Clarification on How the Guidelines Impact Vendors Whose Products are Not Deemed as Outsourcing Arrangements

In light of the EBA's clarification(pages 88 and 89) we understand that the purchase of standardized/licensed software or services, such as those supporting IT platforms (e.g., web hosting, DDoS systems, data backup processes), does not fall within the scope of outsourcing (as per the EBA's response to related queries). Paragraphs 24 and 25 on page 11, however, require financial institutions to assess risks from third-party arrangements, even if not classified as outsourcing. As a vendor providing non-outsourcing arrangements, we seek clarification on whether the EBA requires financial institutions to mandate compliance with the EBA outsourcing guidelines in our case, considering our offerings are explicitly excluded from the outsourcing definition. Can financial institutions require compliance with these guidelines, citing them as a compulsory regulatory requirement, even when our offerings do not qualify as outsourcing arrangements?

As the corporate counsel for a company that provides standardized hardware and software (WAF, load balancing hardware and software, hosting, and distributed denial-of-service (DDoS) systems.  I am reaching out regarding a recurrent concern in my negotiations of agreements with financial institutions.  Our customers consistently require from us to comply with the comprehensive EBA Guidelines for Outsourcing arrangements. We find this approach to be a bit disproportional to the engagement particularly considering the EBA's explicit clarification that our offerings, which include standardized hardware and software, fall outside the classification of outsourcing arrangements.  We are looking for clarity from the EBA to establish that (i) Arrangements that are not classified as outsourcing do not need to be mandated to comply with outsourcing guidelines; (ii) risk-proportionate arrangements with vendors need to be made through fair commercial negotiations rather than being unilaterally imposed on vendors in the guise of regulatory requirements.  We recognize and respect these obligations and seek clarity on how they apply specifically to arrangements that fall outside the scope of outsourcing as defined by the EBA.