The EBA’s new third-party risk guidelines don’t cover crypto exchanges

The EBA published final Guidelines on the sound management of third-party risk on 18 September 2026, and the press release describes a framework "aligned with DORA." Read the addressee list instead of the headline, and a different story appears: crypto-asset service providers are not on it.

The guidelines apply to credit institutions, investment firms under MiFID II, payment institutions, electronic money institutions, and issuers of asset-referenced tokens (ARTs) under MiCAR — the stablecoin issuers, not the exchanges that list them. A CASP that is only a CASP, holding no other EU authorisation, is not an addressee. That is not an inference from the press release; paragraph 9 of the EBA's own consultation paper states it directly.

For the entities the guidelines do reach, they set out a single test. Third-party arrangements supporting a "critical or important function (CIF)" — one whose disruption "would materially impair the performance of a financial entity" — get enhanced risk assessment, due diligence, contracting, subcontracting, monitoring, documentation, and exit-strategy requirements. Everything below that threshold is deliberately lighter touch, cutting what the EBA calls "unnecessary operational and supervisory burdens for less material" arrangements. The guidelines repeal the EBA's 2019 outsourcing guidelines once they take effect. A two-year transitional period applies; no fixed application date has been published yet.

The scope is narrower still, and this is where "aligned with DORA" earns its scare quotes. The EBA is explicit that ICT third-party risk "fall[s] under the scope of DORA" and is excluded here — these guidelines "only cover the use of [providers] providing or supporting functions that are not qualified as ICT services under DORA." Cloud infrastructure, custody technology, trading engines: DORA's own binding technical standards already govern those directly, for any entity DORA reaches. And DORA's addressee list, unlike this one, does include crypto-asset service providers.

That produces an odd split for any firm operating across the MiCAR perimeter. A CASP's ICT vendors — the ones that keep an exchange or a custodian actually running — sit inside DORA regardless of what else the firm is licensed to do. Its non-technology vendors — professional services, physical security, operational functions — sit inside this new EBA guideline only if the entity holds one of the licences on its addressee list: a banking authorisation, a payment or e-money institution licence, MiFID II investment firm status, or ART issuance under MiCAR. A firm that is purely a CASP, and nothing else, has no EBA non-ICT third-party risk guideline at all — only whatever its national competent authority separately requires under MiCAR Title V.

Call it "Licence-Layer Exposure": regulatory reach here tracks the specific authorisation an entity holds, not the group's crypto activity as a whole. For groups that combine a CASP registration with a banking, payment, e-money or investment-firm licence elsewhere in the same structure — not an unusual architecture for firms built around custody, card issuance or fiat on/off-ramps — the practical question is not whether the group is in scope. It is which entity within it is, and for which of that entity's vendor contracts.

A licensed banking subsidiary's outsourcing register answers to this guideline. The exchange sitting next to it in the same group, if it holds no other authorisation, does not.

The instinct on reading "aligned with DORA" is to assume the same population is affected by both. It isn't. The two frameworks split cleanly on the ICT line and, separately, on the entity line — and a MiCAR-only CASP falls on the empty side of both.

Sources: EBA press release, 18 September 2026; EBA consultation paper on the draft Guidelines on the sound management of third-party risk, paragraph 9 (Addressees) and the ICT/non-ICT scope section. Not legal advice.