What changed
RBI released a circular on October 24, 2013, following paragraph 101 of the Monetary Policy Statement 2013-14, emphasizing shared IT resources for cost optimization. It mandates that RRBs ensure service providers comply with all regulatory and legal requirements, and that RBI and NABARD have access to all consumed information resources.
What it means for you
RRBs can now share IT resources like collaboration tools, housekeeping, office automation, and business applications, but must first establish robust IT and IS governance. They must enter into agreements that guarantee audit access for regulators and address privacy, confidentiality, security, and business continuity. This allows cost savings but adds compliance and oversight responsibilities.
What you must do
- Establish strong IT and IS governance with board-level approvals for any IT resource sharing decisions.
- Identify and evaluate assets (data, applications, processes) for sharing, considering impact of security scenarios.
- Enter into service agreements that ensure regulatory audit access for RBI and NABARD, and address all legal/geographical data movement requirements.
- Map data flows between your bank, service provider, and customers to understand risk tolerance.
- Prepare comprehensive service contracts covering architecture, governance, compliance, security, and incident response.
Who it affects
Regional Rural Banks (RRBs), Service providers (including other banks) offering IT resources to RRBs, RBI and NABARD (as regulators with audit access)
What types of IT applications can RRBs share under these guidelines?
Applications related to collaboration, housekeeping, office automation, and business applications can be considered for sharing, provided they have necessary management approvals.
What must RRBs ensure in their agreements with service providers?
Agreements must guarantee that infrastructure and applications are available for audit/inspection by RBI and NABARD, and that all legal and regulatory requirements regarding data location and cross-border movement are met.
What are the key security concerns RRBs should address?
RRBs must address issues like service levels, security, governance, compliance, liability, infrastructure security, and ensure business continuity, privacy, and confidentiality are fully maintained.