LLegal
Von Outsourcing zu Third Party Arrangements: Die neuen EBA-Leitlinien zum Drittparteienmanagement • Teil 1: Überblick über die wichtigsten Neuerungen
Read More
  • 7 minute read

From Outsourcing to Third Party Arrangements: The New EBA Guidelines on Third-Party Risk Management 1/2

On 8 July 2025, the European Banking Authority (EBA) published a new consultation paper on the EBA Guidelines for third-party risk management. The draft goes well beyond the previous Outsourcing Guidelines from 2019. The objective is to establish a harmonised European framework for managing third-party risks, aligned in particular with the Digital Operational Resilience Act (DORA). Part 1 of the analysis highlights the key innovations and main content; a practical assessment will follow in Part 2.
Read More
FFinTech
Neues Buch: Das Recht der digitalen Zahlungsdienstleistungen
Read More
  • 2 minute read

PayTechLaw – now available as a book!

With the title “PayTechLaw – The Law of Digital Payment Services”, a new handbook has been published by C.H. BECK. It is dedicated entirely to the regulatory and civil law framework of digital payments. The editors: Prof. Dr. Carsten Herresthal, LL.M., and Annerton partners Dr. Matthäus Schindele and Frank Müller, LL.M. – all recognized experts in payment services and financial regulatory law. They were supported by a top-class team of authors – including many familiar names from the Annerton environment and beyond.
Read More
FFinTech
From Onboarding to Offboarding: Lifecycle Management of ICT Third-Party Relationships under DORA 2
Read More
  • 5 minute read

From Onboarding to Offboarding: Lifecycle Management of ICT Third-Party Relationships under DORA

The DORA Regulation (EU) 2022/2554 obliges financial institutions to manage their ICT third-party relationships in a structured way across the entire lifecycle – from selection to exit. For FinTechs, this means that ad hoc purchases of IT services are a thing of the past. Instead, documented and auditable processes are required, taking into account risks, supervisory requirements, and exit strategies.
Read More
DDORA & IT Security
The new DORA-RTS SUB is here! 4
Read More
  • 4 minute read

The new DORA-RTS SUB is here!

On 2 July 2025, the European Commission adopted the Regulatory Technical Standard RTS SUB (Delegated Regulation (EU) 2025/532). It specifies the requirements that financial institutions must meet when (sub-)contracting ICT services that support critical or important functions – particularly with regard to risk assessment and the management of sub-service providers.
Read More