Global Trustee and Fiduciary Services Bite-Sized Issue 10 2026

8 AIFMD CRYPTOASSETS FINTECH FUND LIQUIDITY OPERATIONAL RESILIENCE SUSTAINABLE FINANCE/ ESG T+1 ASIA PACIFIC EUROPE NORTH AMERICA UNITED KINGDOM Global Trustee and Fiduciary Services Bite-Sized | Issue 10 | 2026 Quick Links EBA Publishes Guidelines on the Management of Third-party Risk On 18 September 2026, the European Banking Authority (EBA) published Guidelines on third- party arrangements supporting critical or important functions, the disruption of which would materially impair the performance of a financial entity. The EBA says that by concentrating on these higher-risk arrangements, the Guidelines reduce unnecessary operational and supervisory burdens for less material ones while maintaining sound risk management. The EBA says the Guidelines promote a holistic approach to third-party risk management across ICT and non-ICT services and cover the full lifecycle of third-party arrangements, including risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies. The EBA says they reflect stakeholders feedback received during public consultation and through targeted outreach activities and consider international standards, including the Basel Committee on Banking Supervision (BCBS) Principles for the SoundManagement of Third-Party Risk. The EBA says that once the Guidelines come into effect, there will be a two-year transitional period aimed to support a smooth and proportionate implementation. Link to the Guidelines here Global Standard-setting Bodies Publish a Toolkit for Cyber Resilience at FMIs and a Discussion Paper on FMIs’ Reliance on Third-party Service Providers On 8 September 2026, The Bank for International Settlements (BIS) Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) published the Cyber resilience toolkit: practical considerations for financial market infrastructures (FMIs) (toolkit) and FMIs’ reliance on third-party service providers: challenges and risks (discussion paper). BIS says the toolkit provides practical considerations to support FMIs in strengthening their cyber resilience frameworks and implementing operational resilience-related components of the CPMI-IOSCO Principles for FMIs (PFMI). It comprises a set of voluntary, non-binding tools covering several broad topics relevant to cyber resilience and is designed to complement the 2016 CPMI-IOSCO Guidance on cyber resilience for financial market infrastructures. BIS says the discussion paper identifies and examines several key challenges related to the provision of third-party services to FMIs, especially for the delivery of critical services. The paper sets out several questions for stakeholders to provide feedback on the identified risks and on potential further engagement. The comment period closes on 1 December 2026 Link to the Toolkit here Link to the Discussion Paper here Frontier AI and Cyber Resilience On 2 September 2026, the Financial Conduct Authority (FCA) published its findings from a review of firms on how frontier AI may affect cyber resilience, governance and vulnerability management for firms. The FCA says it conducted the review so it could understand how firms are using, testing and preparing for frontier AI models with cyber capabilities. The FCA says the main themes firms reported during its review included: • Vulnerability discovery is accelerating faster than firms’ ability to respond: Firms told the FCA that frontier AI is increasingly supporting the identification, validation and prioritisation of vulnerabilities, increasing the pressure on firms’ remediation processes. • Frontier AI is becoming a test of organisational resilience, not just a tool: The FCA says frontier AI is revealing whether firms have the right governance, risk ownership, engineering capacity and remediation processes needed to act on AI-generated vulnerability discovery.