On 8 October 2026, the Central Bank of Ireland (the “Central Bank”) published Consultation Paper 173 (“CP173”) (PDF, 823 KB), setting out proposed new Guidance on Good Practices for the Sound Management of Third-Party Risks (the “Draft Guidance”). Once finalised, the Draft Guidance will replace the Central Bank’s Cross-Industry Guidance on Outsourcing published in December 2021 (the “2021 Guidance”).

This briefing summarises the key proposed changes, their implications for funds and fund managers, and the practical steps firms should consider. It also highlights actions to take before the consultation closes on 3 December 2026 and ahead of the final Guidance, expected in Q1 2027.

Key takeaways

• Proposed replacement of the 2021 Cross-Industry Guidance on Outsourcing with new cross-sectoral Guidance covering broader third-party risks

• Application to all regulated firms, including fund management companies, with proportionate review of existing outsourcing frameworks and wider third-party arrangements

• Separate treatment of DORA-covered ICT arrangements, with the Draft Guidance applying to non-ICT arrangements and ICT arrangements outside DORA

• Focus areas include contracting standards, governance, concentration risk, offshoring, sub-outsourcing, and intra-group dependencies

• Proposed immediate effect on publication, with final Guidance expected Q1 2027 and firms encouraged to begin scoping and governance reviews now

---

Why the Central Bank is proposing this change

The Central Bank considers that the 2021 Guidance, which was built around traditional outsourcing, no longer fully reflects how firms engage with third parties. Third-party dependencies have broadened significantly to include cloud services, fintech partnerships, joint ventures, data processors, and other arrangements that do not fit neatly within a conventional definition of outsourcing.

The Central Bank’s supervisory work has also identified recurring weaknesses across firms in relation to supplier management, including underdeveloped oversight arrangements, concentration risk, insufficient visibility over intra-group dependencies, offshoring and supervisability concerns, inadequate exit planning, and limited oversight of sub-outsourcing.

At the same time, the regulatory landscape in respect of third-party risk management has moved on. Since 2021, the Basel Committee (Principles for the sound management of third-party risk) (PDF, 275 KB), the Financial Stability Board (Enhancing Third-Party Risk Management and Oversight: A toolkit for financial institutions and financial authorities), the European Securities and Markets Authority (“ESMA”) (ESMA42-1710566791-6103 Principles on third-party risks supervision) (PDF, 508 KB), and most significantly the European Banking Authority (“EBA”) (Guidelines on the sound management of third-party risk regarding non-ICT services) (the “EBA Guidelines”) (PDF, 508 KB) have each issued standards or guidelines on third-party risk, in addition to the Digital Operational Resilience Act (“DORA”) (PDF, 1.5 MB) coming into force, which governs ICT third-party arrangements. The Draft Guidance is intended to align Irish expectations with this wider European direction of travel in respect of third-party risk management, while filling gaps for firms and arrangements that fall outside DORA and the EBA framework.

See also our update on the publication of the final EBA Guidelines: Understanding the EBA’s third-party risk Guidelines.

What is changing

The scope is much broader than “outsourcing”

The Draft Guidance, which will apply to UCITS management companies and AIFMs, moves beyond traditional outsourcing and adopts a broader concept of third-party risk management, encompassing ongoing or recurring arrangements that create reliance on a third-party service provider. Regulated funds should also consider, on a proportionate basis, whether their existing frameworks adequately capture the wider range of third-party arrangements potentially falling within scope. The good practices identified are principally directed at critical or important arrangements, although firms are expected to identify, record and appropriately manage their wider third-party risk universe.

For funds industry participants, this matters because fund management companies and other regulated entities often rely heavily on intra-group and third-party arrangements that may not have previously been assessed as “outsourcing” in the strict sense. Firms may therefore need to bring a broader population of intra-group and third-party service-provider arrangements within their governance framework and policy documentation for third-party risk management. Importantly for funds industry participants, the Central Bank indicates that delegation and outsourcing are not treated as different concepts for third-party risk purposes where the arrangement creates reliance on a third party.

The Draft Guidance also distinguishes intra-group arrangements from arrangements within the same legal entity, such as between branches. The latter are not specifically addressed, although the Central Bank notes that formal arrangements for branches may be appropriate to manage service continuity risks.

The Draft Guidance also reflects the Central Bank’s wider focus on operational resilience, positioning third-party risk management as a core component of firms’ ability to deliver critical services and withstand disruption.

The structure is now outcomes-based and organised by lifecycle

Rather than prescriptive rules, the Draft Guidance sets out sixteen outcomes across five lifecycle stages: 

• Governance and organisational context 
• Due diligence and risk assessment 
• Contracting 
• Ongoing risk management and monitoring 
• Incident and termination management 

Each outcome is supported by “foundational” good practices (the core expectations) and “supporting” good practices (practices that enhance and reinforce the foundations).

This tiered, outcomes-based approach is designed to let firms apply the Guidance proportionately to their nature, scale, complexity, and risk profile, rather than face a one-size-fits-all checklist. In practice, firms will need a clear, documented view of which practices they treat as foundational for their business and how they have exercised judgement in applying the other practices.

Consistent with broader governance expectations, the Draft Guidance emphasises that boards retain ultimate responsibility for risks arising from third-party arrangements and must maintain sufficient oversight, expertise, and substance regardless of the extent of delegation.

Contracting, concentration risk, offshoring and sub-outsourcing receive focused attention

The Draft Guidance sets out a baseline of contractual provisions expected for all third-party agreements, with a further, more detailed set of provisions for arrangements supporting critical or important functions, covering matters such as audit and access rights, data location and data protection, service levels, sub-contracting conditions, termination rights, business continuity testing obligations, and cooperation with the Central Bank.

It also gives dedicated attention to four areas that are especially relevant to fund entities that rely on global administrators, custodians, technology platforms, and group service providers:

• Concentration risk: Firms are expected to assess and manage over-reliance on a single or small number of providers, including substitutability, lock-in risk, and the potential for contagion where multiple firms share the same (or related) providers
• Offshoring: Firms must evaluate jurisdiction-specific risks (regulatory environment, legal and data protection regimes, political and physical climate risk, time zones) and notify the Central Bank in advance where supervisability issues may arise for critical or important functions
• Sub-outsourcing (also referred to as chain outsourcing or sub-contracting): Firms are expected to secure contractual notification and consent rights, retain audit and access rights down the chain, and apply oversight proportionate to the risk presented by sub-outsourcing arrangements
• Intra-group arrangements: Treated in the same manner as external arrangements, with explicit attention to conflicts of interest, over-reliance on group entities, and contingency planning in case group support becomes unavailable. Firms cannot rely on group support to the point of becoming an “empty shell” without adequate local substance and oversight

On negotiating power, the Central Bank has acknowledged industry concern about engaging with large, dominant providers who offer standard, non-negotiable terms. Where a firm cannot secure its preferred protections, it should document its efforts, assess the residual risk, and implement proportionate
mitigating measures.

Record-keeping expectations are more detailed

The Draft Guidance sets out an extensive list of register fields that firms are expected to maintain for their third-party arrangements, with additional fields for arrangements supporting critical or important functions, for example: a substitutability assessment, recovery time and recovery point objectives, sub-contractor details down the chain, audit history, and estimated annual budget cost. Firms that already maintain outsourcing registers may be able to expand and enhance them rather than rebuild them from scratch, although the additional granularity required should not be underestimated.

A notable feature of the Draft Guidance is that it places greater responsibility on firms to determine which arrangements support critical or important functions. While the Draft Guidance provides indicators and examples, firms are expected to develop and document their own methodology, review assessments periodically and justify the approach taken.

Interaction with DORA and the EBA Guidelines

The Draft Guidance is intended to sit alongside, rather than duplicate, other applicable frameworks. DORA already applies detailed requirements to ICT third-party arrangements, while the EBA Guidelines address non-ICT third-party risk for firms within their scope. For funds industry participants, the Draft Guidance will be particularly relevant to non-ICT third-party arrangements and to aspects of third-party risk management that are not addressed in detail under existing sectoral requirements.

This is an important practical point for clients operating in group structures that span banking, investment services, and funds entities. Different entities, and different arrangements within the same entity, may be subject to different combinations of DORA, the EBA Guidelines and the Central Bank’s Draft Guidance.
Firms will therefore need to map the applicable requirements carefully and avoid unnecessary duplication across their third-party risk frameworks.

Status: A non-binding supervisory benchmark

Like the 2021 Guidance, the Draft Guidance is expressed as non-binding good-practice advice and does not create new legal obligations. However, the Central Bank has been clear that firms should not disregard it on that basis. Once finalised, the Guidance will inform supervisory engagement, and firms adopting a different approach should be able to demonstrate to the Central Bank how that approach appropriately manages the relevant risks. In practice, it is therefore likely to operate as the supervisory benchmark against which third-party risk frameworks are assessed.

Why clients should engage now

While the final Guidance is not expected until Q1 2027, clients should consider taking preparatory steps in advance:

• Scoping and mapping work: Firms whose existing frameworks focus principally on traditional outsourcing will likely need to identify and assess a broader population of arrangements (intra-group services, partnerships, technology, and data arrangements) against the new definition. This exercise is substantial for firms with complex group structures or multiple service provider relationships.
• Governance documentation: Firms should consider whether their third-party risk strategy, policy and risk appetite statements, criticality assessment methodology, governance arrangements, and record-keeping templates remain appropriate when assessed against the proposed outcomes and lifecycle structure.
• Contracts review: Firms should begin considering how existing terms used for compliance with the 2021 Guidance may be adapted to assist with any contractual updates required in respect of services arrangements that are not within scope of the 2021 Guidance but will be within scope of the Draft Guidance.
• Regulatory priorities: The CP173 proposals do not exist in isolation. Many firms are already considering how to address the findings and expectations arising from the Central Bank’s recent work on board effectiveness, delegation, and compliance/internal audit functions. Beginning preparations now may enable firms to manage resources, identify overlaps between these initiatives, and avoid a concentration of implementation activity once the new Guidance is finalised.

Suggested next steps

• Identify which combination of frameworks applies to each regulated entity in the group (DORA, the EBA Guidelines, and/or the Central Bank’s Draft Guidance).
• Begin mapping current arrangements, including intra-group and delegation arrangements, against the broader definition of “third-party arrangement” to identify the scale of newly captured relationships.
• Review the firm’s current approach to defining “critical or important” functions, since the Draft Guidance leaves this to each firm’s own methodology, with periodic reassessment as arrangements evolve.
• Assess current registers against the detailed field list in the Draft Guidance and consider whether existing templates can be extended rather than replaced.
• Review the contractual terms of critical or important arrangements that are within scope of the Draft Guidance but not previously subject to the 2021 Guidance and consider how standard contractual terms developed for the purpose of the 2021 Guidance can be leveraged so as to update these arrangements to capture the contractual provisions stipulated by the Draft Guidance (subject to appropriate uplifts to account for the Draft Guidance).
• Identify governance, policy and documentation enhancements that can be progressed now, ahead of the final Guidance.

How we can help

In CP173, the Central Bank has posed 13 specific consultation questions covering scope, proportionality for smaller firms, the outcomes-based structure, implementation costs, and alignment with DORA and the EBA Guidelines. Firms with practical concerns, particularly around the scale of newly captured arrangements or the interaction between frameworks, should consider responding, directly or through an industry association, by 3 December 2026. We can assist you in assessing the consultation questions and preparing or contributing to a response.

We can also assist you with scoping third-party arrangements against the Draft Guidance, drafting or updating third-party risk policies and registers, and benchmarking and updating existing contracts against the proposed contractual provisions of the Draft Guidance. 

Please get in touch with your usual Arthur Cox contact to discuss the Draft Guidance in more detail.