audit-ready

Live register, timestamped due diligence, contract tracking, and one-click evidence pack for supervisor submissions — at $49/month.

Start free →

No credit card required. Register built in under an hour.