Home › Circulars › RBI/2008-09/322

RBI Tightens Offshore Outsourcing Rules for Indian Banks

No longer current — withdrawn, no replacement on file yet
Source: Reserve Bank of India · RBI/2008-09/322 · issued 11 Dec 2008 · ~1 min read
Quick answerRBI added new conditions for offshore outsourcing of Indian operations: banks must ensure regulators don't obstruct RBI audits, records survive liquidation, offshore regulators can't access Indian data, local courts can't claim jurisdiction over Indian ops, and all original records stay in India.

What changed

RBI inserted a new sub-paragraph (7.4) into its 2006 outsourcing guidelines. It now mandates five specific safeguards for offshore outsourcing of financial services related to Indian operations.

What it means for you

Banks must renegotiate offshore contracts to guarantee RBI and auditor access, data sovereignty, and record retention in India. Non-compliance could expose banks to regulatory action or data leakage risks. This raises compliance costs but protects customer data and operational control.

Historical instruction — do not use for current compliance. This is what was required at the time; it no longer reflects current RBI requirements. If no replacement rule is linked above, that only means none is recorded on our register yet — it does not prove no later applicable rule exists. Confirm on the official RBI source below.

What banks were required to do at the time

Who it affects

All scheduled commercial banks (excluding RRBs) with offshore outsourcing arrangements for Indian operations, Compliance and legal teams handling vendor contracts, IT and data management departments managing offshore data processing

❓ Common questions

Regulatory timeline

Built from our lineage records — each fact carries its provenance; missing history simply is not shown (never guessed).

Does this apply to outsourcing to a bank's own group entity abroad?

Yes, the circular applies to all offshore outsourcing of financial services for Indian operations, regardless of whether the provider is a related party or a third party.

What happens if the offshore regulator refuses RBI inspection?

The bank must ensure the contract prevents such refusal; otherwise, the arrangement may be non-compliant and subject to regulatory action.

📜 This document’s life story (1 recorded event, each backed by RBI’s own words)
Repealed by RBI/2025-26/100 — Consolidation of Regulations — Withdrawal of circulars (28 Nov 2025)
RBI’s words: “Official withdrawal register entry #2009: DBOD.No.BP.97/21.04.158/2008-09 — "Guidelines on Managing Risks and Code of Conduct in Outsourcing of Financial Services by Banks" dated December 11, 2008”
📜 Read the original circular — full text as issued by RBI
RBI/2008-09/322 DBOD.No.BP. 97 /21.04.158/2008-09 December 11, 2008 All Scheduled Commercial Banks (excluding RRBs) Dear Sir, Guidelines on Managing Risks and Code of Conduct in Outsourcing of Financial Services by Banks Please refer to Para 7 of our  circular DBOD.No.BP.40/21.04.158/2006-07  dated   November 3, 2006  on the captioned subject. 2. It has been decided to add a new sub para 7.4 as below: “As regards the off-shore outsourcing of financial services relating to Indian Operations, banks should additionally ensure that a) Where the off-shore service provider is a regulated entity, the relevant off-shore regulator will neither obstruct the arrangement nor object to RBI inspection visits / visits of banks internal and external auditors. b) The availability of records to management and the RBI will withstand the liquidation of either the offshore custodian or the bank in India. c) The regulatory authority of the offshore location does not have access to the data relating to Indian operations of the bank simply on the ground that the processing is being undertaken there (not applicable if off shore processing is done in the home country of the bank). d) The jurisdiction of the courts in the off shore location where data is maintained does not extend to the operations of the bank in India on the strength of the fact that the data is being processed there even though the actual transactions are undertaken in India and e) All original records continue to be maintained in India.”   Yours faithfully, (Prashant Saran) Chief General Manager-in-Charge
Reproduced for reference with acknowledgment — Source: Reserve Bank of India · RBI/2008-09/322 · issued 11 Dec 2008. The plain-English explanation above is BankPulse’s own independent summary.
🧰 Tools — save, print, templates & related
Most relevant forCompliance TeamIT & Cyber SecurityInternal AuditSenior Management / BoardLegal / Documentation & Recovery-LegalData Science / Analytics
🛠 Banker’s toolkit — checklists & reply templates →
Related circulars · Department of Regulation
SFB Pillar 3 Disclosure Norms Aligned with BaselUCB Deposit Rate Disclosure & Uniformity Rules UpdatedLAB Deposit Rate Disclosure & Uniformity Rules TightenedPayments Banks: Interest Rates Must Match Disclosed ScheduleRBI Updates Bulk Deposit Rate Rules and Disclosure Timing
Browse all departments →

💬 Banker Discussion

Discuss this circular with fellow bankers — reply, upvote what helps, report what doesn’t belong. Be professional; no client data. Views are the commenter’s own, not BankPulse’s.

Loading comments…
BankPulse Compliance Evidence Pack — generated 05 Aug 2026 · status cross-checked against RBI’s official withdrawal register (refreshed weekly).
Official RBI source: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=4709&Mode=0 — Plain-English summary by BankPulse (bankpulse.ai), reviewed by our expert reviewer, CA Amit Jain. Independent platform, not affiliated with the Reserve Bank of India; is our own plain-English paraphrase, not RBI’s original wording.
Public beta — plain-English informational summaries. Always verify against the official RBI source (circular number cited on every page) before making compliance, credit, treasury, audit, or operational decisions. · Join our WhatsApp channel ↗
—