What changed
Previously, banks were only advised to conduct annual reviews and audits of service providers. Now, RBI has added a new requirement to submit a formal Annual Compliance Certificate with specifics on outsourcing contracts, audit periodicity, major findings, and board-level action taken.
What it means for you
Banks must formalize their outsourcing oversight by compiling and submitting a structured certificate annually. This tightens regulatory monitoring and ensures that risk management practices, audit outcomes, and board involvement are documented and reported, reducing operational risk in outsourced financial services.
What you must do
- Prepare an Annual Compliance Certificate covering all outsourcing contracts, audit frequency, key findings, and board actions.
- Submit the certificate to the Chief General Manager-in-Charge, Department of Banking Supervision, Central Office, RBI, Mumbai.
- Ensure internal or external audits assess risk management practices and compliance with outsourcing guidelines at least annually.
- Review financial and operational condition of each service provider annually, highlighting any performance or security breaches.
Who it affects
All commercial banks (excluding Regional Rural Banks), Board of Directors and senior management of banks, Internal and external auditors handling outsourcing audits
What is the deadline for submitting the Annual Compliance Certificate?
The circular does not specify a specific deadline; banks must submit it annually, presumably within a reasonable period after the end of each financial year, as per their internal schedule.
Does this apply to all types of outsourcing contracts?
Yes, the certificate must give particulars of all outsourcing contracts covered under the 2006 guidelines, which include financial services outsourced by banks.
Who should sign the compliance certificate?
The circular does not specify a signatory, but typically such certificates are signed by a senior official like the Chief Compliance Officer or Managing Director, as per bank's policy.