Skip to main content

Outsourcing of Information Technology Services by RBI regulated entities

Reserve Bank of India (RBI) has issued directions on outsourcing of information technology services by the regulated entities.

What is the objective of the directions?

Regulated Entities (REs) have been extensively leveraging Information Technology (IT) and IT enabled Services (ITeS) to support their business models, products and services offered to their customers. REs also outsource substantial portion of their IT activities to third parties, which expose them to various risks.

The underlying principle of the directions on outsourcing of information technology services is to ensure that outsourcing arrangements neither diminish REs ability to fulfil its obligations to customers nor impede effective supervision by the Reserve Bank of India (RBI).

From when are the directions effective?

The directions on outsourcing of information technology services will come into effect from October 01, 2023.

With respect to existing outsourcing arrangements that are already in force as on the date of issuance of the directions, REs shall ensure that –

  • The agreements that are due for renewal before October 01, 2023, comply with the directions as on the renewal date (preferably), but within 12 months from the date of issuance of the directions.
  • The agreements that are due for renewal on or after October 01, 2023, comply with the directions as on the renewal date or 36 months from the date of issuance of the directions whichever is earlier.

With respect to new outsourcing arrangements, REs shall ensure that –

  • The agreements that come into force before October 01, 2023, comply with the directions as on the agreement date (preferably) but within 12 months from the date of issuance of the directions.
  • The agreements that come into force on or after October 01, 2023, shall comply with the provisions of the directions from the date of agreement itself.

Which entities are covered under the directions?

The directions shall be applicable to the following REs –

  • Commercial Banks including Foreign Banks, Local Area Banks (LABs), Small Finance Banks (SFBs), Payments Banks (PBs)
  • Primary Co-operative Banks in ‘Tier 3’ and ‘Tier 4’ as defined under revised regulatory framework for Urban Co-operative Banks (UCBs)
  • Non-Banking Financial Companies in ‘Top Layer’, ‘Upper Layer’ and ‘Middle Layer’ as defined under Scale Based Regulation (SBR) framework for NBFCs
  • Credit Information Companies (CICs)
  • All India Financial Institutions (AIFIs) –
    • Export-Import Bank of India (EXIM Bank)
    • National Bank for Agriculture and Rural Development (NABARD)
    • National Bank for Financing Infrastructure and Development (NaBFID)
    • National Housing Bank (NHB) 
    • Small Industries Development Bank of India (SIDBI)

Which arrangements are covered under the directions?

The directions shall apply to Material Outsourcing of Information Technology (IT) Services arrangements entered by the REs.

“Material Outsourcing of IT Services” are those which –

  • If disrupted or compromised shall have the potential to significantly impact the RE’s business operations; or
  • May have material impact on the RE’s customers in the event of any unauthorised access, loss or theft of customer information.

What are the regulatory and supervisory requirements in respect of outsourcing arrangements?

  • Outsourcing of any activity shall not diminish RE’s obligations as also of its Board and Senior Management, who shall be ultimately responsible for the outsourced activity. 
  • RE shall take steps to ensure that the service provider employs the same high standard of care in performing the services as would have been employed by the RE, if the same activity was not outsourced. 
  • REs shall not engage an IT service provider that would result in reputation of RE being compromised or weakened.
  • Notwithstanding whether the service provider is located in India or abroad, the REs shall ensure that the outsourcing should neither impede nor interfere with the ability of the RE to effectively oversee and manage its activities. 
  • RE shall ensure that the outsourcing does not impede the RBI in carrying out its supervisory functions and objectives.
  • REs shall ensure that the service provider, if not a group company, shall not be owned or controlled by any director, or key managerial personnel, or approver of the outsourcing arrangement of the RE, or their relatives. However, an exception to this requirement may be made with the approval of Board / Board level Committee, followed by appropriate disclosure, oversight and monitoring of such arrangements. The Board shall inter-alia ensure that there is no conflict of interest arising out of third-party engagements.

What shall be the grievance redressal mechanism under outsourcing arrangements?

  • REs shall have a robust grievance redressal mechanism that shall not be compromised in any manner on account of outsourcing, i.e., responsibility for redressal of customers’ grievances related to outsourced services shall rest with the RE.
  • Outsourcing arrangements shall not affect the rights of a customer against the RE, including the ability of the customer to obtain redressal as applicable under relevant laws.
What are other instruction regarding outsourcing arrangements?
  • REs shall evaluate the need for Outsourcing of IT Services based on comprehensive assessment of attendant benefits, risks and availability of commensurate processes to manage those risks.
  • In considering or renewing an Outsourcing of IT Services arrangement, appropriate due diligence shall be performed to assess the capability of the service provider to comply with obligations in the outsourcing agreement on an ongoing basis. 
  • REs shall ensure that their rights and obligations and those of each of their service providers are clearly defined and set out in a legally binding written agreement. 
  • RE intending to outsource any of its IT activities shall put in place a comprehensive Board approved IT outsourcing policy.
  • REs shall put in place a Risk Management framework for Outsourcing of IT Services that shall comprehensively deal with the processes and responsibilities for identification, measurement, mitigation, management, and reporting of risks associated with Outsourcing of IT Services arrangements. 
  • Public confidence and customer trust in REs is a prerequisite for their stability and reputation. Hence, REs shall seek to ensure the preservation and protection of the security and confidentiality of customer information in the custody or possession of the service provider. Access to customer information by staff of the service provider shall be on need-to-know basis. 
  • REs shall effectively assess the impact of concentration risk posed by multiple outsourcings to the same service provider and / or the concentration risk posed by outsourcing critical or material functions to a limited number of service providers. 
  • REs shall require their service providers to develop and establish a robust framework for documenting, maintaining and testing Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP).
  • REs shall have in place a management structure to monitor and control its Outsourced IT activities.
  • RE may outsource any IT activity / IT enabled service within its business group / conglomerate, subject to the conditions similar to those applicable in case of third-party.
  • The engagement of a service provider based in a different jurisdiction exposes the RE to country risk. RE shall closely monitor government policies of the jurisdiction in which the service provider is based and the political, social, economic and legal conditions on a continuous basis, as well as establish sound procedures for mitigating the country risk. 
  • The Outsourcing of IT Services policy shall contain a clear exit strategy with regard to outsourced IT activities / IT enabled services, while ensuring business continuity during and after exit.


References

Reserve Bank of India. (2023, April 10). 'Master Direction on Outsourcing of Information Technology Services'. Retrieved from https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12486&Mode=0


Follow at - Telegram   Instagram   LinkedIn   Twitter   Facebook

Labels:

Comments

Post a Comment

Popular Posts

Highlights of RBI Annual Report 2023-24 – Chapter 7 to 12

Reserve Bank of India (RBI) has published its annual report for the financial year 2023-24. In a series of articles, we will go through the highlights of the report. This is the fifth and last article in the series.  Chapter 7 – Public Debt Management Ways And Means Advances (WMA) limit for the Government of India (GoI) for H1:2023-24 (April to September 2023) was fixed at ₹1,50,000 crore and for H2:2023-24 (October 2023 to March 2024) was fixed at ₹50,000 crore. RBI issued an ultra-long security of 50-year tenor aggregating ₹30,000 crore to cater to the growing needs of long-term institutional players. Issuance of Sovereign Green Bonds (SGrBs) for an aggregate amount of ₹20,000 crore included maiden issuance of 30-year (₹10,000 crore) SGrB in addition to 5-year (₹5,000 crore) and 10-year (₹5,000 crore) SGrBs. A new 3-year benchmark security was introduced as part of government market borrowing programme during H1:2023-24.  The basket of products offered through the ‘Retail ...
Post a Comment
Read more

Lending against Gold and Silver collateral

Reserve Bank of India (RBI) has issued directions on lending against the collateral of gold and silver. To whom are the directions applicable? The directions are applicable to the following regulated entities (REs) – Commercial Banks (including Small Finance Banks, Local Area Banks and Regional Rural Banks, but excluding Payments Banks). Primary (Urban) Co-operative Banks (UCBs) & Rural Co-operative Banks (RCBs), i.e., State Co-operative Banks (StCBs) and Central Co-operative Banks (CCBs). Non-Banking Financial Companies (NBFCs), including Housing Finance Companies (HFCs). Which loans are covered under the directions? The directions shall apply to all loans offered by an RE for the purpose of consumption or income generation (including farm credit) where eligible gold or silver collateral is accepted as a collateral security. What is eligible collateral? Eligible collateral means the collateral of jewellery, ornaments or coins made of gold or silver. A lender shall not grant any ad...
Post a Comment
Read more

RBI’s Monetary Policy (June 06, 2025): In A Nutshell

The bi-monthly monetary policy of Reserve Bank of India (RBI) was announced on June 06, 2025. Here are some of the highlights of the monetary policy announcement. Rates   Change Rate Policy repo rate Reduced by 0.50% 5.50% Standing deposit facility (SDF) rate 5.25% Marginal standing facility (MSF) rate 5.75% Bank rate 5.75% Monetary policy stance Monetary policy stance was changed from ‘accommodative’ to ‘neutral’. Domestic Economy  The Indian economy presents a picture of strength, stability, and opportunity. The 5x3x3 matrix of fundamentals provides the necessary core strength to cushion the Indian economy against global spillovers and propel it to grow at a faster pace.  First, strength comes from the strong balance sheets of the 5 major sectors - corporates, banks, households, government, and the external sector.  Second, there is stability on all 3 fronts – price, financial, and political – providing policy and economic certainty.  Third, the Indian ec...
Post a Comment
Read more

Prior approvals from or intimations / reporting to RBI by NBFC-BL

Non-Banking Financial Companies (NBFCs) are required to obtain prior approvals from Reserve Bank of India (RBI) or intimate / report to RBI various events. This article lists out some of such important events where prior approvals or intimations / reporting is required for Base Layer NBFCs (NBFC-BL). Events requiring prior approval from RBI  Master Direction – Reserve Bank of India (Non-Banking Financial Company – Scale Based Regulation) Directions, 2023 dated October 19, 2023 Para 30 – NBFCs shall prepare its balance sheet and profit and loss account as on March 31 every year. Whenever an NBFC intends to extend the date of its balance sheet as per provisions of the Companies Act, 2013, it shall take prior approval of RBI before approaching the Registrar of Companies for this purpose. Even in cases where RBI and the Registrar of Companies grant extension of time, the NBFC shall furnish to RBI a proforma balance sheet (unaudited) as on March 31 of the year and the statutory returns ...
Post a Comment
Read more

Due Diligence of AePS Touchpoint Operators

Reserve Bank of India (RBI) has issued directions on due diligence of Aadhaar Enabled Payment System (AePS) touchpoint operators. What is Aadhaar Enabled Payment System (AePS)? Aadhaar Enabled Payment System (AePS) is a payment system in which transactions are enabled through Aadhaar number and biometrics / OTP authentication providing financial services such as cash withdrawal, cash deposit, fund transfer, and non-financial services such as mini statement and balance enquiry, etc. AePS is a payment system operated by National Payment Corporation of India (NPCI) that facilitates interoperable transactions using Aadhaar enabled authentication.  What is AePS touchpoint? AePS touchpoint is the terminal deployed by acquirer banks to facilitate AePS transactions, which shall include both mobile and fixed points. Who is AePS Touchpoint Operator (ATO)? AePS Touchpoint Operator (ATO) is the individual onboarded by the acquiring bank who operates the AePS touchpoint. What is the rationale b...
Post a Comment
Read more