Offboarding
Also called vendor offboarding, supplier exit, third-party termination
Offboarding is the controlled end of a relationship with a supplier. The firm stops the service, recovers or deletes its data, removes the supplier's system and building access, settles the contract and moves the work to another provider or in house. Done badly, it leaves data exposed and services disrupted.
How it works
Offboarding starts when a contract expires, a supplier fails a review or the firm changes strategy. A named owner runs a checklist. Data is returned in a usable format and deletion is confirmed in writing. Accounts, keys and network links are revoked. Open invoices, licences and subcontractor obligations are closed, and the inventory is updated.
Regulators treat exit as part of the third-party life cycle. Firms must plan exits for critical services before they sign, and show that a service can move without breaching their own obligations to customers. Poor offboarding is a common source of data breaches, because former suppliers keep access or copies of records after the relationship ends.
The rules
Article 28 requires exit strategies for ICT services supporting critical or important functions, and termination rights where a provider breaches law or contract terms.
EU financial entities within the scope of DORARequire documented exit strategies for critical or important outsourcing. EBA/GL/2026/09, published 18 September 2026, will repeal them once it applies.
Credit institutions, investment firms, payment and e-money institutionsExpects firms to have stressed exit plans for material outsourcing, covering both orderly termination and sudden supplier failure.
Banks, building societies, PRA-designated investment firms and insurersTreats termination as a stage of the third-party life cycle, covering transition of services, return or destruction of data and removal of access.
US banking organisations supervised by the three agenciesCommon questions
Does offboarding also apply to customers?
Yes. Banks also use the term for closing customer relationships, for example after due diligence fails or risk appetite changes. That process follows AML and consumer rules. In third-party risk management, offboarding means ending a relationship with a supplier.
What is the difference between an exit strategy and offboarding?
An exit strategy is the plan written before or during the contract. Offboarding is carrying it out. Regulators expect firms to have exit plans for critical services and to be able to execute them without disrupting customers.
What usually goes wrong in vendor offboarding?
Common failures include former suppliers keeping system access, data that is never returned or deleted, and subcontractors left out of the process. Missing contract clauses on data return and transition support make each of these harder to fix.
