A&O Shearman was formed in 2024 via the merger of two historic firms, Allen & Overy and Shearman & Sterling. With nearly 4,000 lawyers globally, we are equally fluent in English law, U.S. law and the laws of the world’s most dynamic markets.
This combination creates a new kind of law firm, one built to achieve unparalleled outcomes for our clients on their most complex, multijurisdictional matters – everywhere in the world. A firm that advises at the forefront of the forces changing the current of global business and that is unrivalled in its global strength.
Our clients benefit from the collective experience of teams who work with many of the world’s most influential companies and institutions, and have a history of precedent-setting innovations.
Together our lawyers advise more than a third of NYSE-listed businesses, a fifth of the NASDAQ and a notable proportion of the London Stock Exchange, the Euronext, Euronext Paris and the Tokyo and Hong Kong Stock Exchanges.
The European Banking Authority has introduced comprehensive new guidelines governing third-party risk management for non-ICT services, fundamentally reshaping how financial institutions must structure and manage their vendor relationships. These guidelines mandate specific contractual provisions and impose strict timelines for compliance, with existing arrangements requiring alignment within two years for critical functions. Financial services entities must now navigate a more prescriptive regulatory framew
On September 18, 2026, the European Banking Authority (EBA) published its final guidelines on the sound management of third-party risk relating to non-ICT services, replacing the EBA's 2019 Guidelines on outsourcing arrangements. Among the most notable changes is a more prescriptive list of clauses that must be included in third-party arrangements, including outsourcing agreements, with more detailed guidance on how those must address various risks. The new requirements will apply to all new third-party arrangements, with a requirement on firms to bring existing third-party arrangements, including outsourcings, for critical or important functions agreements into line within two years. For other arrangements, amendments are needed at the point of renewal or amendment.
Our bulletin below considers the new contractual requirements in detail and proposes key action points for financial services entities in-scope of the guidelines.
The content of this article is intended to provide a general guide
to the subject matter. Specialist advice should be sought about your
specific circumstances.
