Simon Keogh
Senior Associate | Legal
Ireland
Simon Keogh
Senior Associate
Ireland
Central Bank of Ireland's consultation on guidance for the management of third-party risks: implications for fund service providers
ON THIS PAGE
The Central Bank of Ireland has published Consultation Paper 173 (CP173) seeking industry feedback on new guidance for third-party risk management, which will apply to fund service providers operating in Ireland.
Once finalised, the Guidance on Good Practices for the Sound Management of Third-Party Risks is set to replace the existing Cross-Industry Guidance on Outsourcing.
In this article, Ogier's Investment Funds experts in Ireland outline the rationale for the Central Bank of Ireland's (Central Bank) new guidance, what is proposed and the practical next steps for fund service providers before the consultation closes on 3 December 2026.
Why is the Central Bank proposing new guidance?
The Central Bank has proposed to update the existing guidance to reflect firms’ increasing reliance on third parties. Firms may now depend on cloud providers, fintech partnerships, joint ventures, intra-group service providers, technology vendors and data processors, including for AI and core business functions. Many of these arrangements do not fit neatly within traditional definitions of outsourcing but can create material dependencies.
The Central Bank also points to:
Supervisory findings
Recurring weaknesses in oversight arrangements, concentration risk, intra-group dependencies, offshoring, exit planning and sub-outsourcing. Outsourcing remains a key sector risk.
Regulatory fragmentation
New frameworks have emerged that differ in their approach to third-party risk supervision, scope and terminology.
Systemic risk
The concentration of critical services, particularly cloud and AI services, among a limited number of providers.
Simplification and competitiveness
The Central Bank has approached the work through the lens of regulatory simplification, seeking to reduce administrative load while maintaining clarity of responsibility and embedding proportionality.
What does the Central Bank’s new guidance propose?
The key proposals are summarised below.
Topic / area | Proposal | Key points to note |
Non-binding | The new guidance is proposed to replace the existing guidance. | The proposed new guidance is non-binding in nature and aims to strike a balance between clarity and flexibility. However, where firms adopt different practices, they are expected to be in a position to explain why they have chosen to do so. |
Scope | The new guidance covers all material third-party arrangements that create reliance or dependency, not only outsourcing in the traditional sense. | The new guidance expressly includes intra-group outsourcing, cloud providers, partnerships and joint ventures, technology and software vendors and data processors. |
Structure | The new guidance is based on good practices that allow flexibility and are intended to support an outcomes-based approach. | Firms retain discretion over how outcomes are achieved and may depart from the good practices where risks are appropriately addressed. |
Lifecycle | The new guidance follows the lifecycle of an arrangement from governance through pre-engagement, engagement, ongoing management and termination. | The new guidance covers risk and criticality / importance assessments, due diligence, contracting, onboarding, monitoring, assurance and exit. |
Tiered good practices | Good practices are split into “foundational” and “supporting” tiers, allowing firms to prioritise and thereby contributing to flexibility. | Intended to help firms prioritise and apply the new guidance proportionately. |
Intra-group agreements | Intra-group agreements are recognised as distinct arrangements but still require risk management. | Firms must maintain sufficient substance and cannot become “empty shells” which are reliant on group support. |
Large service providers | The proposal will shift focus to the outcomes which a contract should achieve rather than mandated and pre-determined clauses. | Where terms cannot be secured, firms should document their efforts to include the ideal clauses, assess the residual risk and implement compensating controls. |
Concentration risk | Firms should assess firm-level concentration, including substitutability, lock-in and exit planning. | There is no expectation to avoid dominant providers, but firms should understand and mitigate the concentration risk accepted. |
Offshoring | Offshoring is neither prohibited nor discouraged, but specific risks must be managed. | Firms should inform the Central Bank before committing to offshoring critical or important functions where supervision issues may arise. |
Sub-outsourcing | Contracts should require notification of any material sub-outsourcing. Prior consent should still be required for critical or important functions. | Audit and access rights should extend to sub-outsourcers. Consider concentration through common sub-outsourcers. |
What is the Central Bank seeking feedback on?
The consultation seeks feedback on topics including the proposed scope of the guidance, the Central Bank’s assessment of the problems identified in the Regulatory Impact Assessment and whether specific areas require further clarity.
Read all 13 questions from the Central Bank in Consultation Paper CP173 (pages 37-38).
Key takeaways for fund service providers
Look beyond outsourcing
Fund managers with a focus on traditional outsourcing should map out their wider dependencies, such as technology, data and software providers. The Central Bank acknowledges these firms may face greater one-off costs.
Non-binding does not mean optional
The Central Bank may refer to the new guidance in supervision and will consider whether any different approach adequately manages the risks.
Group reliance will be scrutinised
Fund managers who are part of international groups should be able to show local substance, oversight and contingency arrangements if group support becomes unavailable.
Revisit contracts
Check sub-outsourcing, audit, access and termination provisions and keep a record of negotiation efforts and compensating controls where terms with large providers cannot be secured.
Maintain exit plans
Assess substitutability and maintain exit plans for critical or important arrangements.
Engage early on offshoring
Assess criticality at an early stage and engage with the Central Bank before committing to offshoring critical or important functions where supervisory concerns may arise.
Consider responding
CP173 specifically seeks evidence on costs, scope boundaries, proportionality, interaction with DORA and other frameworks and transition arrangements.
What should fund service providers do now?
Before 3 December 2026, fund service providers operating in Ireland should review CP173, benchmark current third-party risk frameworks against the proposed outcomes and consider whether to respond, as an individual firm or through an industry association. The Central Bank also plans to host an industry workshop during the consultation period.
Responses should be emailed to TPRMConsultation@centralbank.ie.
Final guidance is expected to be published in Q1 2027.
How Ogier can help
Ogier's Investment Funds team in Ireland advises investment funds and asset management companies on regulatory, governance and delegation matters. For questions about this update or preparing a consultation response, contact our team .
Key contacts
About Ogier
Ogier is a professional services firm with the knowledge and expertise to handle the most demanding and complex transactions and provide expert, efficient and cost-effective services to all our clients. We regularly win awards for the quality of our client service, our work and our people.
Disclaimer
This client briefing has been prepared for clients and professional associates of Ogier. The information and expressions of opinion which it contains are not intended to be a comprehensive study or to provide legal advice and should not be treated as a substitute for specific advice concerning individual situations.
Regulatory information can be found under Legal Notice
Sign up to receive updates and newsletters from us.
Sign up