By Sophie Lindqvist

The Central Bank of Ireland has issued draft guidance on third-party risk management, signalling a shift beyond the regulator's existing outsourcing framework.

The draft surfaced in legal trade press coverage under the headline "Beyond outsourcing: CBI draft guidance on third-party risk management." The phrasing tells practitioners one thing clearly. CBI intends to widen the perimeter of its supervisory lens.

CBI supervises banks, insurers, investment firms, payment institutions, and e-money institutions operating in Ireland. Its existing outsourcing guidance governs how regulated firms handle external service providers. The new draft extends that frame to "third-party risk management."

What is third-party risk management?

Third-party risk management is the discipline of identifying, assessing, and controlling risks from any external party a firm depends on. Outsourcing, by contrast, is the narrower act of delegating a function or activity. The distinction matters. Regulators increasingly treat every external dependency as a candidate for oversight.

Cloud contracts, banking-as-a-service partnerships, intra-group shared service centres, and software-as-a-service deals all sit inside that broader frame. Each can affect a firm's operational resilience, data security, or customer outcomes.

Why does "beyond outsourcing" matter for practitioners?

The new label signals that CBI no longer treats outsourcing as the only entry point for supervision. A SaaS contract that never triggered outsourcing notification may now enter the same governance channel as a core vendor.

That has practical consequences for risk and compliance teams. They typically build registers around the older outsourcing definition. Gaps may need identification, and existing records may need expansion.

The Bank expects boards to know their external exposure. Reporting templates that capture only outsourcing arrangements will likely need widening to cover the broader category.

Who does this affect?

The draft applies to every CBI-regulated firm. That covers 5 categories of supervised entities: banks, insurers, investment firms, payment institutions, and e-money institutions. Each must consider whether its third-party universe is fully mapped.

In-house counsel, chief risk officers, and heads of procurement will carry the operational burden. External legal advisers will likely see demand spike as firms map their arrangements.

What should firms do now?

• Map every external relationship, not just formal outsourcing deals
• Review board reporting templates to capture the wider category
• Identify SaaS, cloud, and partnership arrangements outside the current register
• Track CBI's publications page for the consultation window
• Prepare internal commentary for any consultation response

How does this fit the wider European pattern?

The European Banking Authority has issued outsourcing guidelines that EU national regulators implement. The European Central Bank has pushed for broader operational resilience standards. The UK's Prudential Regulation Authority and Financial Conduct Authority have moved in similar directions.

Ireland's draft fits that continental pattern. Each regulator wants the same outcome. They want a clear view of every external dependency, not just the ones labelled "outsourcing."

What comes next?

CBI typically pairs such papers with a defined consultation period. Industry bodies and firms respond in writing. The Bank then publishes final guidance, which sets its expectation of regulated entities.

The full consultation paper and response deadline are awaited. Until then, the headline tells practitioners the direction. Internal mapping work can start now, even before the formal text arrives.

For in-house counsel, the practical takeaway is simple. The vocabulary has changed. Old registers built only around outsourcing will look incomplete under the new language.