Central Bank of Ireland seeks feedback on new third-party risk management guidance

The proposed guidance expands the current framework from traditional outsourcing to encompass all material third-party relationships that could pose potential risks. It includes various categories such as outsourcing arrangements, intra-group arrangements, cloud service providers, partnerships, joint ventures, technology and software vendors, as well as data processors and any other dependencies that result in reliance on third parties.

This guidance, while non-binding, emphasizes achieving certain outcomes rather than imposing strict requirements. It is organized by the lifecycle of third-party relationships, addressing governance, pre-engagement risk assessment, due diligence, ongoing management, and the termination process.

The guidance categorizes good practices into two tiers: foundational practices essential for effective third-party risk management, and supporting practices that enhance these foundational measures. The Central Bank believes this tiered approach enables firms to implement the guidance proportionately, focusing their resources on relationships that pose significant risks.

Different types of firms are expected to benefit variably from this guidance. For example, credit and payment institutions already adhering to the Digital Operational Resilience Act (DORA) might find only limited additional insights in the new guidance. Conversely, provisions for other firms, such as insurance companies and retail credit firms, may lack detailed compliance guidelines, which the new guidance aims to address.

On the subject of proportionality, the Central Bank stresses that firms should tailor the application of the guidance according to their size, internal structure, and the complexity of their dependency relationships. It notes that a small firm with few outsourcing arrangements will have a simpler framework compared to a larger entity with numerous dependencies.

The paper also addresses intra-group arrangements, recognizing that firms often rely on their group entities. It outlines considerations regarding potential conflicts of interest, concentration risk due to reliance on group entities, service level agreements, and governance issues, as well as contingency planning for scenarios where group support may not be accessible.

While acknowledging that intra-group arrangements carry distinct risks, the Central Bank insists that firms must ensure sufficient local oversight and capabilities, rather than becoming “empty shells” reliant solely on group support. Firms must maintain visibility and control over outsourced functions and establish robust contractual and performance monitoring arrangements.

The proposed guidance is informed by several established frameworks, including the Basel Committee's principles, the Financial Stability Board's toolkit, and relevant European guidelines on third-party risk management.

The consultation poses 13 specific questions, including the appropriateness of non-binding guidance, the clarity of the proposed scope, and challenges smaller firms may encounter during implementation. The Central Bank indicates that this initiative is part of its regulatory simplification agenda and builds on its findings published in December 2025 aimed at improving regulatory frameworks. Responses to the consultation can be submitted via email at [email protected].