June 23, 2022
The Chairman/Managing Director/Chief Executive Officer
Scheduled Commercial Banks (excluding Regional Rural Banks);
Local Area Banks;
Small Finance Banks;
Payments Banks;
Primary (Urban) Co-operative Banks having asset size of ₹1000 crore and above;
Non-Banking Financial Companies in Top, Upper and Middle Layers;
Credit Information Companies; and
All India Financial Institutions (NHB, NABARD, SIDBI, EXIM Bank and NaBFID)
Madam/Dear Sir,
Regulated Entities (REs) have been extensively leveraging Information Technology (IT) and IT enabled services (ITeS) to support their business models and products and services offered to their customers. REs also outsource substantial portion of their IT activities to third parties. Such reliance on IT/ ITeS provided by third parties expose the REs to significant risks.
- 2. In order to ensure effective management of attendant risks in outsourcing of IT activities, it was announced in the Statement on Developmental and Regulatory Policies released with the bi-monthly Monetary Policy Statement dated February 10, 2022, that draft guidelines on risk management framework for Outsourcing of IT Services, on managing related concentration risk, its periodic risk assessment and aspects of Outsourcing of IT Services to foreign service providers, will be issued by the Reserve Bank of India.
3. Accordingly, in exercise of the powers conferred by Section 35A read with Section 56 of the Banking Regulation Act, 1949; Section 45L of the Reserve Bank of India Act, 1934 and Section 11 of the Credit Information Companies (Regulation) Act, 2005, and all other provisions/ laws enabling the Reserve Bank of India in this regard, the Reserve Bank proposes to prescribe a Master Direction on Outsourcing of IT Services as given in the Annex, to be implemented by the REs.
Yours faithfully,
(T.K.Rajan)
Chief General Manager
To Read More….
Click the link below….
Press Release : https://www.dropbox.com/s/fmndczvy4obajei/Draft%20Master%20Direction%20on%20Outsourcing%20of%20IT%20Services.pdf?dl=0