EBA Outsourcing Guidelines set the rules for when and how developer access is granted. These rules are not optional. They are regulatory requirements designed to protect operational integrity and customer data in outsourced development. Fail them, and you face both compliance penalties and security gaps.
Under the EBA Outsourcing Guidelines, any developer—whether internal, contracted, or offshore—must have access rights defined, documented, and approved before touching production systems. Access scope must match task scope. No more, no less. This means temporary credentials, time-bound permissions, and strict revocation once work is done.
Audit logs are not afterthoughts. Record every login, every code push, every configuration change. Logs must be reviewed regularly and stored securely. You must be able to show the regulator when, why, and by whom every change was made.
Segregation of duties matters. The person writing the code should not be the same person deploying it without oversight. Use separate environments. Keep sensitive data masked or out of reach in development sandboxes. The EBA guidelines expect you to cut risk at every link in the chain.