On September 24, 2026, the European Banking Authority published final Guidelines on third-party risk management, built on the same operating logic as the Digital Operational Resilience Act but extended well past ICT services: any ongoing arrangement supporting a critical or important function must now go through initial risk assessment, due diligence, formal contracting, subcontracting oversight, continuous performance monitoring, full record-keeping, and a documented exit plan. Firms get a two-year transitional window to adapt. What they do not get is an option to treat a questionnaire filed once at onboarding as evidence that any of the later stages are happening.
That is the quiet significance of the EBA's move, and it lands well beyond the EU banks it directly binds. It is a regulator formally codifying something TPRM and procurement teams have known operationally for years: the vendor questionnaire is necessary, structurally sound, and still not sufficient on its own to satisfy what "third-party oversight" now means. This piece walks through what the Guidelines actually change, why the questionnaire alone was never built to carry a continuous-monitoring standard, and the eight-signal intelligence stack that closes the gap without discarding the questionnaire that still anchors it.
Most TPRM programs can show a completed questionnaire. Fewer can show what changed about that vendor in the eighteen months since. See how an AI-powered third-party risk platform keeps the whole relationship current, not just the file that was opened it.
Explore the TPRM PlatformThe Questionnaire's Ceiling
A well-built vendor risk questionnaire does real work. It forces a vendor to formally state its scope of service, the controls it claims to operate, where and how it handles data, and which subcontractors sit behind it — a structured, comparable baseline that no external signal can fully reconstruct on its own. Most regulatory frameworks, the EBA's included, still expect documented due diligence of exactly this kind at the point a relationship is contracted. None of that is in question.
What is in question is how far that baseline can be stretched to cover everything a full-lifecycle oversight standard now expects. A questionnaire answered in March describes the vendor as it existed, or as it chose to describe itself, in March. It says nothing about a funding shortfall that surfaces in July, a subcontractor swapped in September without notice, a license that lapses at year-end, or a sanctions designation that lands on a beneficial owner the following spring. Annual or biennial refresh cycles were always a compromise between thoroughness and operational feasibility, not a claim that risk itself only changes once a year. A regulator writing "ongoing monitoring" and "continuous" directly into supervisory text removes the option to treat that compromise as adequate.
The efficiency case for moving past questionnaire-only TPRM has been made well already, including on this site. What the EBA's Guidelines add is a compliance case that does not depend on anyone accepting the efficiency argument first: for the firms in scope, a program that cannot show ongoing monitoring and current record-keeping across a vendor relationship's full lifecycle is not merely suboptimal, it is out of step with what a supervisor now expects to see on examination.
What the EBA Just Wrote Into Rule Text
DORA, in force across the EU since January 2025, set the original template for ICT third-party oversight: financial entities maintain a register of information on ICT arrangements, assess concentration risk across critical providers, and submit the most systemically important ICT third parties to a dedicated EU-level oversight framework. It was, deliberately, an ICT-specific regime built for a specific risk: operational resilience of digital infrastructure.
The EBA's September 2026 Guidelines generalize that same discipline — a unified register, full-lifecycle management, continuous monitoring — across non-ICT third-party arrangements as well, provided the function they support is critical or important. A payroll processor, a facilities provider running physical access control, a specialist outsourced compliance function: any of these can now fall under the same expectations previously reserved for cloud and core-banking technology vendors, if disruption to that specific function would materially affect the institution. The Guidelines draw explicitly on Basel Committee principles for third-party risk management, and by narrowing formal scope to genuinely critical functions while broadening what those functions must go through, the EBA is deliberately trading breadth for depth: fewer vendors captured, but a materially higher bar for each one that is.
Two implications follow directly for a TPRM program. First, a unified ICT-and-non-ICT register means vendor risk can no longer sit in separate systems run by separate teams on separate cadences — IT security's register and procurement's vendor list have to converge into one continuously current view. Second, "record-keeping" across the full lifecycle is itself a standing requirement, not a byproduct of doing the work well; a program needs to be able to show, on request, when a vendor was last screened, what changed, and who decided what to do about it — which is a considerably higher evidentiary bar than producing a completed questionnaire from eighteen months ago.
ISACA's research on the shift from questionnaire fatigue to contextual assurance puts the operational reasoning bluntly: conventional TPRM built on annual questionnaires and point-in-time audits "generate paperwork, not protection," and roughly 30% of breaches, per Verizon's data, trace back to third-party involvement. Regulation and operational reality are converging on the same conclusion from different directions — one is writing continuous oversight into supervisory text, the other is measuring the cost of not having it.
Crest's TPRM Agents hold questionnaire, sanctions, financial, adverse-media, and vulnerability signals open simultaneously for every active vendor — surfacing what changed, with the evidence already attached, instead of waiting for next year's review to find out.
The Eight-Signal Stack
A full-lifecycle standard does not require abandoning the questionnaire — it requires stacking seven more continuously refreshed signals on top of it, so the risk picture updates as the vendor's actual circumstances change rather than only when someone remembers to ask again.
Anchor With the Questionnaire
Capture the vendor's own account of scope, controls, data flows, and subcontractors as the structured starting baseline — necessary, but not the finished picture.
Verify Entity and Authenticity
Confirm the vendor's legal registration and status, and verify that the person completing the questionnaire is actually authorized to answer on the vendor's behalf.
Track Financial Health
Monitor solvency indicators, credit signals, and funding events on an ongoing basis — financial distress changes the reliability of every other answer on file.
Screen Regulatory and Licensing Status
Confirm required licenses, registrations, and certifications remain current, not only valid on the day the questionnaire was submitted.
Screen Sanctions and Ownership Exposure
Re-screen the vendor and its beneficial owners against sanctions and PEP data on every list update, not on a fixed annual cycle.
Monitor Adverse Media
Track structured and open-source coverage continuously, surfacing litigation or enforcement action no official list has caught up to yet.
Monitor Cyber and Vulnerability Exposure
Track external attack-surface and vulnerability signals directly, rather than relying only on a vendor's self-attested security posture.
Layer Geopolitical and Concentration Signals
Add export-control, conflict-exposure, and supply-concentration signals to complete a single, continuously refreshed dynamic risk profile.
What Changes for a TPRM or Compliance Team
- Keep the questionnaire — reposition it. It remains the only source for a vendor's own account of its scope and controls; it stops being asked to carry a continuous-monitoring standard on its own.
- Unify the register. The EBA's Guidelines expect one ICT-and-non-ICT view, not separate lists run by separate teams on separate schedules.
- Treat record-keeping as a deliverable, not a byproduct. Being able to show when a vendor was last screened, what changed, and who decided what to do about it is now part of the standard itself.
- Plan for the two-year transition as a build-out window, not a deadline to react to at the end of it — the earlier a unified, continuously monitored register exists, the less disruptive the final compliance date becomes.
From Point-in-Time to Continuous
Two related arguments already sit alongside this one on this site, and it is worth being clear about how this piece differs from both. Continuous Monitoring TPRM: Real-Time Vendor Risk Scores made the capability case — the eight-capability framework a platform needs to turn a static score into a live one. The Questionnaire Isn't the Point of TPRM Anymore made the efficiency case — why signal beats snapshot even before any regulator gets involved. This piece makes the compliance case: the EBA has now written a full-lifecycle, continuously monitored standard directly into supervisory text, which means the shift from point-in-time to continuous is no longer optional best practice for firms in scope — it is what "adequate third-party oversight" is coming to mean by rule.
Agentic AI is what makes running eight continuously refreshed signals across a full vendor portfolio operationally realistic rather than aspirational. A standing agent can hold each vendor's full signal stack open simultaneously — re-screening sanctions and PEP data on every list update, tracking financial and licensing status, watching adverse media and vulnerability feeds continuously — and correlate findings across signals rather than surfacing each one in isolation, so a flagged change arrives with the evidence already attached rather than as a bare alert someone has to go investigate from scratch. Human-in-the-loop governance stays intact throughout: what a flagged change means for the relationship, escalation, enhanced due diligence, offboarding, remains a named risk owner's decision. What the agent changes is how quickly that owner learns there is a decision to make, and how complete the record looks when a supervisor asks how it was reached.
That combination — a structured questionnaire baseline plus a continuously refreshed intelligence stack sitting on top of it — is the practical shape of compliance with a full-lifecycle standard, regardless of which regulator's text a given firm is reading. It does not require discarding what the questionnaire does well. It requires no longer asking the questionnaire to do the parts of the job it was never built to do alone.
Crest Perspective
The vendor questionnaire was designed for a world where risk was assessed annually. Continuous risk intelligence does not replace the questionnaire — it answers the question the questionnaire cannot: what changed between the last assessment and today? The two signals are complementary: the structured assessment establishes a baseline; continuous monitoring detects when that baseline has been invalidated by events the vendor did not self-report.
Frequently Asked Questions
A vendor risk questionnaire is a structured, point-in-time self-report — the vendor answers a defined set of questions about its controls, data handling, subcontractors, and compliance posture, typically once at onboarding and again at a scheduled review, often a year or more later. Continuous third-party risk intelligence is an ongoing, multi-signal monitoring layer that runs alongside the questionnaire rather than replacing it, pulling in entity verification, sanctions and beneficial-ownership screening, financial health signals, adverse media, external cyber and vulnerability exposure, regulatory and licensing status, and geopolitical or concentration signals, refreshed continuously rather than on a fixed review cycle. The questionnaire answers what a vendor says about itself at one moment. Continuous risk intelligence tracks what is actually changing about that vendor between the moments anyone asks.
On September 24, 2026, the European Banking Authority published final Guidelines on third-party risk management, aligned with the Digital Operational Resilience Act and extending a similar full-lifecycle standard to non-ICT third-party arrangements. The Guidelines narrow formal scope to arrangements supporting critical or important functions, but for those in-scope arrangements they mandate a unified approach spanning initial risk assessment, due diligence, contract terms, subcontracting oversight, ongoing performance monitoring, record-keeping, and documented exit planning, with a two-year transitional period for firms to adapt. The Guidelines bind EU-supervised financial entities directly, but the underlying shift they codify mirrors direction already visible in other jurisdictions' TPRM guidance, making it a useful signal for any enterprise's third-party program regardless of geography.
DORA, in force since January 2025, set the original template: EU financial entities maintain a register of information on ICT third-party arrangements, assess concentration risk, and submit critical ICT third-party providers to a dedicated EU-level oversight framework. The EBA's September 2026 Guidelines generalize that same logic, full lifecycle management, ongoing monitoring, a unified register, beyond ICT services to non-ICT third-party arrangements supporting critical or important functions. For a firm already building DORA compliance, this is less a new regime to stand up than an extension of the same register, monitoring cadence, and governance discipline to a wider set of vendor relationships, including many previously treated as lower-priority because they sat outside IT.
No, and treating it as a replacement misreads what each does well. The questionnaire remains the only mechanism that captures a vendor's own account of its control environment, data flows, subcontractor relationships, and scope of service, and most regulatory frameworks, including the EBA's, still expect documented due diligence at the contracting stage. What changes is the questionnaire's role: it becomes the structured baseline a relationship starts from, not the full risk picture a program relies on indefinitely. Continuous intelligence layers on top of that baseline, catching the changes, a new sanctions designation, a funding shortfall, an unpatched vulnerability, a lapsed license, that occur between scheduled questionnaire refreshes, when most of a vendor relationship's actual life happens.
Running eight or more independent signal sources, sanctions lists, adverse media, financial data, vulnerability feeds, regulatory registers, continuously across a portfolio of hundreds or thousands of vendors is not a task a compliance or procurement team can perform manually at any useful frequency, which is why most programs default back to periodic, questionnaire-only reviews despite knowing the gap. Agentic AI closes that gap by holding each vendor's full signal stack open continuously: re-screening automatically on every list or data update, correlating findings across signals rather than reviewing each in isolation, and routing a genuine change, not noise, into a workflow with the evidence already attached. A named risk owner still decides what a flagged change means for the relationship; what the agent changes is how quickly that owner learns there is a decision to make, and how complete the evidence trail looks when a regulator asks how the decision was reached.