LLegal
Von Outsourcing zu Third Party Arrangements: Die neuen EBA-Leitlinien zum Drittparteienmanagement • Teil 1: Überblick über die wichtigsten Neuerungen
Read More
  • 7 minute read

From Outsourcing to Third Party Arrangements: The New EBA Guidelines on Third-Party Risk Management 1/2

On 8 July 2025, the European Banking Authority (EBA) published a new consultation paper on the EBA Guidelines for third-party risk management. The draft goes well beyond the previous Outsourcing Guidelines from 2019. The objective is to establish a harmonised European framework for managing third-party risks, aligned in particular with the Digital Operational Resilience Act (DORA). Part 1 of the analysis highlights the key innovations and main content; a practical assessment will follow in Part 2.
Read More
FFinTech
From Onboarding to Offboarding: Lifecycle Management of ICT Third-Party Relationships under DORA 3
Read More
  • 5 minute read

From Onboarding to Offboarding: Lifecycle Management of ICT Third-Party Relationships under DORA

The DORA Regulation (EU) 2022/2554 obliges financial institutions to manage their ICT third-party relationships in a structured way across the entire lifecycle – from selection to exit. For FinTechs, this means that ad hoc purchases of IT services are a thing of the past. Instead, documented and auditable processes are required, taking into account risks, supervisory requirements, and exit strategies.
Read More
DDORA & IT Security
The new DORA-RTS SUB is here! 4
Read More
  • 4 minute read

The new DORA-RTS SUB is here!

On 2 July 2025, the European Commission adopted the Regulatory Technical Standard RTS SUB (Delegated Regulation (EU) 2025/532). It specifies the requirements that financial institutions must meet when (sub-)contracting ICT services that support critical or important functions – particularly with regard to risk assessment and the management of sub-service providers.
Read More
DDORA & IT Security
NIS2 meets DORA – What changes for financial institutions as a result of the NIS2 Implementation and Adjustment Act (NIS2UmsuCG)? 5
Read More
  • 5 minute read

NIS2 meets DORA – What changes for financial institutions as a result of the NIS2 Implementation and Adjustment Act (NIS2UmsuCG)?

On 30 July 2025, the German Federal Government presented the draft of the NIS2UmsuCG. This transposes the NIS2 Directive (EU) 2022/2555 into German law and expands the IT security framework. For the financial sector, which has been subject to the DORA Regulation (EU) 2022/2554 since 17 January 2025, the question arises: Do we still need to concern ourselves with NIS 2 – or are we exempt?
Read More