European banks to tighten controls over key external service providers

Banks and other regulated financial institutions across the European Union are preparing for stricter oversight of companies providing essential external services following the publication of new rules by the European Banking Authority. The framework, issued on 18 September 2026, covers non-technology services and gives institutions two years to adapt their existing arrangements.

The changes broaden the approach previously applied mainly to outsourcing. Financial institutions will now need to examine a wider range of relationships with outside companies and determine which could have a significant effect on their operations if a provider failed or a service was interrupted. More extensive controls will apply to these important relationships, while lower-risk services will be subject to a more proportionate approach.

The rules sit alongside the EU’s Digital Operational Resilience Act, which deals with technology-related external services. The EBA framework instead addresses non-ICT activities, creating separate but complementary systems for overseeing the different types of outside companies increasingly used by financial institutions.

Responsibility will remain firmly with the institution using the service. Banks will be expected to understand their dependence on individual suppliers, examine providers before entering agreements and maintain sufficient internal oversight throughout the relationship. Contracts will also need to provide appropriate access to information and allow institutions to respond effectively when services are disrupted or arrangements need to be terminated.

Particular attention will be paid to subcontracting and situations where institutions become heavily dependent on a small number of providers. Banks will need to consider whether important operations could continue if a supplier encounters difficulties and establish practical alternatives for transferring or replacing services where necessary.

The changes could also affect companies working with the financial sector, including some businesses connected with commercial property. Banks rely on extensive networks of external professional and operational suppliers, and providers supporting activities classified as important to a financial institution could face more detailed scrutiny of their contracts, continuity arrangements, subcontractors and reporting capabilities. The rules do not, however, introduce a separate regulatory regime for property companies.

The new framework will replace the EBA’s 2019 outsourcing guidelines and reflects the increasing reliance of Europe’s financial industry on specialist external providers. For property and professional-services businesses serving regulated institutions, the practical consequence could be greater scrutiny of how services are delivered and how quickly clients could maintain operations or transfer responsibilities if an important supplier relationship breaks down.

Source: Deloitte