The requirements page lists all 72 duties: 53 from the EBA Guidelines and 19 from the Central Bank of Ireland guidance. Each carries an implementation status, an owner, implementation notes, evidence and a review date, and each has authored guidance describing the artefacts a supervisor's reviewer asks for, the gaps that actually occur, and a checklist.
Status values
The same four values used across every Venvera framework: Not Implemented, Partial, Implemented and Not Applicable. Not Applicable has a real job here. A firm that is not regulated by the Central Bank of Ireland marks the nineteen CBIOUT- rows not applicable with a justification, and the Statement of Applicability shows the justification next to each. Two EBATP- rows can also be out of scope for a particular firm: the supervisory conditions for licensable activities (EBATP-69) where no provider performs such an activity, and the reference to BRRD and CRD investigatory powers inside EBATP-96, which binds institutions under CRD only.
The register row
EBATP-58 is deliberately the longest requirement in the module. Its text lists every field paragraphs 61 and 62 of the Guidelines require, because the field list is the duty: reference number and type of arrangement, dates and the reason for ending, the entities using the provider, the intragroup flag, the function and its category, the critical or important flag with reasons, the provider's identifiers and ultimate parent, the countries of performance, and for critical or important functions the governing law, audit dates, subcontractors with rank and location, the substitutability outcome, the reintegration assessment with recovery objectives, the exit plan flag, alternative providers and the annual cost. CBIOUT-10.2 lists the Central Bank's additions, including the firm-level block its return asks for.
The fields themselves live in the Third-Party Risk module's vendor register, which is the system of record. Evidence for EBATP-58 is therefore an export of the register, a reconciliation and the owner of each critical-only field, not a copy of the register pasted into the requirement.
The contract rows
Eleven rows describe what a contract must contain. The practical artefact is one clause checklist per signed contract, which is what the authored guidance on EBATP-84 and EBATP-85 asks for, with every element marked present or accepted as a deviation with a reason. The rows that most often fail on provider paper are the subcontracting notice period and objection right (EBATP-90), the termination of unauthorised subcontracting (EBATP-95), the reference to supervisory powers in every contract regardless of criticality (EBATP-96), and the transition period matched to the exit plan (EBATP-109).
| Requirement | Duty |
|---|---|
| EBATP-84 | Minimum content of every contract, including data return on insolvency or termination and cooperation with the authorities |
| EBATP-85 | Additional terms for critical or important functions: quantified service levels, reporting, insurance, contingency testing, audit rights, exit transition |
| EBATP-87 to 95 | Subcontracting conditions, notification with a notice period, approval or objection, and termination where the provider subcontracts without permission |
| EBATP-98 | Unrestricted access, information and audit rights for the firm, the competent authority and the resolution authority |
| CBIOUT-7.1 | The Central Bank additions: resolution resilience, town-level locations, KPIs in the SLA, exit test support, termination on Central Bank instruction |
Event clocks
Eight duties start on an event. They stay on their requirement rows rather than the calendar, so the evidence is a log with dates:
| Requirement | Trigger | Deadline |
|---|---|---|
| EBATP-65 | A planned arrangement for a critical or important function, or a function becoming critical or important | Notify the competent authority in a timely manner before the arrangement starts, with the register data set |
| EBATP-66 | A material change or severe event affecting a critical or important arrangement | Notify in a timely manner; define materiality and the decision owner in the policy |
| EBATP-58 | Two years after the application date, where the review of critical arrangements is not finished | Inform the competent authority with the measures planned or the exit strategy; application date to be confirmed by the EBA |
| EBATP-90 | The provider notifies a new or changed subcontractor | Approve or object before the contractual notice period ends; silence counts as non-objection |
| EBATP-101 | A planned onsite audit | Reasonable notice to the provider, except in an emergency or where notice would defeat the audit |
| EBATP-113 | A missed service level or identified shortcoming | Corrective action without undue delay; escalate where it persists |
| CBIOUT-10.1.1 | A proposed, changed, re-classified or terminated critical or important outsourcing, or offshoring | Notify the Central Bank before commencement with time for supervisory consideration |
| CBIOUT-10.1.3 | A significant business model change, a material event at a provider, or a material SLA breach affecting customers | Report promptly under the firm's escalation procedure |
Evidence
Attach evidence to the requirement it supports. The authored guidance on each requirement lists the artefacts a reviewer asks for, such as the gate checklist with a refusal recorded, the dated due diligence file, the subcontractor list reconciled with the register, the exit plan test report with the plan changes it caused, and the notification log with the decisions not to notify. The outsourcing requirements are not on the crosswalk: EBA/GL/2026/09 governs arrangements for non-ICT services, while DORA Articles 28 to 30 and the ISO 27001, NIST, SOC 2 and CPS 234 supplier controls govern ICT and information security suppliers, so an automatic link would let an ICT assessment count for a non-ICT arrangement. Where an arrangement genuinely falls under both regimes, attach the same evidence to both requirements.
Policies
Nine policy templates ship with the framework: the third-party risk and outsourcing policy, the register and reporting procedure, the criticality methodology, the due diligence standard, the contract minimum terms standard, the exit strategy template, the intragroup standard, the concentration risk standard and the supervisory notification procedure. Each section cites the requirements it satisfies, so generating the pack from the Policies page links every requirement to the paragraph that answers it.