On April 10, 2023, the Reserve Bank of India (RBI) issued the directions named RBI (Outsourcing of Information Technology Services) Directions, 2023 for the outsourcing of Information Technology (IT) services by banks, NBFCs (Non-bank financial companies) and Regulated Entities (REs) to ensure that such arrangements do not undermine their responsibilities and obligations to customers.
- The Directions shall come into effect from October 1, 2023 to provide the REs with adequate time to comply with the requirements.
Background:
i.As the REs have been extensively leveraging IT and IT enabled Services (ITeS) to support their business models, products and services offered to their customers. REs also outsource substantial portion of their IT activities to third parties, which expose them to various risks.
- To ensure effective management of attendant risks, the Statement on Developmental and Regulatory Policies (dated February 10, 2022), proposed the issuance of suitable regulatory guidelines on Outsourcing of IT Services.
- Accordingly, a draft Master Direction on Outsourcing of IT Services was released for public comments in June 2022.
ii.Based on feedback received, the finalised RBI (Outsourcing of Information Technology Services) Directions, 2023 are released now.
Note – RBI has issued the directions in exercise of the powers conferred by Section 35A read with Section 56 of the Banking Regulation Act, 1949; Section 45L of the Reserve Bank of India Act, 1934 and Section 11 of the Credit Information Companies (Regulation) Act, 2005.
a.Regulatory and Supervisory requirements for the REs:
i.As per RBI directions, the Outsourcing of any activity should not diminish RE’s obligations as also of its Board and Senior Management.
ii.The RE also should take steps to ensure that the service provider employs the same high standard of care in performing the services as would have been employed by the RE, if the same activity was not outsourced.
iii.REs shall not engage an IT service provider that would result in reputation of RE being compromised or weakened.
iv.The REs should ensure that the outsourcing should neither impede nor interfere with the ability of the RE to effectively oversee and manage its activities (whether the service provider is located in India or abroad).
v.The RE should ensure that the outsourcing does not impede the RBI in carrying out its supervisory functions and objectives.
vi.Additional requirements pertaining to usage of cloud computing services and outsourcing of Security Operations Center (SOC) services are also outlined by RBI.
b.Comprehensive assessment: REs should evaluate the need for Outsourcing of IT Services based on comprehensive assessment of attendant benefits, risks and availability of commensurate processes to manage those risks.
c.Compliance with statutory and regulatory requirements: The RE shall consider all relevant laws, regulations, rules, guidelines and conditions of approval, licensing or registration, when performing its due diligence in relation to outsourcing of IT services.
d.IT Outsourcing Policy: An RE intending to outsource any of its IT activities shall put in place a comprehensive Board approved IT outsourcing policy.
REs should ask their service providers to develop and establish a framework for documenting, maintaining and testing business continuity plans and disaster recovery plans.
– RBI simplifies the application process for registration of CICs
i.On April 10, 2023, RBI has undertaken a comprehensive review of the system of processing of applications for registration of Core Investment Companies (CICs) to make the process smoother and easier.
ii.The application form has been revamped to make it structured and aligned with the extant CIC regulations.
iii.To make the registration process user friendly, the number of documents to be furnished along with the application form has been reduced to 18 from the existing set of 52 documents.
Recent Related News:
On January 23, 2023, the Reserve Bank of India (RBI) extended the deadline for banks to complete the process of renewal of agreements for the existing safe deposit locker holders by December 31, 2023 from January 1, 2023.
About the Reserve Bank of India (RBI):
Governor– Shaktikanta Das
Deputy Governors– Mahesh Kumar Jain, Michael Debabrata Patra, M. Rajeshwar Rao, T. Rabi Sankar
Headquarters– Mumbai, Maharashtra
Establishment– 1st April 1935
