The Central Bank of Ireland publishes consultation paper CP173, seeking views on proposed Guidance on Good Practices for the Sound Management of Third-Party Risks. The guidance would replace the Cross-Industry Guidance on Outsourcing, published in December 2021. Responses close on 3 December 2026. The proposed guidance broadens the scope of the existing regime from traditional outsourcing to all material third-party arrangements that create a reliance or dependency capable of giving rise to relevant risks. Named categories are outsourcing arrangements, including intra-group arrangements, cloud service providers, partnerships and joint ventures, technology vendors and software providers, data processors, and other dependencies that create reliance on third parties. The guidance would be non-binding. It is structured around outcomes to be achieved rather than prescriptive requirements, and is sequenced across the lifecycle of a third-party arrangement, covering governance and organisational context, pre-engagement risk and criticality assessment, engagement through due diligence and contracting, ongoing management, and termination and exit. Good practices are presented in two tiers. Foundational good practices are described as core to sound third-party risk management, and supporting good practices as additional measures that enhance them. The Central Bank says the tiering is intended to support proportionate application by allowing firms to prioritise. The guidance distinguishes between the firms it expects to benefit from it. It states that credit institutions and payment institutions complying with the Digital Operational Resilience Act (DORA) for information and communications technology third-party risk, and with the European Banking Authority guidelines for third-party risk outside DORA, "may find that this Guidance provides only limited additional insight". It adds that the provisions applicable to other firms, "for example, insurance undertakings or retail credit firms, among others", may contain high-level obligations to manage risks "without sufficient descriptive provisions showing how those obligations can be complied with in practice", and that the guidance "seeks to bridge that gap". On proportionality, the Central Bank says firms should apply the guidance in a manner appropriate to their size, internal organisation and the nature, scope and complexity of their dependencies, and should focus resources on arrangements presenting material risks. It states that "a small firm with one or two outsourcing arrangements will have a much simpler framework than a large, complex firm with extensive third-party dependencies", and that both can achieve sound third-party risk management through approaches tailored to their circumstances. The paper addresses intra-group arrangements separately. It acknowledges that firms may rely on group entities for support and that group oversight mechanisms may provide some assurance, and sets out specific considerations including potential conflicts of interest between group and local entity priorities, concentration risk from over-reliance on group entities, service level agreements and governance, contingency planning for scenarios where group support may not be available, and regulatory differences between group and local entities. The Central Bank states that while intra-group arrangements may present different risks, "firms must maintain sufficient substance and cannot become ‘empty shells’ relying entirely on group support without adequate local oversight and capability". It says firms must maintain clear visibility and control over outsourced functions, with robust contractual arrangements, performance monitoring and contingency plans. The guidance draws on the Basel Committee on Banking Supervision principles for the sound management of third-party risk, the Financial Stability Board toolkit on enhancing third-party risk management and oversight, the European Banking Authority guidelines on sound management of third-party non-ICT risk, European Securities and Markets Authority principles on third-party risks supervision, and DORA requirements where applicable. The consultation poses 13 questions. These cover whether non-binding guidance is preferable to binding requirements, whether the proposed scope covering all arrangements that create reliance or dependency is correct, whether the outcomes-based structure and the foundational and supporting tiers are clear and helpful, whether the guidance gives sufficient clarity for firms of different sizes, what specific challenges smaller firms may face in implementing it, and whether its relationship with DORA and the European Banking Authority guidelines is sufficiently clear. The Central Bank says the work forms part of its regulatory simplification agenda, and that its December 2025 publication Regulating and Supervising Well: a more effective and efficient framework identified the need to update the 2021 outsourcing guidance. Responses should be submitted to TPRMconsultation@centralbank.ie.
