In October 2026 the Central Bank of Ireland published Consultation Paper CP173, proposing new Guidance on Good Practices for the Sound Management of Third-Party Risks. The consultation closes on 3rd December 2026 with final guidance expected in Q1 2027. It is proposed that it will take effect on publication, at which point the 2021 Cross-Industry Guidance on Outsourcing is withdrawn. This is a consultation draft so details may change.
The scope is any arrangement under which a third party provides services or support on an ongoing or recurring basis. That includes cloud providers, partnerships, joint ventures and intra-group providers. The Central Bank treats "delegation" and "outsourcing" as the same concept, so relabelling an arrangement doesn't take it out of scope. No transition period is proposed though the Central Bank's position is that the good practices are a continuation of existing expectations.
The guidance says "should " throughout and firms can take a different approach if it manages the risks and meets their legal obligations. The Central Bank may still ask firms to show they've considered these topics and it will intervene where risks are high enough. Firms already subject to DORA or the EBA's binding non-ICT guidelines will find limited extra content.
The stages are:
• governance
• due diligence and risk assessment
• contracting
• ongoing risk management and monitoring
• incident and termination management
Each outcome has foundational practices (the core) and supporting practices (enhancements). The practices apply mainly to critical or important arrangements but firms should apply them more widely where their own risk assessment says that's prudent.
A service qualifies where its failure, directly or indirectly, would stop the firm carrying out core operations or serving customers, or would harm the normal functioning of the financial system. There is no formula and firms need a documented methodology, applied consistently and reviewed periodically, and should watch for reliance that grows over time.
Boards remain responsible for third-party risk strategy, risk appetite and oversight. They should ensure there is a documented strategy aligned to the business, a policy setting out roles and classification criteria and the skills to oversee technical arrangements such as cloud. Supporting practices include designating an individual, function or committee accountable to the board, and giving the board enough management information to challenge.
Before entering an arrangement, firms should assess risks including sub-outsourcing, sensitive data, concentration, offshoring, business continuity, step-in risk (having to prop up a failing provider) and legal, regulatory and reputational exposure. Due diligence should cover the provider's financial health, security, authorisation, group structure and conflicts of interest, reputation and litigation, and insurance. Diligence should be refreshed during the contract and before renewal with enough time to renegotiate or exit.
All third-party agreements should include:
• a clear service definition and dates
• whether sub-contracting is allowed and on what conditions
• service and data locations, with advance notice of changes
• data availability, integrity and confidentiality
• measurable SLAs with details on monitoring and access rights
• cooperation with authorities
• termination rights and notice periods
For critical or important functions , agreements should also cover:
• KPI reporting
• prompt notice of material developments
• audit and access rights for the firm and the regulator
• conditions and monitoring for sub-contractors
• tested business continuity plans
• exit arrangements
• data recovery if the provider fails
Firms should keep a complete, current register of all third-party arrangements. It should include provider identity (including LEI), service and data locations, whether personal data is involved, and whether the arrangement is critical or important along with supporting rationale. For critical arrangements it should also record:
• approver and governing law
• audit and diligence dates
• the sub-contractor chain
• a substitutability rating (from "not substitutable" to "easily substitutable")
• recovery objectives
• alternative providers
• continuity and exit test dates
Firms should maintain it in the Central Bank's template format.
• Sub-outsourcing - Firms should document their appetite for it and shouldn't agree to it unless the sub-contractor complies with the law and gives the same access and audit rights as the primary provider. Prior approval of sub-outsourcing should be built into contracts.
• Concentration - The guidance covers dependence on one provider, multiple services at the same provider, a single geographic region and several providers sharing the same fourth party. Firms aren't expected to avoid dominant providers. If they can't secure ideal terms, they should assess the residual risk, consider alternatives and put proportionate mitigations in place.
• Intra-group - The same rigour applies as for external providers. Arrangements should be at arm's length with conflicts of interest provided for. Where group assessments or exit plans are relied on, the local firm should receive a summary and be satisfied they work for it.
• Offshoring - It isn't specifically discouraged but firms should assess regulatory, legal, political, climate, cultural and time-zone risks, and must never enter arrangements that impede supervision. Contracts should give the firm and its regulator access for quality assurance and supervisory work.
For critical arrangements, firms should have a documented, viable and regularly tested exit strategy. It should cover:
• impact tolerances
• substitutability
• the option of bringing the service back in-house and the skills to do so
• an estimated transfer timeframe
• interim contingency arrangements
• step-in risk
Providers of critical services should test their own continuity plans at least annually. Firms should be able to take part in that testing, receive the results and act on weaknesses. On data, firms should have a documented data management strategy including a clear split of responsibilities for cloud services, encryption keys accessible to the firm and its regulator, offline backups, and deletion of data after exit.
• Conduct a high-level gap analysis against the consultation paper
• Check whether your register captures what the draft expects.
• Test your critical or important methodology against the draft's wording.
• Review sub-outsourcing, audit and exit provisions in key contracts.
• Decide whether to respond before 3 December. Submissions go to TPRMConsultation@centralbank.ie
