Regulation

Outsourcing and Vendor Rules for EMIs: DORA, EBA, FCA

Dmytro Medvid, Founder · 24 October 2026 · 11 min read

Supplier dependencies of an e-money institution mapped against DORA, EBA guidelines and FCA rules

Key takeaways

In the EU, ICT suppliers of payment and e-money institutions fall under DORA Chapter V, and non-ICT suppliers will fall under the EBA's guidelines EBA/GL/2026/09 once they apply.
Both EU regimes turn on whether a service supports a critical or important function; a non-ICT supplier performing payment services to an extent that would require authorisation is critical by default.
For critical or important services, firms should inform their competent authority in a timely manner about planned arrangements, keep a register and hold a documented, workable exit plan.
UK authorised PIs and EMIs must already notify the FCA before outsourcing operational functions, and from 18 March 2027 must notify planned material third-party arrangements and file an annual register.
A single, classified supplier inventory can feed the DORA register, the EBA register and the FCA register, and doubles as a due diligence checklist when choosing a core platform.

If you run an EMI or payment institution, almost every vendor you rely on now sits under one of three rulebooks. In the EU, ICT services — your core platform, cloud hosting, KYC software, card processor — fall under DORA, which has applied since 17 January 2025. Non-ICT services — an outsourced review team, a call centre, outsourced internal audit — will fall under the EBA's new third-party risk guidelines (EBA/GL/2026/09), published on 18 September 2026 and replacing the 2019 outsourcing guidelines once they apply. In the UK, outsourcing notifications under the PSRs and EMRs apply today, and from 18 March 2027 authorised PIs and EMIs must also notify the FCA of planned material third-party arrangements and significant changes to them, and file an annual register.

The practical consequence is the same everywhere: you need to classify every supplier, know which ones support a critical or important function, tell your supervisor before you commit to those, and be able to leave any of them without stopping your service. This guide maps the three regimes side by side and shows what to do with your vendor list this quarter.

Why this is on the agenda in October 2026

Three things landed close together. The EBA finalised its guidelines on third-party risk for non-ICT services on 18 September 2026, with a two-year transitional period for existing arrangements. The FCA's PS26/2 rules on third-party reporting take effect on 18 March 2027, which is under five months away. And on 19 October 2026 the FCA published examples of good and poor practice on AI, criticising firms that accepted vendor assurances at face value and repeating that firms deploying AI tools remain responsible for the outcomes. As Bratby Law noted on 22 October, a payment firm that hands an operational function of its payment services, such as fraud screening, to an AI supplier is likely to be outsourcing, with the notification duties that follow.

None of this is a brand-new idea. PSD2 has always required a payment institution to inform its regulator before outsourcing operational functions. What changed is the scope (far more than "outsourcing"), the paperwork (structured registers that supervisors can compare across firms) and the expectation that you can prove an exit route.

Step one: ICT or non-ICT?

The EU now runs two regimes side by side, and the dividing line is the type of service, not the type of supplier.

DORA (Regulation (EU) 2022/2554) covers ICT services: digital and data services delivered through ICT systems on an ongoing basis. Article 2(1) names payment institutions and e-money institutions as in-scope financial entities, explicitly "including" those exempted under PSD2 and the E-Money Directive (EUR-Lex). Exempted institutions use the simplified ICT risk framework in Article 16, but the third-party rules in Chapter V still apply to them, proportionately, except the requirement in Article 28(2) to adopt a separate ICT third-party risk strategy.

EBA/GL/2026/09 covers everything else. The guidelines apply to payment institutions and e-money institutions on an individual basis (paragraph 14), do not apply to firms that only provide account information services (paragraph 11), and expressly carve out anything within the scope of DORA Chapter V (paragraph 5) (EBA final report).

Where a contract mixes both, the EBA leaves the call to you: under paragraph 32 it is for the financial entity to decide whether the ICT element is material, in which case DORA governs that element. Freshfields points out that the EBA refers firms to the ESAs' DORA Q&As on the definition of ICT services and on mixed arrangements. Document the reasoning; a supervisor will ask how you drew the line.

Some arrangements fall outside both. The EBA's exclusion list (paragraph 33) includes payment network infrastructures such as Visa, Mastercard and WERO, correspondent banking, statutory audit and low-impact goods and services such as legal opinions and office supplies. Excluded does not mean unmanaged: the EBA says the risks still have to be managed.

How to route a new supplier (EU)

Before signing, decide what the supplier actually provides. Payment schemes, correspondent banking and low-impact goods sit outside both regimes.
ICT services go to DORA Chapter V. Non-ICT services go to the EBA guidelines. For mixed contracts you decide whether the ICT element is material, and document why.
Both regimes then ask the same question: does the service support a critical or important function?
If it does, inform your competent authority in a timely manner, before you commit. Either way, the arrangement goes into your register.

Simplified decision path for an EU payment or e-money institution. UK entities follow the PSRs/EMRs and, from 18 March 2027, SUP 15.19.

Step two: is the function critical or important?

Both regimes turn on the same concept. DORA defines a critical or important function as one whose disruption would materially impair the firm's financial performance, the soundness or continuity of its services, or its continuing compliance with its authorisation and other obligations. PSD2 Article 19(6) uses almost the same test for an "important operational function" (EUR-Lex, consolidated PSD2).

The EBA guidelines add a shortcut that matters for payment firms. Under paragraph 36, where a third party performs banking, payment or asset-referenced-token functions to an extent that would require authorisation, the firm should automatically treat that function as critical or important. There is no room for a "low risk" assessment of an arrangement that is, in substance, someone else running your regulated activity.

For a typical EMI the answer is rarely in doubt for the core platform: the ledger, the client portal, payment processing and transaction monitoring support functions without which the firm cannot operate or comply. Arguments tend to happen at the edges — analytics tools, communication platforms, AI assistants in customer support.

Here is how a mid-sized EMI's supplier list might route. It is illustrative; your classification depends on what each contract actually covers.

Supplier	Likely regime	Critical or important?
White-label core banking platform (ledger, portal, back office)	DORA	Almost certainly
Cloud hosting behind that platform	DORA (as a subcontractor in the chain)	Yes, via the platform
KYC and screening software	DORA	Usually
Outsourced KYC review analysts	EBA guidelines, if the human service predominates	Often
Customer support call centre	EBA guidelines	Depends on what it handles
Outsourced internal audit	EBA guidelines	Yes by default (para 35), unless assessed otherwise
Card scheme membership (Visa, Mastercard)	Excluded (payment network infrastructure)	—
Blank plastic card stock	Out of scope (acquisition of goods)	—
Card personalisation and fulfilment	Assess: ICT or non-ICT service	Depends on data handled

Step three: what each regime asks you to do

The obligations line up more than the labels suggest. The differences are in timing, in who gets notified, and in how much the contract itself must say.

DORA, EBA guidelines and UK rules for PIs and EMIs

Criteria
In force	Since 17 Jan 2025	Date set after translation; 2-year transition for existing arrangements	Reg 25/26 now; SUP 15.19 and 16.33 from 18 Mar 2027
Who	All PIs and EMIs, including exempted	PIs and EMIs, individually (AIS-only firms excluded)	Authorised PIs and EMIs
What it covers	ICT services	Non-ICT services	Outsourcing now; all material third-party arrangements from 2027
Tell the supervisor	Planned ICT arrangements for critical functions, in a timely manner	Planned critical arrangements, in a timely manner	Before outsourcing; from 2027 early, before any commitment
Register	All ICT contracts; report at least yearly	All arrangements; may be merged with DORA's	Material arrangements; annual, 90-day window
Mandatory contract terms	Yes, Art 30(2) and 30(3)	Yes, minimum terms	No clause list in the PSRs/EMRs
Exit planning	Exit strategy and transition period for critical services	Documented exit plan for critical functions	FCA expects plans to move critical providers

One supplier inventory, classified once, can feed all three. Build it that way.

Summary for orientation, not a complete statement of the rules. Check the primary texts and your national regulator's procedures.

DORA: register, notice and contract terms

Article 28(3) requires a register of information on all contractual arrangements for ICT services, distinguishing those that support critical or important functions, with at least yearly reporting on new arrangements and the full register available to the competent authority on request. The same paragraph requires you to inform the authority "in a timely manner" about any planned arrangement for ICT services supporting a critical or important function, and when an existing function becomes critical. The register's format is fixed by Implementing Regulation (EU) 2024/2956.

Article 30 is the part vendors feel. Every ICT contract must cover, among other things, a full description of the services and whether subcontracting is allowed, the locations where services are provided and data processed, data protection, service levels, incident assistance at no extra cost or a cost set in advance, full cooperation with the competent and resolution authorities, and termination rights with minimum notice periods (DORA Article 30). For services supporting critical or important functions, Article 30(3) adds precise quantitative service levels, business contingency plans, unrestricted access, inspection and audit rights for you and your regulator, and an exit strategy with a mandatory adequate transition period during which the provider keeps running the service while you migrate.

The EBA guidelines: same shape, for everything else

The new guidelines mirror DORA's lifecycle: risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit. For critical or important functions the firm should be able, within an appropriate time frame (paragraph 46(f)), to transfer the function to another provider, take it back in-house, or discontinue the dependent activity, and its policy must require a documented exit plan (paragraph 48(g)). Paragraph 65 asks firms to inform competent authorities in a timely manner about planned arrangements supporting critical or important functions.

The register (paragraphs 61–62) should be consistent with the DORA register, and firms may combine both into one. For critical arrangements it records governing law, audit dates, subcontractors, the substitutability assessment and whether an exit plan exists. It also asks for the estimated annual budget cost of each critical arrangement for the past year (paragraph 62(h); see also Simmons & Simmons).

Timing: the guidelines apply to arrangements entered into, reviewed or amended from the application date, which the EBA will set once translations are published; as of today the EBA's page lists the status as "final and awaiting translation". Existing critical arrangements should be reviewed within two years of that date; if the review is not finished, the firm should tell its competent authority how and when it will complete it, or how it plans to exit. Non-critical arrangements can wait until renewal. Each national competent authority must then tell the EBA whether it complies or intends to comply, or explain why not, so check how yours implements them.

The UK: two layers until 2027, then three

DORA does not apply to UK-authorised firms. Instead:

Today: regulation 25 of the Payment Services Regulations 2017 and regulation 26 of the Electronic Money Regulations 2011 require an authorised firm to notify the FCA of its intention to outsource an operational function, and of any change in outsourced functions or providers without undue delay. Important functions carry conditions, including that senior management does not delegate its responsibility. Under regulation 36(2) of the PSRs (and the equivalent EMR provision) the firm is liable for its supplier's acts as if they were its own (Bratby Law).
Operational resilience: SYSC 15A applies to EMIs and PIs regardless of size, for their payment services and e-money business. Firms must map the people, processes, technology, facilities and information, including those provided by third parties, behind each important business service and test that they can stay within impact tolerances (FCA Handbook). The FCA's 2023 letter to payments firms also said it expects firms to monitor dependence on critical technology and banking providers and to have contingency plans to move provider.
From 18 March 2027: authorised PIs and EMIs must notify the FCA when entering into, or significantly changing, a material third-party arrangement, outsourcing or not, and maintain a register of those arrangements. The FCA expects notifications "at an early stage", before any internal or external commitment, through FCA Connect. The register reflects 31 December of the previous year and is submitted within 90 calendar days of the FCA opening the window, through FCA RegData (FG26/4).

An arrangement is material if its disruption could cause intolerable harm to clients, threaten the UK financial system, or cast serious doubt on the firm's ability to meet its threshold conditions, the Principles or SYSC 15A. FG26/4 lists AI and machine learning models as an example of a non-outsourcing third-party arrangement; whether one is material is assessed case by case, like any other supplier.

Where firms get this wrong

Treating the vendor's paper as the control. A supplier's ISO certificate or SOC report is evidence, not a substitute for your own due diligence, monitoring and exit plan. DORA Article 28(1) and PSD2 Article 20 both keep full responsibility with the regulated firm.

Registers that do not match reality. The DORA register and the new EBA register are structured data that supervisors compare across firms. A register filled in once for a deadline and never updated will contradict your contracts, and your contracts will contradict what the business actually uses.

Forgetting the chain. Your core platform runs on someone's cloud and probably calls a dozen other services. DORA's contract terms cover subcontracting conditions and data locations; FG26/4 treats a change of key sub-contractor as a potentially significant change. Ask vendors for their subcontractor list before you sign, not after an incident.

Exit plans that are only a paragraph. "We would migrate to another provider" is not an exit plan. Both DORA and the EBA guidelines expect exit plans that are documented and workable; in practice that means a named alternative or in-house path, a data export format you have actually tested, a transition period in the contract and an estimate of how long migration would take. We covered the same logic for bank relationships in our exit plan for losing a banking partner.

Late notifications. The duty to tell the supervisor applies to planned arrangements, so in practice it comes before the contract is signed. Firms that discover a material vendor change during a regulatory visit, rather than through their own process, start the conversation on the back foot.

What to do this quarter

Third-party readiness for PIs and EMIs

Build one supplier inventory
Every contract, intragroup arrangements included (for the FCA register, intragroup only where there is an external dependency), with owner, service, function supported and subcontractors.
Classify each line
ICT (DORA), non-ICT (EBA guidelines), excluded, and for UK entities material or not under FG26/4. Record the reasoning for mixed contracts.
Run the critical or important function test
Under the EBA guidelines, a non-ICT supplier that performs payment services for you to an extent that would require authorisation is critical or important by default (paragraph 36).
Gap-check critical contracts against DORA Article 30(3)
Service levels, audit and access rights, incident support, subcontracting, data location, exit and transition period.
Write real exit plans
Alternative provider or in-house route, tested data export, realistic migration time, contractual transition period.
Align your registers
One data model that produces the DORA register, the EBA register and, for UK entities, the FCA register from 2027.
Put notification into procurement
No contract for a critical or material service is signed until the regulatory notice step is complete.
Include AI suppliers
Fraud models, chatbots and AI-assisted review tools are third-party arrangements too.

Saved on this device when browser storage is available.

If you are choosing or replacing your core platform, these requirements are also a buying checklist. Ask any vendor, including us, for their standard DORA Article 30 contract annex, their subcontractor list with data locations, the format and frequency of data exports, and how a migration away from them would work. The trade-offs between building and buying are in our white-label vs in-house guide, and the wider launch stack is in the EMI technology checklist.

This article explains the rules in general terms and is not legal advice. Confirm how they apply to your firm with counsel and your national competent authority.

Our view

The new rules do not stop EMIs and PIs from relying on vendors; almost every payment firm in Europe runs on someone else's technology, and supervisors know it. What they ask is that the firm, not the vendor, can show what it depends on, why, and how it would carry on if a supplier failed or had to be replaced.

That is easier to do when the contract and the architecture were designed for it. A platform that exports your full ledger and customer data in a documented format, runs on infrastructure you can name, and gives your auditor and regulator access is a smaller risk than one that is cheaper today but impossible to leave. That is the test to apply to any platform, ours included, and to the custom development you commission around it. If you want a second pair of eyes on your supplier map before March 2027, tell us what you're building.

FAQ

Does DORA apply to small or exempted payment and e-money institutions?

Yes. DORA Article 2(1) covers payment and e-money institutions, including those exempted under PSD2 and the E-Money Directive. Exempted institutions use the simplified ICT risk framework in Article 16, but the Chapter V third-party rules still apply proportionately, except the Article 28(2) strategy requirement.

When do the EBA's new third-party risk guidelines apply?

The EBA published EBA/GL/2026/09 on 18 September 2026. The application date will be set once translations into all official EU languages are published; existing critical arrangements then have two years to be reviewed, and non-critical ones can wait until renewal.

Is a core banking platform covered by DORA or by the EBA guidelines?

A core banking or white-label platform is an ICT service, so it falls under DORA Chapter V. The EBA guidelines cover non-ICT services and expressly exclude anything within DORA's scope; for mixed contracts the firm decides whether the ICT element is material.

What changes for UK EMIs and PIs on 18 March 2027?

Under FCA PS26/2, authorised PIs and EMIs must notify the FCA early, before any commitment, when planning a material third-party arrangement or a significant change to one, outsourcing or not, and submit an annual register of material arrangements within 90 days of the FCA opening the window.

Do AI tools count as third-party arrangements?

They can. If an AI supplier performs an operational function of a firm's payment services, such as fraud screening, UK rules on outsourcing notification are likely to apply, and FCA guidance FG26/4 lists AI and machine learning models as an example of a non-outsourcing third-party arrangement.