The Reserve Bank of India (RBI) on November 28, 2025 issued Directions for Payments Banks to manage risks arising from outsourcing of financial and IT services. The Directions apply to all Payments Banks and require immediate compliance, with existing IT outsourcing agreements to be aligned by April 10, 2026. Key definitions, scope, and applicability are clarified, emphasizing that outsourcing does not diminish the ultimate responsibility of the bank’s Board and Senior Management for outsourced activities, including regulatory compliance and customer obligations.
The Directions mandate that banks implement Board-approved outsourcing policies and establish a robust governance framework, including clearly defined roles for Senior Management, Audit Committees, and designated committees to evaluate risks, approve outsourcing arrangements, and monitor performance. Material outsourcing is defined based on impact on operations, reputation, cost, and strategic importance. Banks are prohibited from outsourcing core management functions such as Internal Audit, Compliance, KYC decision-making, and investment portfolio management.
Risk management requirements cover strategic, operational, reputational, compliance, legal, counterparty, contractual, concentration, and systemic risks. Banks must ensure confidentiality, security of information, independent audits, contingency planning, and exit strategies for outsourced services. Specific provisions address offshore or intra-group outsourcing, subcontracting, and reporting obligations, including Currency Transaction Reports (CTRs) and Suspicious Transaction Reports (STRs). The framework also prescribes monitoring, control, and redressal mechanisms to safeguard the bank’s operational resilience and regulatory compliance.
These Directions shall come into force with immediate effect.
[Notification No. RBI/DOR/2025-26/220 DOR.ORG.REC.No.139/21-04-158/2025-26]
