Reserve Bank of India issues direction on outsourcing of IT services

Update 10 April 2023: The Reserve Bank of India (RBI) issued its revised draft Master Direction setting out an updated risk management framework for the outsourcing of IT services with new regulations coming into play on 1 October 2023.

The Reserve Bank of India (RBI) has issued a draft Master Direction setting out a risk management framework for the outsourcing of IT services.

The Direction includes regulations on managing related concentration risk, periodic risk assessments and the outsourcing of IT services to foreign service providers.

The new regulations come as regulators across the world are focused on strengthening operational resilience in the financial sector. Among these is the Bank of England, who in April shared a series of proposals focused on outsourcing and third-party risk management within financial market infrastructure firms (FMIs).

Responding to the RBI’s consultation, NCC Group was delighted to offer our observations for strengthening the draft Master Direction, in particular around the importance of continuing to recognise software escrow solutions as part of a comprehensive business continuity plan. Our recommendations include:

• Working with other regulators globally to do more to promote and educate financial firms on the benefits of cloud, software and technology escrow solutions as a practical means of managing third-party risk.
• This includes standardising the promotion of cloud, software and technology escrow solutions, bringing the Master Direction in line with other core guidelines overseen by the RBI and its fellow financial regulators.
• Ensuring that the development and regular testing requirements of business continuity and exit plans form part of licensing or contractual agreements between regulated entities and their third-party suppliers.
• Greater information sharing to improve shared and contextualised understanding of concentration and cyber risk.

Leading NCC Group’s response to the Bank’s proposals, Wayne Scott, Regulatory Compliance Solutions Lead at NCC Group, said:

“The risks facing financial services are ever evolving, and this requires sound risk management to ensure business continuity. The RBI has been at the forefront of operational resilience, promoting escrow solutions as one of the solutions for ensuring the ongoing provision of important business services.

As RBI finalises its Master Direction, it will be key to ensure that this ‘Resilience by Design’ approach is reflected in guidelines to financial services firms.”