On 18 September 2026, the European Banking Authority (EBA) published its final guidelines on third-party risk management for non-ICT services. The EBA develops rules and guidelines for the banking sector and promotes consistent supervision across the EU. The underlying principle is to align risk management with the potential impact of a disruption. External parties supporting critical or important functions therefore require greater attention. The guidelines have been published but are not yet applicable.
Although the guidelines target financial institutions, their approach also offers practical guidance for other organisations in the Netherlands and Belgium. Which suppliers require more extensive checks and closer monitoring? It starts with one question: what would happen to your organisation if this supplier were to fail tomorrow?
What is third-party risk management?
Third-party risk management involves identifying, assessing and managing risks associated with relationships with external parties, such as suppliers, service providers and subcontractors. You assess not only their reliability and resilience, but also how dependent your organisation is on them.
A credit check provides insight into a supplier's financial health. However, the consequences of a disruption also depend on what the supplier provides and how quickly you can switch to an alternative. For example, a small supplier with a low procurement value might provide a component without which your production would come to a standstill.
Determine which suppliers are critical to your organisation
To allocate your attention effectively, you need to combine financial information with knowledge of your own business processes. Assess each supplier based on the following criteria:
- Impact: Which processes, products or services would be at risk if the supplier failed?
- Replaceability: Is an alternative available, and how long would it take to switch?
- Access: Does the supplier have access to critical data or essential systems?
- Dependencies: Which subcontractors are required to ensure delivery?
This helps you distinguish between a supplier that can easily be replaced and one whose failure would directly affect your operations. That distinction determines how thorough your assessment needs to be and how closely you should monitor developments.
Interesting read: Top 5 supplier risks and how to manage them
Look beyond your suppliers: where do risks converge?
When assessing suppliers, it is important to look beyond your direct contractual partners. You might purchase from three different suppliers while still depending on a single manufacturer. If that manufacturer fails, all three suppliers could experience problems at the same time.
This concentration risk is also addressed in the EU ICT Supply Chain Security Toolbox, published in February 2026. The toolbox provides recommendations for ICT supply chain security, including multi-vendor strategies to diversify dependencies. It is a practical resource, not a general legal requirement for supplier management.
The broader lesson is that having multiple suppliers only provides alternatives if they are sufficiently independent of one another. Therefore, investigate corporate relationships, key subcontractors and shared production sites. Also check whether an alternative supplier has sufficient capacity and can take over in time.
Manage risk throughout the entire relationship
Once you have identified critical suppliers and mapped where dependencies converge, you can implement appropriate measures. These should go beyond the initial assessment during onboarding.
The EBA guidelines therefore address the entire lifecycle of a relationship: risk assessment, due diligence, contracting, subcontracting, monitoring and exit. Findings from your assessment should be reflected in your contractual agreements and in how you monitor the relationship over time.
For example, if a supplier is difficult to replace, you should establish continuity arrangements in advance and assess what a potential transition would involve. If a supplier depends heavily on a subcontractor, discuss how you will be kept informed of changes affecting that party.
Interesting read: Your supplier database is not what you think it is: that could cost you money
Turn a risk signal into concrete action
During the course of a relationship, payment difficulties, a deteriorating credit score or an acquisition may trigger a reassessment of risk. Monitoring helps identify these changes. For Trade Credit Risk and Supplier Risk, the next question is what action should follow.
For a critical supplier, a deterioration in financial health may be a reason to initiate a conversation immediately and prepare an alternative. For a supplier that is easy to replace, less intensive monitoring may be sufficient.
Therefore, establish who is responsible for assessing risk signals, when intervention is required and which measures are available. This connects up-to-date information with the dependencies you have already mapped.
What does this mean in practice?
Follow these five steps to make third-party risk management an integral part of your supplier management policy:
- Segment suppliers by criticality and dependency. Determine which parties are essential to your operations.
- Identify vulnerable links. Investigate where the failure of a single party could bring a process to a standstill.
- Check the supply chain behind your suppliers. Map where subcontractors and shared dependencies introduce additional risks.
- Align due diligence and monitoring with the potential impact. Focus your checks on suppliers whose failure could have the greatest consequences for business continuity.
- Determine the appropriate response in advance. Define responsibilities, alternative suppliers and exit options.
Effective third-party risk management is about giving the right suppliers the right level of attention. By combining financial insights with an understanding of your dependencies, you can determine where additional checks are needed and when to take action.
Want greater control over your supplier risks? Discover how our Supplier Risk solutions help you assess suppliers and identify risks in a timely manner. Or discuss your challenges with one of our experts.
