The European Banking Authority (EBA) released guidelines in 2024 that reveal a critical gap in how financial institutions manage third-party relationships. These guidelines cover the full lifecycle of third-party arrangements across both ICT and non-ICT services, emphasizing risk assessment, due diligence, contracting, subcontracting, monitoring, documentation, and exit strategies.
Here's what happens when you skip the exit planning.
What Happened
The EBA's intervention addresses a systemic weakness: banks that can't extract themselves from failing vendor relationships. While the guidelines don't reference a specific incident, they formalize requirements that many institutions have learned through painful experience. The scope is comprehensive, applying to large banks and financial services firms across all third-party arrangements, not just technology providers.
The timing is significant. These guidelines arrive as financial institutions face increasing operational dependencies on external service providers, from cloud infrastructure to payment processing to compliance automation.
Timeline
The lifecycle failures typically unfold like this:
Initial engagement: Your procurement team selects a vendor based on capability and cost. Risk assessment focuses on onboarding requirements. Exit planning gets a checkbox in the contract template but no operational substance.
Operational phase: The vendor integrates into your critical processes. Your team builds workflows around their platform. Data accumulates in their systems. Monitoring focuses on service levels, not exit readiness.
Deterioration: The vendor's performance degrades, they announce end-of-life for your product, or they're acquired by a competitor. You discover you have no documented process to migrate data, no identified alternative providers, and no tested transition plan.
Crisis: You're forced to either accept unfavorable contract terms or execute an emergency migration that disrupts operations and exposes you to regulatory scrutiny.
Which Controls Failed or Were Missing
The EBA guidelines highlight three control failures that appear repeatedly:
Incomplete lifecycle planning: Risk assessments that stop at vendor selection. You evaluated the provider's financial stability and security posture before signing the contract, but you didn't document how you'd terminate the relationship if needed. The due diligence phase didn't include transition complexity as a risk factor.
Absent or untested exit strategies: Contracts that include termination clauses but no operational exit plan. You have the legal right to leave, but you can't exercise it because you don't know where your data lives, what dependencies exist, or how long migration would take. The exit strategy exists as a contract appendix, not as a tested procedure.
Monitoring gaps: Ongoing vendor monitoring that tracks availability and incident response but ignores exit readiness. You're measuring uptime and patch compliance, but you're not validating that data exports still work, that alternative providers remain viable, or that your team still knows how to execute the exit plan you documented three years ago.
The subcontracting dimension adds complexity. If your primary vendor relies on subcontractors you didn't assess, your exit plan may depend on relationships you don't control.
What the Relevant Standard Requires
The EBA guidelines establish lifecycle requirements that map to broader operational resilience frameworks:
Risk assessment and due diligence: Before engaging a third party, you must evaluate not just their capability to deliver services, but your ability to exit the arrangement. This includes assessing data portability, technical dependencies, and the availability of alternative providers. The assessment should inform contract negotiations, not just document decisions already made.
Contracting: Agreements must include documented exit strategies that specify data return procedures, transition assistance obligations, and timeline requirements. The contract should address subcontracting arrangements and require notification of material changes that could affect your exit options.
Ongoing vendor monitoring: Continuous monitoring must verify that exit strategies remain viable. This means periodic validation that data can be extracted in usable formats, that documented dependencies haven't changed, and that alternative providers you identified during due diligence still exist and remain suitable.
Documentation: You must maintain current documentation of third-party arrangements, including data flows, integration points, and exit procedures. This documentation should be detailed enough that someone unfamiliar with the relationship could execute the exit plan.
These requirements align with DORA's emphasis on digital operational resilience testing, which includes testing the ability to switch between ICT service providers. They also reflect principles in ISO 27001:2022 Annex A 5.19 (information security in supplier relationships) and A 5.20 (addressing information security within supplier agreements).
Lessons and Action Items for Your Team
Here's what you need to fix:
Build exit complexity into vendor selection: Add transition risk as a weighted factor in your procurement scoring. A vendor that makes exit difficult should lose points, even if they offer superior features or lower costs. During due diligence, document specifically how you would migrate to an alternative provider, and use that assessment to negotiate contract terms.
Create operational exit plans, not contract clauses: For each critical third-party arrangement, document the step-by-step process to terminate the relationship. Identify who owns each step, what data must be extracted, which systems must be reconfigured, and how long each phase will take. Include specific technical requirements: file formats for data export, API endpoints that must be replicated, integration points that must be rebuilt.
Test your exit strategies annually: Pick one critical vendor relationship each quarter and validate that your documented exit plan still works. Export a sample dataset and verify it's complete and usable. Confirm that alternative providers you identified still offer compatible services. Update the plan based on what you learn.
Monitor subcontracting changes: Require vendors to notify you when they add or change subcontractors that support your services. Assess whether those changes affect your exit options. If your vendor's new cloud provider makes data export more difficult, update your exit plan and timeline.
Measure exit readiness, not just service delivery: Add exit plan currency to your vendor scorecard. Track when each plan was last reviewed, when data export was last tested, and when alternative providers were last validated. Treat an outdated exit plan as a control deficiency that requires remediation.
The EBA guidelines don't just apply to European banks. If you manage third-party risk in any regulated industry, the lifecycle approach they mandate represents the current regulatory expectation. Your vendor relationships aren't just about what they deliver today but about what happens when they can't deliver tomorrow.
