{"what_this_is":"The machine-readable twin of the BankPulse page for one RBI rulebook. Same points, same dates, same paragraph references as the page a person reads. RBI's own wording is not reproduced here: each point names the RBI paragraph, the character offset into the text BankPulse read and the sha256 of that text, so the claim can be checked against RBI's own document.","schema_version":1,"release_id":"d653cdb0a5","generated_at":"2026-09-15T00:33:59.117975+00:00","id":"md12925","title":"Reserve Bank of India (Credit Information Companies – Managing Risks in Outsourcing) Directions, 2025","document_kind":"Directions","page":"https://bankpulse.ai/rule/md12925","status":"In force","importance":{"code":"MR","label":"MUST READ","weight":"Must read","why":"Binding RBI Directions naming this institution class in the title","layer":"bankpulse_inference"},"applies_to":{"shown":"Credit information companies","class_code":"CIC","from":"the document's own title","layer":"bankpulse_inference"},"dates":{"prid":"md12925","mode":"four_dates_v1","published":{"label":"Published","value":"November 28, 2025","stated":true,"why":"The day RBI put this document out."},"effective":{"label":"Starts to apply","value":"","stated":false,"why":"Not stated separately in this document. Read the rule itself before you assume a start date."},"transition":{"label":"Time to get ready","value":"","stated":false,"why":"Cannot be worked out until the day it starts to apply is known."},"deadline":{"label":"Last date to act","value":"","stated":false,"why":"No date to act by was found in this document. Other dates may sit inside single paragraphs."},"sources":{"published":"doc_date in data/highlights/md12925.json","effective":"none held","transition":"none held","deadline":"none held"}},"rbi_source":{"url":"https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12925","document_date":"November 28, 2025","read_by_bankpulse":"2026-08-21 16:21:54 UTC","text_sha256":"db126fe7db698a9fe7d3953d2d5cc7c82d5720737d7f52941383c4b0628263aa","word_count":null,"standing_last_checked":"Standing checked on RBI’s Master Directions index, 15 September 2026, 5:58 am IST."},"counts":{"points_shown":35,"points_naming_an_rbi_paragraph":35,"points_stored":35,"actions":0,"amendments":0},"points":[{"n":1,"claim":"md12925-4384b020","page_group":"Chapter I. Preliminary","stored_section":"WHAT CHANGES","heading":"Deadline for existing deals","plain_english":"Existing IT outsourcing deals must follow these rules by April 10, 2026, or renewal, whichever comes first.","rbi_paragraph":"Para 2","rbi_char_offset":3992,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p1","layer":"bankpulse"},{"n":2,"claim":"md12925-01d43fde","page_group":"Chapter I. Preliminary","stored_section":"THE CORE IDEA","heading":"Outsourcing rules for CICs","plain_english":"This document sets the outsourcing rules for credit information companies.","rbi_paragraph":"Para 1","rbi_char_offset":3584,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p2","layer":"bankpulse"},{"n":3,"claim":"md12925-1840df20","page_group":"Chapter I. Preliminary","stored_section":"KEY DATES","heading":"Start date","plain_english":"These Directions came into effect on the day the Reserve Bank issued them.","rbi_paragraph":"Para 2","rbi_char_offset":3738,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p3","layer":"bankpulse"},{"n":4,"claim":"md12925-a1ffcce3","page_group":"Chapter I. Preliminary","stored_section":"WHO IT APPLIES TO","heading":"Who is covered","plain_english":"These Directions apply to every credit information company.","rbi_paragraph":"Para 3","rbi_char_offset":4585,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p4","layer":"bankpulse"},{"n":1,"claim":"md12925-145085d5","page_group":"Chapter II. Role of the Board","stored_section":"THE CORE IDEA","heading":"Responsibility stays with CIC","plain_english":"Outsourcing an IT service never lowers a CIC's own responsibility for it.","rbi_paragraph":"Para 8","rbi_char_offset":11518,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p5","layer":"bankpulse"},{"n":1,"claim":"md12925-ea8c00b3","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHAT CHANGES","heading":"Nothing deleted in transition","plain_english":"The provider may not wipe or change data while the work is being moved.","rbi_paragraph":"Para 52","rbi_char_offset":35255,"weight":"MUST KNOW","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p6","layer":"bankpulse"},{"n":2,"claim":"md12925-c53e9b46","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Weigh the IT case","plain_english":"The case for giving out an IT job must be weighed against its risks.","rbi_paragraph":"Para 13","rbi_char_offset":14662,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p7","layer":"bankpulse"},{"n":3,"claim":"md12925-1d593a0e","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"A framework for IT risk","plain_english":"A risk plan must cover how IT risks are found, sized and reported.","rbi_paragraph":"Para 18","rbi_char_offset":18953,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p8","layer":"bankpulse"},{"n":4,"claim":"md12925-6080f5b4","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Too much with one provider","plain_english":"The lender must weigh the risk of leaning on one provider too much.","rbi_paragraph":"Para 20","rbi_char_offset":19526,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p9","layer":"bankpulse"},{"n":5,"claim":"md12925-0b7b2ef6","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Guard the customer data","plain_english":"Customer data held by the provider must be kept safe.","rbi_paragraph":"Para 23","rbi_char_offset":20174,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p10","layer":"bankpulse"},{"n":6,"claim":"md12925-07b1ff76","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Watch their security","plain_english":"The lender must check the provider's safety steps often, and note any breach.","rbi_paragraph":"Para 26","rbi_char_offset":21300,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":"A bank hires an outside firm to host its records. Signing the contract is not the end of it. The bank must review and monitor that provider's security practices and control processes on a regular basis.","anchor":"https://bankpulse.ai/rule/md12925#p11","layer":"bankpulse"},{"n":7,"claim":"md12925-917f0563","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Due diligence each renewal","plain_english":"The provider must be checked when hired and again at each renewal.","rbi_paragraph":"Para 28","rbi_char_offset":21839,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":"A bank's outsourcing arrangement comes up for renewal after three years. Due diligence is done again, not only when it was first signed. The question each time is whether the service provider can still meet the obligations.","anchor":"https://bankpulse.ai/rule/md12925#p12","layer":"bankpulse"},{"n":8,"claim":"md12925-fb64df1e","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Look outside as well","plain_english":"Outside reviews and market feedback should back up our own checks.","rbi_paragraph":"Para 31","rbi_char_offset":24239,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":"A bank's own checks on a provider are not the whole picture. It also obtains independent reviews and market feedback on that service provider. Those supplement the findings of its own due diligence.","anchor":"https://bankpulse.ai/rule/md12925#p13","layer":"bankpulse"},{"n":9,"claim":"md12925-36b9426b","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHAT CHANGES","heading":"Put it in writing","plain_english":"What each side owes the other must be set out in a written deal that binds.","rbi_paragraph":"Para 32","rbi_char_offset":24483,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p14","layer":"bankpulse"},{"n":10,"claim":"md12925-08741cdc","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Lawyer must vet it","plain_english":"A lawyer must check the written deal and say it will hold.","rbi_paragraph":"Para 33","rbi_char_offset":24862,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p15","layer":"bankpulse"},{"n":11,"claim":"md12925-84bbcbbb","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHAT CHANGES","heading":"Room to step in","plain_english":"The deal must leave room to step in to meet the law.","rbi_paragraph":"Para 33","rbi_char_offset":25091,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p16","layer":"bankpulse"},{"n":12,"claim":"md12925-1ed1b4d7","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHAT CHANGES","heading":"Say what the relationship is","plain_english":"The deal must say whether the tie is agent and principal, or not.","rbi_paragraph":"Para 33","rbi_char_offset":25217,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p17","layer":"bankpulse"},{"n":13,"claim":"md12925-38065293","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"A structure to watch it","plain_english":"There must be a team in place to watch and steer the work given out.","rbi_paragraph":"Para 35","rbi_char_offset":29641,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p18","layer":"bankpulse"},{"n":14,"claim":"md12925-59cfb54e","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Audit the provider","plain_english":"The lender must audit the provider and anyone it hires.","rbi_paragraph":"Para 36","rbi_char_offset":29963,"weight":"DO IT","role":"Audit","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p19","layer":"bankpulse"},{"n":15,"claim":"md12925-cdedd9a1","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHAT CHANGES","heading":"Report any slippage","plain_english":"The review must bring out any drop in service, secrecy or safety.","rbi_paragraph":"Para 40","rbi_char_offset":32070,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p20","layer":"bankpulse"},{"n":16,"claim":"md12925-57a64bad","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"An inventory of IT services","plain_english":"The lender must keep a list of the IT jobs it has given out.","rbi_paragraph":"Para 42","rbi_char_offset":32632,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p21","layer":"bankpulse"},{"n":17,"claim":"md12925-d28e8205","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Map the dependency","plain_english":"The lender must map how much it leans on outside firms.","rbi_paragraph":"Para 42","rbi_char_offset":32780,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p22","layer":"bankpulse"},{"n":18,"claim":"md12925-fff009df","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Continuity must be tested","plain_english":"The provider must write down, keep and test its plans to keep work going.","rbi_paragraph":"Para 43","rbi_char_offset":33034,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p23","layer":"bankpulse"},{"n":19,"claim":"md12925-2f001469","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Name the alternative","plain_english":"The exit plan must identify who else could do the work, or whether it comes back in-house.","rbi_paragraph":"Para 49","rbi_char_offset":34716,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p24","layer":"bankpulse"},{"n":20,"claim":"md12925-794d4ac5","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHAT CHANGES","heading":"Destroy the data safely","plain_english":"The deal must say how data and records are to be wiped or destroyed.","rbi_paragraph":"Para 51","rbi_char_offset":35082,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p25","layer":"bankpulse"},{"n":21,"claim":"md12925-12415270","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Announce the ending","plain_english":"Where a provider dealt with customers, the end of the deal must be made known.","rbi_paragraph":"Para 53","rbi_char_offset":35594,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p26","layer":"bankpulse"},{"n":22,"claim":"md12925-35de5d7c","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Group choice on merit","plain_english":"A group firm must be picked on the same plain grounds as an outside firm.","rbi_paragraph":"Para 55","rbi_char_offset":36036,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p27","layer":"bankpulse"},{"n":23,"claim":"md12925-316f48c7","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"THE CORE IDEA","heading":"Arm's length always","plain_english":"The lender must always deal with group firms at arm's length.","rbi_paragraph":"Para 56","rbi_char_offset":36296,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p28","layer":"bankpulse"},{"n":24,"claim":"md12925-776b0c26","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Watch the host country","plain_english":"Where a provider is abroad, its country's rule and politics must be watched.","rbi_paragraph":"Para 58","rbi_char_offset":36818,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p29","layer":"bankpulse"},{"n":25,"claim":"md12925-dc977e3b","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHAT CHANGES","heading":"Need to know only","plain_english":"A provider's staff may see customer data only where the job needs it.","rbi_paragraph":"Para 23","rbi_char_offset":20370,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p30","layer":"bankpulse"},{"n":26,"claim":"md12925-7c40ddec","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Joint vendor audits","plain_english":"CICs using the same vendor can share one joint audit instead of separate ones.","rbi_paragraph":"Para 37","rbi_char_offset":30520,"weight":"BACKGROUND","role":"Audit","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p31","layer":"bankpulse"},{"n":27,"claim":"md12925-00554b5d","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Risk sets the audit cycle","plain_english":"How often the audit happens turns on the risk and what is at stake.","rbi_paragraph":"Para 38","rbi_char_offset":31057,"weight":"BACKGROUND","role":"Audit","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p32","layer":"bankpulse"},{"n":28,"claim":"md12925-c836b969","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"WHO SHOULD ACT","heading":"Board hears the bad news","plain_english":"Reports go to senior staff, and anything bad goes up to the Board.","rbi_paragraph":"Para 38","rbi_char_offset":31255,"weight":"BACKGROUND","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p33","layer":"bankpulse"},{"n":29,"claim":"md12925-0ed6978d","page_group":"Chapter III. Outsourcing of Information Technology (IT) Services","stored_section":"IMPACT","heading":"Complaint responsibility","plain_english":"The credit information company alone is responsible for fixing complaints about outsourced services.","rbi_paragraph":"Para 62","rbi_char_offset":48878,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p34","layer":"bankpulse"},{"n":1,"claim":"md12925-30fee77a","page_group":"Chapter IV. Repeal and Other Provisions","stored_section":"WHAT IT REPLACES","heading":"Old cases continue","plain_english":"Action already taken under the old rules stays governed by them.","rbi_paragraph":"Para 65","rbi_char_offset":49671,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12925#p35","layer":"bankpulse"}],"actions":[],"amendments":[],"layers":{"rbi_source":"Facts taken from RBI's own document.","bankpulse":"BankPulse's plain-English summary of RBI's document.","bankpulse_inference":"BankPulse's own inference, not stated by RBI."},"rbi_wording_not_included":"By design. BankPulse never republishes RBI's exact sentences. Use rbi_paragraph with rbi_source.url to read RBI's own words.","terms":"BankPulse's plain-English summaries are BankPulse's own work. The underlying regulation is the Reserve Bank of India's. Always check the RBI document named in rbi_source before acting."}