Reserve Bank of India (All India Financial Institutions – Managing Risks in Outsourcing) Directions, 2025
UR
- Applies toAll India financial institutions
- StatusIn force
- IssuedNovember 28, 2025
- Amendmentsnone tracked
- Length35 points in 5 sections · 4 min read
The four dates on this rule
- PublishedNovember 28, 2025The day RBI put this document out. This is the same day as the Issued date on this rule.
- Starts to applyNovember 28, 2025The day this rule starts to apply, as RBI's own text states it.
- Time to get readyNoneIt starts to apply on the day it was published.
- Last date to actApril 10, 2026The day by which the work this rule asks for must be finished.
Kept in your browser only. Your desk
Show me the points for
Nothing is removed from the page.
Show me the points about
34 of the 35 points name no product and bind every product. All products.
What it says
How firm is each point
Stated by RBI — RBI’s own paragraph says this. We have only made it plainer.
Our reading — BankPulse read RBI’s paragraph and shortened it. The paragraph is the authority, not this line.
Needs judgement — RBI leaves this to the bank to settle, so nobody can give you a fixed number here.
Chapter I. Preliminary
1. Deadline for existing deals
Existing IT outsourcing deals must follow these rules by April 10, 2026, or renewal, whichever comes first.
2. Outsourcing rules
This document sets the outsourcing rules for all India financial institutions.
3. Start date
These Directions came into effect on the day the Reserve Bank issued them.
4. Who is covered
These Directions apply to every all India financial institution.
Chapter II. Role of the Board
1. Responsibility cannot be outsourced
An all India financial institution cannot outsource its duty. The all India financial institution and its Board stay fully responsible for each outsourced IT service.
Chapter III. Outsourcing of Information Technology (IT) Services
Must know
1. Nothing deleted in transition
The provider may not wipe or change data while the work is being moved.
Do it
2. Weigh the IT case
The case for giving out an IT job must be weighed against its risks.
3. A framework for IT risk
A risk plan must cover how IT risks are found, sized and reported.
4. Too much with one provider
The lender must weigh the risk of leaning on one provider too much.
5. Guard the customer data
Customer data held by the provider must be kept safe.
6. Watch their security
The lender must check the provider's safety steps often, and note any breach.
BankPulse example. A bank hires an outside firm to host its records. Signing the contract is not the end of it. The bank must review and monitor that provider's security practices and control processes on a regular basis.
7. Due diligence each renewal
The provider must be checked when hired and again at each renewal.
BankPulse example. A bank's outsourcing arrangement comes up for renewal after three years. Due diligence is done again, not only when it was first signed. The question each time is whether the service provider can still meet the obligations.
8. Look outside as well
Outside reviews and market feedback should back up our own checks.
BankPulse example. A bank's own checks on a provider are not the whole picture. It also obtains independent reviews and market feedback on that service provider. Those supplement the findings of its own due diligence.
9. Put it in writing
What each side owes the other must be set out in a written deal that binds.
10. Lawyer must vet it
A lawyer must check the written deal and say it will hold.
11. Room to step in
The deal must leave room to step in to meet the law.
12. Say what the relationship is
The deal must say whether the tie is agent and principal, or not.
13. A structure to watch it
There must be a team in place to watch and steer the work given out.
14. Audit the provider
The lender must audit the provider and anyone it hires.
15. Report any slippage
The review must bring out any drop in service, secrecy or safety.
16. An inventory of IT services
The lender must keep a list of the IT jobs it has given out.
17. Map the dependency
The lender must map how much it leans on outside firms.
18. Continuity must be tested
The provider must write down, keep and test its plans to keep work going.
19. Name the alternative
The exit plan must identify who else could do the work, or whether it comes back in-house.
20. Destroy the data safely
The deal must say how data and records are to be wiped or destroyed.
21. Announce the ending
Where a provider dealt with customers, the end of the deal must be made known.
22. Group choice on merit
A group firm must be picked on the same plain grounds as an outside firm.
23. Arm's length always
The lender must always deal with group firms at arm's length.
24. Watch the host country
Where a provider is abroad, its country's rule and politics must be watched.
Background
25. Need to know only
A provider's staff may see customer data only where the job needs it.
26. Pooled vendor audits
Regulated entities using the same vendor, the institution included, may share one pooled audit instead of separate ones.
27. Risk sets the audit cycle
How often the audit happens turns on the risk and what is at stake.
28. Board hears the bad news
Reports go to senior staff, and anything bad goes up to the Board.
29. Complaint responsibility
The all India financial institution alone is responsible for fixing complaints about outsourced services.
Chapter IV. Repeal and Other Provisions
1. Old cases continue
Action already taken under the old rules stays governed by them.
The same subject for other kinds of institution
The same subject for other kinds of institution.
Other RBI rules for all India financial institutions
RBI capital adequacy rules for all India financial institutions 2025
RBI credit bureau reporting rules for all India financial institutions 2025
RBI credit risk rules for all India financial institutions 2025
RBI customer service and fair conduct rules for all India financial institutions
RBI cyber security rules for all India financial institutions 2026
RBI exposure limit rules for all India financial institutions 2025
RBI financial services business rules for all India financial institutions 2025
RBI financial statement and disclosure rules for all India financial institutions
RBI fraud risk rules for all India financial institutions 2026
RBI income recognition and provisioning rules for all India financial institutions
RBI investment portfolio rules for all India financial institutions 2025
Every rule page on BankPulse · Questions bankers ask, answered