European Banking Authority (EBA)
The EBA Guidelines on outsourcing arrangements expect financial entities to keep a clear record of what they outsource, on what terms, and who watches over it. With European Banking Authority (EBA) switched on, your contracts carry exactly those questions, the contracts in scope get their own tab, and the whole set exports to Excel.
EBA is set per contract. It is on when EBA is part of your contract with us — if it is not and you need it, contact sales@3rdrisk.com.
Overview
Four things to know before you start:
- Scope is per contract. You mark each arrangement individually; nothing is in scope by default.
- The fields sit inline on the contract form, marked beside the label, not on a separate tab.
- Thirteen fields exist only because of EBA. The rest of what EBA asks about is the ordinary contract detail you already keep — name, dates, notice periods, the people responsible.
- Nothing checks your work. None of the fields are mandatory and there is no completeness report, so reviewing the export is how you find gaps.
1. Put a contract in EBA scope
- Navigate to: Left menu: Third-parties, then Contracts.
- Open the contract and click on Edit contract.
- In This contractual arrangement falls under, select European Banking Authority (EBA).
- Fill in the EBA fields that appear.
- Click on Save.
Once it is in scope the contract carries an EBA badge in the header, and every field EBA asks about is marked with a small badge next to its label. Hover a marker to see which regulation is asking.
Note: the contract opens read-only. Edit contract in the bottom right puts it into edit mode.
Note: the field accepts more than one regulation. If your platform also runs DORA, a contract can fall under both, and a field both ask for simply carries two markers. Learn more: Digital Operational Resilience Act (DORA)
2. The thirteen fields EBA adds
They are grouped on the form with the rest of the contract detail, under headings such as Review and storage and Stakeholders.
How critical the arrangement is
Field | What it records |
|---|---|
Criticality classification (is the outsourcing critical or important?) | Critical, Important or Non-critical. This is the judgement everything else hangs on. |
What the provider is allowed to do
Field | What it records |
|---|---|
Sub-outsourcing allowed | Whether the provider may subcontract at all. |
Sub-outsourcing approval process | How you approve a subcontractor when they may. |
Regulatory access rights clause | Whether the contract grants your regulator access. |
Right to audit clause | Whether you may audit the provider: Yes, No or Upon request. |
Access to premises, systems, and data clause | The access you and the authorities have, and on what notice. |
Notification obligations to regulator | Whether you must notify the regulator before entering or ending this arrangement. |
Retention period of contract and audit trail | For how many years the contract and its audit trail are kept. A number of years. |
What happens if it goes wrong
Field | What it records |
|---|---|
Contingency plan in case of provider failure | What you do if this provider stops delivering. |
Reversibility arrangements | How the service comes back in-house or moves on. |
Transferability of services and data | Whether services and data can move to another provider: Yes, No or Partially. |
Who keeps an eye on it
Field | What it records |
|---|---|
Frequency of performance monitoring/review | Monthly, Quarterly, Annually or Upon request. |
Internal owner responsible for oversight | The person accountable for overseeing this arrangement, picked from your users. |
EBA also asks for two roles on the contract that you may not be filling in today: a data protection officer and a legal officer, alongside the contract manager, business owner and risk officer.
Note: Sub-outsourcing approval process, Contingency plan and Reversibility arrangements are free text with formatting, so you can paste the relevant clause straight from the contract.
3. Find the contracts in scope
The contract list has a tab per active regulation. Click on European Banking Authority (EBA) to see only the contracts in scope. The tab is a filter, so Filters applied turns red while it is active — Overall takes you back to everything.
Note: the tabs only appear when there is more than one to show. If EBA is your only regulation, the list simply shows everything.
Note: there is no EBA tab on the third-party catalogue. Scope belongs to the contract, so that is where you filter it.
4. Import and export
With EBA switched on, the contract import template grows an EBA section: a falls_under_eba column taking Yes or No, plus one column per EBA field, with drop-downs where the field has fixed options. That is the fastest way to record a set of existing arrangements.
- Navigate to: Left menu: Third-parties, then Contracts.
- Download the import template, which now includes the EBA columns.
- Fill them in and upload the file.
Learn more about importing contracts: Contract catalogue
The export carries the same columns. Filter to the EBA tab first and the export gives you the arrangements in scope with everything EBA asks about, which is what you review before a supervisor asks — the platform does not generate a filing document for you.
Permissions needed
Permissions needed: the permissions you already use to view and edit contracts. There is no separate EBA permission.
Known limitations
- You cannot switch EBA on yourself. It follows your contract with us; Configuration → Features only reports the state.
- Scope is per contract, and there is no EBA setting on a third party.
- None of the fields are mandatory. A contract in EBA scope saves with every EBA field empty and nothing warns you.
- There is no completeness report. Reviewing the export is the practical check.
- The platform does not produce a filing document. The contract export is the register.
- The fields sit inline on the contract form, marked beside the label, rather than on a tab of their own.