The EBA Outsourcing Guidelines set strict conditions for managing third-party services. They require clear contracts, defined accountability, and constant oversight. When providers handle sensitive data or critical functions, every access point must be planned, documented, and approved. Ad hoc access — temporary or emergency — is the highest risk. It bypasses normal