Draft Master Direction on Outsourcing of Information Technology Services
- Reserve Bank of India Date: Jun 23, 2022 Draft Master Direction on Outsourcing of Information Technology (IT) Services Regulated Entities (REs) have been extensively leveraging Information Technology (IT) and IT-enabled services (ITeS) in their business, products, and services with increasing dependence on third parties. Such reliance on IT/ITeS provided by third parties exposes the REs to various risks.
- It was announced in the Statement on Developmental and Regulatory Policies, released with the bi-monthly Monetary Policy Statement dated February 10, 2022, that draft guidelines on risk management framework for Outsourcing of IT Services, managing related concentration risk, its periodic risk assessment, and aspects of outsourcing of IT Services to foreign service providers will be issued by the Reserve Bank of India.
- Accordingly, the Reserve Bank has released a draft Master Direction on Outsourcing of IT Services, for comments of stakeholders and members of the public.
- Comments/feedback from REs and other stakeholders may be submitted by July 22, 2022, through email with the subject line ‘Feedback on Master Direction on Outsourcing of IT Services. The final Master Direction shall be issued by Reserve Bank after considering the feedback received.
(Yogesh Dayal)
Chief General Manager
Press Release: 2022-2023/413
RBI/2022-23/xx DoS.CO.CSITEG/SEC.xx/31.01.015/2022-23 June 23, 2022
The Chairman/Managing Director/Chief Executive Officer Scheduled Commercial Banks (excluding Regional Rural Banks);
Local Area Banks;
Small Finance Banks;
Payments Banks;
Primary (Urban) Co-operative Banks having asset size of ₹1000 crore and above;
Non-Banking Financial Companies in Top, Upper, and Middle Layers;
Credit Information Companies;
and All India Financial Institutions (NHB, NABARD, SIDBI, EXIM Bank, and NaBFID)
Madam/Dear Sir,
- Draft Master Direction on Outsourcing of IT Services Regulated Entities (REs) has been extensively leveraging Information Technology (IT) and IT-enabled services (ITeS) to support their business models and products and services offered to their customers. REs also outsource a substantial portion of their IT activities to third parties. Such reliance on IT/ ITeS provided by third parties exposes the REs to significant risks.
- In order to ensure effective management of attendant risks in outsourcing of IT activities, it was announced in the Statement on Developmental and Regulatory Policies released with the bi-monthly Monetary Policy Statement dated February 10, 2022, that draft guidelines on risk management framework for Outsourcing of IT Services, on managing related concentration risk, its periodic risk assessment and aspects of Outsourcing of IT Services to foreign service providers, will be issued by the Reserve Bank of India.
- Accordingly, in the exercise of the powers conferred by Section 35A read with Section 56 of the Banking Regulation Act, 1949; Section 45L of the Reserve Bank of India Act, 1934, and Section 11 of the Credit Information Companies (Regulation) Act, 2005, and all other provisions/ laws enabling the Reserve Bank of India in this regard, the Reserve Bank proposes to prescribe a Master Direction on Outsourcing of IT Services as given in the Annex, to be implemented by the REs.
Yours faithfully,
(T.K.Rajan)
Chief General Manager
Encl: Annex