The Central Bank of Ireland (CBI) have commenced, in October 2026, a consultation on “Draft Guidance on Good Practices for the Sound Management of Third-Party Risks”. The consultation is presented as CP173 with the draft guidance published as an annex. The consultation will close on 3 December 2026 and CBI are anticipating the publication of final guidance in Q1 2027. On publication of the Guidance in Q1 2027, it is intended that the 2021 cross sectoral guidance on outsourcing will be withdrawn.

This guidance is intended to address all third party relationships that create reliance or dependency. It is thus broader in scope than the 2021 guidance on outsource arrangements and is closer aligned to the DORA type requirements as currently applied to ICT 3rd party arrangements.

The Guidance has been sequenced to appropriately reflect the identification of, and engagement by, firms with third parties and the subsequent management of those relationships. The Guidance is presented in discrete blocks of outcomes to be achieved, and practices that allow firms to benchmark the maturity of their own risk management practices. These are addressed across the following headings:

  • Governance & Organisational Context
  • Risk Management and Due Diligence
  • Contracting
  • On-going Risk Management & Monitoring
  • Incident & Termination Management

The proposed Guidance will be non-binding however, the supervisory approach is likely to expect that firms have had regard to the best practice and can explain any divergence from same.

The Guidance also includes a section on specific considerations for intra-group arrangements including:

  • Potential conflicts of interest between group and local entity priorities;
  • Concentration risk from over-reliance on group entities;
  • Need for appropriate service level agreements and governance;
  • Contingency planning for scenarios where group support may not be available; and
  • Regulatory differences between group and local entities e.g. GDPR.

Guidance is also provided on the oversight and risk management of sub-outsourcing.