The Reserve Bank of India (RBI) on November 28, 2025 issued the Reserve Bank of India (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025, establishing a unified and stringent framework for identifying, managing, and mitigating risks arising from outsourcing of financial and IT services by commercial banks. These Directions aim to ensure that outsourcing does not dilute a bank’s responsibility, compromise customer interests, or create systemic vulnerabilities.
The Directions mandate board-approved outsourcing policies, clear accountability structures, senior management oversight, comprehensive risk assessments, and strong controls over confidentiality, data security, auditability, business continuity, and grievance redressal. Banks must evaluate service providers, execute robust outsourcing agreements, monitor subcontracting, assess offshore arrangements, and enforce business continuity and exit strategies—especially for IT and cloud-based services.
Overall, the framework enhances operational resilience by ensuring prudent governance of outsourced functions, including IT systems, cloud usage, security operations centres (SOC), and group-level or cross-border outsourcing arrangements, while preserving consumer protection and regulatory compliance.
[Notification No. RBI/DOR/2025-26/171]
