A regulatory outsourcing register is a structured inventory, required by financial regulators, of the functions a firm has contracted out to service providers. For each arrangement it records the provider and any parent company, the service, the start and renewal dates, the governing law, the countries where the service is performed and data is stored, whether the function is critical or important, and the date of the last risk assessment. Critical arrangements carry extra detail.
In the European Union the register was introduced by the European Banking Authority's outsourcing guidelines, which have applied since 2019, and the Digital Operational Resilience Act now requires a register of information on all contracts for technology services, to be submitted to supervisors. United Kingdom regulators set similar expectations. Supervisors use the registers to identify concentration on particular suppliers, which informs critical third-party oversight. Within the firm it supports third-party risk management, vendor risk management and operational resilience mapping.