Outsourcing Registers - Submission Requirements

Context

The Central Bank has referenced in its 2026 Regulatory & Supervisory Outlook the heightened risk posed to the operational resilience of financial services firms due to increased operational complexity including complex supply chains.

• The Central Bank is of the view that the maintenance of appropriate records (database/register) in relation to a Regulated Financial Service Provider’s (RFSP) third-parties is critical to facilitate RFSPs to maintain a holistic view of third-party arrangements and is essential in managing the related risks appropriately.

  The Central Bank has historically collected data maintained by RFSPs on their third-party outsourcing arrangements (Outsourcing Registers). These RFSPs carry on business in the Banking and Payments, Insurance, and Capital Markets and Funds sectors and the original selection was based on supervisory risk and impact ratings.

• The collected information is used both in supervisory risk assessments, to facilitate the identification of potential systemic third-party concentration risks and importantly to enable the Central Bank of Ireland to quickly identify incidents at individual financial service providers that may represent early warnings of potentially systemic issues for the Irish Financial system.

In 2025 the Central Bank of Ireland paused its domestic collection of these Outsourcing Registers while financial entities were preparing for the first collection and submission of registers of information under the Digital Operational Resilience Act (DORA). (note domestic collection refers to the Central Bank of Ireland direct collection, excluding ECB collections from Significant Institutions)

Given the two year pause and evolving third-party risks, it is important that the Central Bank refresh the data it has on the use of outsourcing arrangements (that are not covered in the DORA register).

The 2027 Collection

The Central Bank of Ireland will resume the collection of domestic Outsourcing Registers in February 2027 with the following provisions intended to minimise burden for RFSPs in this collection:

• Early notice of this collection with a deadline of 28 February 2027 with a data reference date of 31 December 2026.
• Limiting the scope of RFSPs required to submit their updated Outsourcing Register in this collection to those financial service providers which submitted Outsourcing Registers to the Central Bank of Ireland in the previous 2024 cycle.  
• Using the same template format as previous collections.

• For RFSPs which are also in scope of the DORA Registers of Information (ROI) collection: in this submission RFSPs may either leave in, or remove data which has already been submitted as part of the DORA ROI submissions. The Central Bank does not have a preference; RFSPs should choose whichever approach minimises their effort. The Central Bank is not seeking to collect DORA ROI information twice.

The Central Bank of Ireland will contact RFSPs within scope of this data collection exercise in Q4 2026 with further details.

Submission Requirements

As set out in the Cross-Industry Guidance on Outsourcing and associated Feedback Statement published in December 2021, the Central Bank of Ireland (the “Central Bank”) expects that each regulated financial service provider (RFSPs) will establish and maintain an outsourcing register.  The Central Bank has developed a template for recording all relevant outsourcing arrangements and for reporting purposes. 

Scope 

All RFSPs whose PRISM Impact Rating is Medium Low or above (or its equivalent) and other additionally designated and notified firms are required to submit their completed reporting template to the Central Bank via the Central Bank Portal. 

The completed Outsourcing Register return file should be uploaded in the Central Bank Portal.

All other RFSPs should use the relevant industry template to guide the completion of their registers and be prepared to provide the register to supervisors on request or as part of a subsequent collection of registers by the Central Bank.

Template and Guidance Note

The Register Templates and associated Guidance Note, which includes instructions for completion and submission of the register for each sector via the Portal are provided below:

Banking (LSIs)

Insurance

Payments & E-Money Firms

Markets Firms

Contact Details for further Clarification and Queries

If you have any queries or require further clarifications, please direct these to outsourcing.register@centralbank.ie.  Please keep your Central Bank Supervisory Contact in copy of any correspondence to the mailbox. 

Technical queries or issues relating to Portal access can be submitted through the 'submit a request' function on the Portal. Alternatively, you can contact the Online Reporting helpline at 01 224 4545 or email onlinereturns@centralbank.ie.