The Outsourcing (EBA) module tracks the duties a financial entity owes when it relies on third parties for non-ICT services, under two instruments: the EBA Guidelines on the sound management of third-party risk regarding non-ICT services (EBA/GL/2026/09), published in final form on 18 September 2026, and the Central Bank of Ireland Cross-Industry Guidance on Outsourcing of December 2021. The Guidelines replace EBA/GL/2019/02 for non-ICT services, widen the object from "outsourcing" to "third-party arrangement", and line their register, policy and contract clauses up with DORA so that one holistic third-party framework is possible. The Central Bank guidance was written on top of the 2019 Guidelines and still cites their paragraph numbers; the module carries the concordance for you.
Who is in scope: credit institutions, investment firms, payment institutions and electronic money institutions under the Guidelines, plus the other categories the Guidelines name; every Central Bank regulated firm that outsources, under the Irish guidance. ICT services are not in this module at all. They are governed by Chapter V of DORA and tracked in the DORA module, and the Guidelines expressly allow one integrated register and one integrated policy across the two.
The framework is the rulebook, the register is the module
Venvera already holds your vendor register, the DORA Register of Information, questionnaires, sub-outsourcing and concentration analysis in the Third-Party Risk module. This framework does not duplicate any of that. It is the rulebook: 72 requirements that say what the register, the contracts, the due diligence and the exit plans must contain and how often each duty recurs, each with its own status, owner and evidence. When a requirement asks for a register field, the register in the TPRM module is where you put it; the requirement row is where you show the supervisor it exists.
What Venvera tracks
Two prefixes. EBATP- rows carry the paragraph number of the 2026 Guidelines where a duty starts (EBATP-87 covers paragraphs 87 to 89), because that is how the EBA, your internal audit function and a supervisor cite them. CBIOUT- rows carry the Part B section of the Central Bank guidance and exist only where the Central Bank adds a step, a threshold, a frequency, a data item or an addressee that the Guidelines do not. An Irish-regulated firm answers both; every other firm answers the EBATP- rows and marks the CBIOUT- rows not applicable with a justification.
| Area | Source | What it covers |
|---|---|---|
| Scope and criticality | EBA 31 to 37; CBI s. 1 | Scoping every supplier relationship, the DORA boundary, the three impairment tests and the presumptions for critical or important functions |
| Governance and policy | EBA 23 to 24, 38 to 52; CBI s. 4.1 | Proportionality, strategy, management body accountability, the accountable role, substance, the policy and its content, conflicts of interest |
| Pre-contract analysis and due diligence | EBA 67 to 82; CBI s. 5, 6 | The five-step gate, supervisory conditions for licensable activities, risk assessment, location analysis, due diligence at two depths, data protection, conduct and ESG |
| Contracts and subcontracting | EBA 83 to 100, 108 to 109; CBI s. 5.1, 5.2, 7 | Minimum contract content, the additional terms for critical functions, access and audit rights, subcontracting conditions and objections, termination and transition |
| Oversight, audit and monitoring | EBA 56 to 57, 101 to 113; CBI s. 5.4, 8 | Internal audit coverage and follow-up, exercising audit rights, reliance on certifications, ongoing monitoring, concentration, performance and corrective action |
| Business continuity and exit | EBA 54 to 55, 114 to 116; CBI s. 9 | Continuity plans and the business impact analysis, documented and tested exit strategies, exit triggers and step-in |
| Register and supervisory reporting | EBA 58 to 66; CBI s. 10 | The register and its fields, supply on request, notification of planned critical arrangements, material changes and severe events, the Central Bank return |
| Group, intragroup and Irish specifics | EBA 27 to 28, 53; CBI s. 2, 4.4, 5.5 | Intragroup rigour, what a local entity must receive from central functions, objective pricing, outsourced control functions, offshoring |
Dashboard
The dashboard shows implementation coverage across the 72 requirements, a breakdown by the eight areas, and the maturity score from the gap assessment if one has been completed. Coverage and maturity answer different questions: coverage says whether a duty is implemented, maturity says whether the framework operates, which is what a supervisor tests. A row marked not applicable with a justification counts as covered, which is how a non-Irish firm's CBIOUT- rows behave.
Recurring duties
Twelve obligations land on the compliance calendar with owners, dates and reminders. Eleven are annual and one is quarterly; none is fixed to a calendar day by law, so each is anchored to the date you first complete it. The main ones:
Annual, paragraph 47 and the Central Bank's at-least-annual board review. The record is the approved version, the minute and the list of contracts the update triggered.
Annual, paragraphs 38, 110 and 111. The report pack with concentration exposure and open corrective actions, and the minute of the discussion.
Annual, paragraphs 58 to 62. A signed reconciliation against accounts payable, the contract repository and the DORA register of information.
Annual, paragraph 110 and CBI s. 1 and 5. Criticality, risk, concentration and subcontracting refreshed and dated in the register.
Annual, paragraphs 54 and 115 and CBI s. 9 and 9.1. A walkthrough challenged by senior management, and a continuity test with the provider's own results obtained.
Quarterly, paragraphs 112 and 113. Reports and KPIs against the service levels, shortcomings and the corrective action taken.
Annual for Irish firms in scope, CBI s. 10.2. The next cycle has a reference date of 31 December 2026 and a deadline of 28 February 2027.
Event clocks
Eight duties start on an event rather than a date and stay on their requirement rows: notifying the supervisor before a planned critical or important arrangement starts (EBATP-65 and CBIOUT-10.1.1), reporting material changes and severe events (EBATP-66 and CBIOUT-10.1.3), approving or objecting to a new subcontractor within the contractual notice period (EBATP-90), giving reasonable notice before an onsite audit (EBATP-101), corrective action without undue delay on a missed service level (EBATP-113), and the transitional notification where the review of critical arrangements is not finished two years after the application date (on EBATP-58). The requirements article describes each.