Third-Party Risk Management: EBA, DORA & CIFs

Third-Party Risk Management: EBA, DORA & CIFs

Master Third-Party Risk Management, Regulatory Compliance, and Operational Resilience in Financial Services.

Financial institutions increasingly depend on external technology providers, outsourcing partners, cloud platforms, and specialized service organizations. Managing these relationships is no longer simply a procurement or vendor management responsibility. It is a critical component of enterprise risk management, operational resilience, and regulatory compliance.

This comprehensive course provides a practical understanding of Third-Party Risk Management (TPRM) under the Digital Operational Resilience Act (DORA) and the European Banking Authority (EBA) Guidelines, with particular emphasis on Critical or Important Functions (CIFs).

You will explore how financial institutions can identify, assess, govern, monitor, and control third-party risks throughout the entire service lifecycle.

What You Will Learn

• Understand DORA Chapter V and the EBA Third-Party Risk Guidelines.

• Identify and classify Critical or Important Functions (CIFs).

• Develop effective third-party risk governance frameworks and policies.

• Conduct pre-contract risk assessments and third-party due diligence.

• Evaluate contractual requirements, audit rights, and regulatory obligations.

• Manage subcontracting, fourth-party dependencies, and concentration risks.

• Establish and maintain third-party registers and the DORA Register of Information (RoI).

• Implement continuous monitoring, Key Risk Indicators (KRIs), and performance assessments.

• Develop exit strategies, business continuity arrangements, and stressed-exit plans.

• Prepare for regulatory supervision, compliance reviews, and third-party risk audits.

Regulatory Frameworks Covered

The course examines key European and international regulatory requirements, including:

• DORA — Regulation (EU) 2022/2554

• EBA Guidelines on the Sound Management of Third-Party Risk (EBA/GL/2026/09)

• Basel Committee Principles for the Sound Management of Third-Party Risk (2025)

• ECB Guide on Outsourcing Cloud Services

• DORA requirements for ICT third-party service providers and critical functions

Particular attention is given to integrating ICT and non-ICT third-party risk management into a consistent governance framework.

Practical Applications and Real-World Case Studies

Beyond regulatory theory, this course explores real-world incidents and practical risk management challenges involving financial institutions, technology providers, and critical service dependencies.

Through illustrative scenarios and the fictional Halvard Bank Group case study, you will examine third-party risk assessments, governance decisions, contractual gaps, concentration risks, monitoring processes, and exit planning.

The course also introduces a structured approach to developing an EBA and DORA compliance implementation roadmap.

Who Should Take This Course?

This course is designed for:

• Third-Party Risk Managers and Vendor Risk Specialists

• Banking, Fintech, and Financial Services Professionals

• Compliance Officers and Internal Auditors

• ICT Risk and Cybersecurity Professionals

• Operational Resilience and Business Continuity Managers

• Procurement, Outsourcing, and Contract Management Professionals

• Risk Consultants and Regulatory Compliance Advisors

• CIOs, CROs, COOs, and Senior Management

A basic understanding of banking, risk management, or financial services is recommended, but prior expertise in EBA or DORA regulations is not required.

Take the Next Step in Third-Party Risk Management

By completing this course, you will develop the knowledge and practical understanding needed to strengthen third-party risk governance, manage critical service dependencies, support regulatory compliance, and improve operational resilience across financial institutions.

Build the skills to manage third-party risk with confidence in an increasingly interconnected financial ecosystem.

This course contains the use of artificial intelligence.