Why lifecycle management and proportionality are becoming central to third-party risk

Third-party risk management is moving further away from a point-in-time compliance exercise.

On September 18, 2026, the European Banking Authority published its final Guidelines on the management of third-party risk. The guidelines focus on third-party arrangements supporting critical or important functions and promote a more proportionate and consistent approach aligned with DORA.

The guidelines take a holistic view of third-party risk across both ICT and non-ICT services and cover the lifecycle of third-party arrangements, including risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies. A two-year transitional period is included for implementation.

Why the lifecycle matters

The regulatory focus is significant because the risk of a third-party relationship does not end once onboarding is complete.

A supplier can change its technology environment, subcontractors, financial position, cyber posture or operating circumstances during the relationship.

A governance model based entirely on the original assessment can therefore become outdated.

A lifecycle approach instead connects:

Screen Third-Parties → Onboard & Segmentation → Assess Risks → Monitor Risks Real-Time → Monitor Performance → Governance & Compliance → Offboard Third-Party

This lifecycle is also the operating model reflected in Enlighta’s Continuous TPRM framework.

Proportionality changes the way organizations think about due diligence

The EBA’s guidelines focus on third-party arrangements supporting critical or important functions, recognizing that not all relationships present the same degree of risk.

This has an important operational implication.

TPRM programs need to understand the context of the relationship:

• What service does the third party provide?
• How critical is that service?
• What information or systems can it access?
• What business impact could result from disruption?
• What subcontractors or dependencies are involved?
• What risk signals already exist?

That context can then inform the depth of due diligence and the level of ongoing oversight.

Continuous monitoring closes the gap

Risk assessment establishes an initial understanding of exposure.

Continuous monitoring helps determine whether that exposure is changing.

External signals such as cyber-risk developments, sanctions changes, adverse events, financial indicators or supply-chain developments can provide early indications that a vendor’s risk profile may need to be reconsidered.

Enlighta’s internal TPRM framework specifically identifies continuous monitoring of cyber risk, sanctions and adverse events, along with fourth-party and supply-chain risk, as part of the broader lifecycle.

Monitoring should lead to action

A monitoring program becomes operational when risk information is connected to the next step.

That may mean:

Risk Signal → Vendor Context → Assessment → Workflow → Remediation → Governance

Rather than creating another disconnected dashboard, the objective is to connect intelligence to the vendor record, relevant risk assessment, evidence, issues and corrective actions.

Enlighta’s platform includes risk assessments, risk registers, risk scorecards, issues and actions, risk audits, evidence validation, contracts, SLAs and obligations, performance and governance capabilities.

Exit is part of the lifecycle

The EBA guidelines also include exit strategies as part of third-party risk management.

For critical relationships, exit cannot be treated as an administrative event at the end of a contract.

Organizations need visibility into the services being provided, contractual obligations, dependencies, stakeholders and potential business impact.

This makes lifecycle governance important not just for onboarding and monitoring, but also for transition and offboarding.

How Enlighta helps

Enlighta connects screening, onboarding and segmentation, risk assessment, real-time monitoring, performance management, governance and compliance, contracts and obligations, and third-party offboarding in one platform.

External data feeds can also be integrated into the broader TPRM process, including vendor data, sanctions and PEP data, market data and other risk signals. The platform supports fourth- and fifth-party information, risk issues and actions, risk audits, risk registers and scorecards.

This creates a lifecycle-oriented approach in which third-party risk can continue to be assessed and governed throughout the relationship.

What this means for TPRM leaders

The EBA’s final guidelines reinforce an evolution already underway in third-party risk management:

from periodic assessment to lifecycle management, and from uniform treatment to risk-proportionate oversight.

For organizations managing complex third-party ecosystems, the operational challenge is connecting those principles to day-to-day processes.

The more seamlessly risk intelligence, assessments, monitoring, contracts, performance and governance work together, the easier it becomes to maintain visibility throughout the relationship.

Source: European Banking Authority, The EBA publishes its final Guidelines on the management of third-party risk, September 18, 2026.

See Enlighta Continuous TPRM in Action →