EBA updates its approach to banks' outside service providers

The announcement

The EBA published final guidelines on third-party risk management on 18 September. The announcement concentrates on arrangements supporting critical or important functions, where disruption could materially impair a financial entity.

The guidelines address the relationship from assessment and contracting through monitoring and exit planning, across ICT and non-ICT services. The EBA describes a two-year transitional period and alignment with the broader DORA framework.

What it means for account customers

Customers usually see a bank's brand and app, rather than its supplier network. A polished interface therefore cannot answer every question about how the service would respond to a disruption.

Our view: compare usable support and recovery routes alongside fees. Ask where service notices appear and how to reach the provider if the normal app is unavailable. These guidelines concern institutions' risk management; they are not evidence that a particular bank has suffered an outage or that a named supplier is unsafe.

This article distinguishes the source announcement from BankRanking's editorial interpretation. It does not rank or endorse a product.