Regulated entities are expected to secure contractual rights for notification and consent regarding any subcontracting within their service chains. This specific requirement forms a cornerstone of the newly published Consultation Paper 173, issued by the Central Bank of Ireland on October 8, 2026. This document introduces a draft version of the Guidance on Good Practices for the Sound Management of Third-Party Risks, which is set to replace the existing cross-industry framework that has been in place since 2021. The shift represents a significant evolution in regulatory philosophy, moving away from a narrow focus on traditional outsourcing toward a comprehensive view of the entire third-party risk landscape. As the complexity of the financial ecosystem grows, the authorities have recognized that reliance on external providers now extends far beyond simple administrative tasks, encompassing critical cloud infrastructure, complex financial technology partnerships, and intricate intragroup service dependencies. Stakeholders have until December 3, 2026, to provide their feedback on these proposals, with the finalized guidance expected to take effect in the first quarter of 2027.
1. Determine Regulatory Scope
The initial phase of compliance involves a rigorous assessment of how various regulatory frameworks intersect with a firm’s specific business model. In the current landscape of 2026, regulated entities must navigate a multilayered environment where the Digital Operational Resilience Act, the European Banking Authority guidelines, and the Central Bank’s local guidance may all apply simultaneously. This determination is not a simple checklist exercise; it requires a deep dive into the nature of every service utilized. For instance, information and communication technology arrangements fall under the strict mandates of DORA, while non-ICT services, such as professional consulting or specialized asset management support, might be governed by the EBA or the Central Bank’s new draft guidance. Firms must clearly delineate which framework takes precedence for each relationship to avoid conflicting compliance efforts or operational redundancies that could lead to oversight gaps.
Building on this structural assessment, organizations operating within complex group structures face additional layers of complexity that require precise mapping. Many funds and fund managers rely on shared service centers or global group functions that provide everything from compliance monitoring to technical infrastructure. The draft guidance makes it clear that these intragroup arrangements are to be treated with the same level of scrutiny as external third-party contracts. Firms must evaluate whether their current governance maps accurately reflect these dependencies and ensure that they do not inadvertently become an empty shell by relying too heavily on group entities without maintaining sufficient local substance and expertise. This scoping exercise must be documented thoroughly, as the Central Bank expects a clear rationale for how a firm has categorized its various service providers and which specific rulesets are being applied to manage the associated risks.
2. Catalog Current Relationships
The second critical step involves a comprehensive inventory of all external and internal service arrangements, utilizing a much broader definition of what constitutes a third-party risk. In the past, many organizations focused primarily on traditional outsourcing, often overlooking recurring service contracts, fintech collaborations, or data processing agreements that did not fit the classic mold. The 2026 guidance shifts the focus to any arrangement that creates a reliance on a third party for the continuous delivery of a firm’s business activities. This necessitates a proactive sweep of all active contracts to identify hidden dependencies, particularly those involving cloud-native services or specialized software platforms that have become integral to daily operations. By capturing these relationships in a centralized database, firms can begin to see the true scale of their operational footprint and identify potential points of failure that were previously invisible under narrower definitions.
This cataloging process naturally extends to the often-opaque world of subcontracting and chain outsourcing, where the primary service provider delegates portions of their responsibility to other entities. The Central Bank’s focus on the entire service chain means that firms can no longer simply monitor their direct vendor; they must have visibility into the secondary and tertiary providers that support critical functions. This exercise reveals the complexity of modern supply chains, where a single failure deep in the technical stack could have a cascading effect on a regulated firm in Ireland. Firms must work with their primary partners to extract this information, ensuring that every link in the chain is accounted for and categorized according to its impact on the firm’s resilience. This holistic view is essential for managing concentration risk, as it allows firms to see if multiple distinct providers are actually relying on the same underlying infrastructure, such as a specific cloud availability zone.
3. Refine Criticality Assessment Methods
A fundamental requirement of the new guidance is the development of a documented methodology for determining which third-party arrangements are critical or important. Unlike previous years where firms might have relied on generic industry templates, the Central Bank now expects each entity to define its own logic based on its specific risk profile, scale, and nature of operations. This methodology must go beyond financial metrics, looking instead at the potential impact of a service disruption on the firm’s operational resilience and its ability to continue providing services to investors or the wider market. Managers must consider factors such as the ease of substitutability, the duration of time the firm could survive without the service, and the potential for legal or reputational damage. By establishing a robust, repeatable process for these assessments, firms can ensure that their most significant risks receive the highest level of executive oversight and monitoring.
Once the methodology is established, it must be applied consistently and reviewed at regular intervals or whenever a significant change occurs in the business environment. The 2026 draft guidance emphasizes that a service which was considered non-critical at the start of a contract might become vital as the firm grows or as the service provider’s role evolves. For example, a data analytics tool that begins as a niche research aid might eventually become a core component of the investment decision-making process. Firms are expected to justify their decisions to the regulator, demonstrating that they have exercised sound judgment in identifying which relationships require enhanced due diligence and more stringent contractual protections. This ongoing refinement of criticality ensures that the firm’s risk management efforts remain proportional and focused on the areas where a failure would cause the most significant harm to the organization or its clients.
4. Evaluate Record-Keeping Systems
The Central Bank has significantly increased the expectations for the granularity of data that must be maintained in a firm’s third-party risk register. Current systems, many of which were designed to meet the 2021 standards, likely fall short of the detailed field requirements proposed in the 2026 draft. New fields now encompass specific details such as recovery time objectives, recovery point objectives, and the full audit history of the relationship. Furthermore, firms must now record the estimated annual budget cost for each arrangement and provide a detailed substitutability assessment for every critical function. This shift requires an evaluation of existing data management systems to determine if they can be expanded to accommodate these new data points or if a more modern, integrated technological solution is required to manage the volume and complexity of the information.
Beyond the technical capacity to store data, firms must ensure the accuracy and accessibility of the information within these registers to facilitate effective reporting. The draft guidance implies that these registers should not be static spreadsheets updated once a year, but rather dynamic tools that inform risk-based decision-making. For critical or important arrangements, the register must also include detailed information about subcontractors down the entire service chain, including their geographical locations and the legal jurisdictions governing those sub-agreements. This level of detail is intended to give both the firm’s board and the Central Bank a clear picture of where data resides and where operational vulnerabilities might exist. Ensuring that these records are kept up to date requires a clear internal process for data collection, involving procurement, legal, and operational teams to feed information into a central, authoritative source.
5. Audit Service Agreements
Reviewing and updating legal agreements is perhaps the most labor-intensive aspect of aligning with the new guidance, as it requires a detailed audit of existing terms against the Central Bank’s baseline expectations. For arrangements supporting critical or important functions, the guidance specifies a suite of mandatory provisions, including clear audit and access rights, stringent data protection requirements, and well-defined termination rights. Firms must examine their current portfolio of contracts to identify gaps, particularly in older agreements that may lack specific language regarding business continuity testing or cooperation with the regulator. This audit serves as a roadmap for upcoming negotiations, allowing legal teams to prioritize the most essential updates and develop a strategy for bringing all high-stakes relationships into compliance with the 2027 standards.
During this audit process, firms often encounter challenges when dealing with large, global service providers that offer non-negotiable, standardized terms. The 2026 draft guidance acknowledges this power imbalance but places the responsibility on the regulated entity to document its efforts to secure necessary protections. Where a firm cannot achieve its preferred contractual terms, it must perform a residual risk assessment and implement additional internal controls to mitigate the potential impact. This might involve more frequent monitoring, the development of more robust internal exit strategies, or the use of redundant service providers to reduce the risk of a single point of failure. By documenting these efforts and the resulting mitigation strategies, firms demonstrate to the Central Bank that they are actively managing their risks even when they lack the leverage to dictate every term of a service agreement.
6. Enhance Internal Governance
The final pillar of the preparation strategy involves aligning the firm’s internal governance structures with the lifecycle model proposed in the draft guidance. This model spans five distinct stages: governance and context, due diligence, contracting, ongoing monitoring, and incident management. Boards of directors and senior management are expected to take an active role in overseeing this lifecycle, ensuring that the firm’s third-party risk strategy is fully integrated into its broader operational resilience framework. This requires a review of existing policies and risk appetite statements to ensure they reflect the broadened scope of the 2026 definitions. Furthermore, firms must verify that they have the necessary expertise within their ranks to effectively challenge and oversee their service providers, maintaining sufficient substance to avoid any perception of being a mere pass-through entity.
Management previously finalized the necessary adjustments to their internal reporting lines to ensure that third-party risks reached the appropriate level of visibility. They implemented refreshed training programs for staff involved in procurement and vendor management, emphasizing the shift toward an outcomes-based regulatory approach. The board approved an updated set of key performance indicators that tracked not just service availability, but also the resilience of the entire subcontracting chain. These actions ensured that the organization moved beyond a compliance-centric view of outsourcing toward a holistic, risk-based culture. By the time the finalized guidance was published in early 2027, the groundwork had been laid to transform third-party risk management from a back-office function into a strategic asset that safeguarded the firm’s stability and supported its long-term growth objectives.
