Regulated Entities (REs) have been extensively leveraging Information Technology (IT) and IT-enabled Services (ITeS) to support their business models, products and services offered to their customers. REs also outsource substantial portions of their IT activities to third parties, which exposes them to various risks. In order to ensure effective management of attendant risks, the Statement on Developmental and Regulatory Policies dated February 10, 2022, proposed the issuance of suitable regulatory guidelines on outsourcing of IT Services. Accordingly, a draft Master Direction on Outsourcing of IT Services was released for public comments in June 2022.
Based on feedback received, the Reserve Bank of India has uploaded finalised (Outsourcing of Information Technology Services) Directions, 2023 on its website on Monday. The underlying principle of these directions is to ensure that outsourcing arrangements neither diminish REs’ ability to fulfil its obligations to customers nor impede effective supervision by the RBI. With a view to providing REs adequate time to comply with the requirements, the enclosed Directions shall come into effect from October 1, 2023. These directions will be applicable to all the scheduled commercial banks (excluding regional rural banks), local area banks, small finance banks, payments banks, primary (urban) co-operative banks, non-banking financial companies, credit information companies, and all India financial institutions (EXIM Bank, NABARD, NaBFID, NHB, and SIDBI). Further, foreign banks, operating in India through branch mode, shall be subject to a ‘comply or explain’ approach wherein such foreign banks may deviate from any specific part of these Directions subject to examination and acceptance by the RBI of a reasonably justifiable explanation for the same.
Outsourcing of IT Services will include outsourcing of the following activities: IT infrastructure management, maintenance and support (hardware, software or firmware), network and security solutions, maintenance (hardware, software or firmware), application development, maintenance and testing, application service providers (ASPs) including ATM Switch ASPs, services and operations related to data centres, cloud computing services, managed security services, and management of IT infrastructure and technology services associated with payment system ecosystem.
__________
