The Central Bank of Ireland (“Central Bank”) has proposed new, non-binding guidance (“Guidance”) that will replace its 2021 outsourcing guidance and significantly widen the net, covering not just traditional outsourcing but any material third-party arrangement that creates a dependency, from cloud providers to data processors to intra-group arrangements.
The move responds to supervisory concerns about concentration risk and weak oversight, and aligns Ireland with recent international standards from the Basel Committee, the Financial Stability Board, the European Banking Authority, the European Securities and Markets Authority and DORA. Firms have until 3 December 2026 to respond, with final guidance expected in Q1 2027.
Why third-party risk management matters for regulated firms
Outsourcing has become central to how regulated firms operate, but reliance on a shrinking pool of key providers, particularly in cloud computing and artificial intelligence, has become a growing supervisory concern. The Central Bank’s own supervisory work has continued to flag recurring weaknesses, including underdeveloped oversight, limited visibility of intra-group dependencies, offshoring and sub-outsourcing risks, and weak exit planning.
What is changing under the Central Bank’s third-party risk guidance?
- A broader scope, reaching beyond traditional outsourcing to any material arrangement creating reliance or dependency, including cloud services, partnerships, joint ventures, technology vendors and data processors;
- An outcomes-based approach, setting out what good practice looks like rather than prescriptive rules, so firms can tailor compliance to their own risk profile;
- A lifecycle structure, following arrangements from governance and pre-engagement through to contracting, ongoing monitoring and termination;
- Tiered practices, distinguishing core practices from supporting good practices, to allow proportionate application across firms of different sizes; and
- Closer alignment with international standards, including the Basel Committee’s principles, the FSB toolkit, EBA and ESMA guidance, and DORA.
Will the new third-party risk guidance create legal obligations?
The Guidance remains non-binding. The Central Bank carried out a regulatory impact assessment and concluded that updated, comprehensive guidance strikes the right balance between clarity and flexibility, rather than introducing binding rules or relying solely on European measures. Firms whose current frameworks focus mainly on traditional outsourcing may, however, face some one-off work in identifying and assessing their wider web of third-party dependencies.
What should regulated firms do to prepare for the new guidance?
The consultation is open until 3 December 2026, with an industry workshop planned and bilateral meetings available on request. Firms should start mapping their third-party arrangements against the proposed scope now, so they are ready to respond to the consultation and to adapt once final guidance is published, expected in the first quarter of 2027.
Read our full update on CP173 for a detailed breakdown of the 16 good practices, the consultation questions and the Central Bank’s response to industry concerns.
