NBFC Outsourcing and IT Governance Policies: The RBI Checklist for the 2025 and 2026 Directions

If you run a Non-Banking Financial Company in India, two sets of RBI Directions now decide how you must govern the vendors you rely on and the technology you run. One covers outsourcing, issued on 28 November 2025. The other covers cybersecurity and technology risk, issued on 31 July 2026. Together they ask your Board to approve a defined set of policies, to review them on a fixed rhythm, and to be able to show that the people who apply them know what they say.

This guide turns both Directions into a policy checklist. It covers who each one applies to, which policies the Board must approve, what the outsourcing agreement and the governance committees must contain, and the review and reporting cycles that follow. It is based on the text of the Managing Risks in Outsourcing Directions, 2025 and the Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, as published on rbi.org.in.

The two Directions at a glance

Managing Risks in Outsourcing Directions, 2025 (issued 28 November 2025) came into force with immediate effect. They cover outsourcing of financial services in Chapter III and outsourcing of IT services in Chapter IV. For existing IT outsourcing agreements, the Directions required compliance either at renewal or by 10 April 2026, whichever was earlier. New IT outsourcing agreements must comply from the date they are signed. That transition date has now passed, so existing agreements should already be in line.

Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (issued 31 July 2026) also came into force with immediate effect. They repeal the earlier IT framework and IT governance instructions for NBFCs, as communicated in a circular of the same date. The requirements are tiered by size, which is the first thing to settle for your own organization.

Who must do what: the layer map

Outsourcing Directions. Chapter IV (IT services outsourcing) and the IT specific parts of Chapter II (the Board level IT outsourcing policy and reviews) apply to NBFCs in the Middle Layer and above. NBFCs in the Base Layer follow the rest of the Directions. The Directions do not apply to NOFHCs.

Cybersecurity and Technology Directions. They apply in three tiers:

• Chapter III: Base Layer NBFCs with assets below ₹500 crore, and Core Investment Companies. This is a baseline set of requirements.
• Chapter IV: Base Layer NBFCs with assets of ₹500 crore and above.
• Chapter V: Middle Layer, Upper Layer and Top Layer NBFCs, excluding Core Investment Companies.

The layers themselves are defined in RBI’s Scale Based Regulation Directions, 2025. If you are close to a threshold, plan for the next tier before you cross it.

The Board approved policies to put in place

Both Directions start with the Board. Under the outsourcing Directions, the outsourcing of an activity does not diminish the obligations of the NBFC, its Board or its senior management. Under the technology Directions, the Board must approve the strategies and policies on technology and cybersecurity and review them at least annually. In practice, that translates into this policy set:

• Outsourcing policy for financial services: selection criteria for activities and service providers, delegation of authority by risk and materiality, and systems to monitor and review.
• IT outsourcing policy (Middle Layer and above): roles of the Board, committees, senior management, the IT function and assurance functions; selection criteria; the definition of material outsourcing; delegation of authority; disaster recovery and business continuity; monitoring; and termination and exit strategies.
• IT policy and IT governance framework: organization structure, a designated head of IT, and the roles of the Board and senior management.
• Information Security policy: covering confidentiality, integrity, availability and authenticity, asset inventory and classification, segregation of duties, role based access, maker checker control, incident management and audit trails.
• Cybersecurity policy and Cyber Crisis Management Plan: covering detection, response, recovery and containment, and including vulnerability management.
• Change management policy: approval of change proposals, cost benefit analysis, risk assessment, implementation and reporting.
• Business Continuity Plan policy: approved by the Board, with periodic reports to it.
• IS Audit framework: approved by the Audit Committee of the Board.

Smaller Base Layer NBFCs have a lighter list. Under Chapter III they need a Board approved IT and information systems policy covering basic access controls and a defined password policy, defined user roles, maker checker, information security and cybersecurity controls, a Board approved Business Continuity Plan policy, and data backup with periodic testing. Our Board approved policies checklist for NBFCs places these alongside the other policies RBI expects.

Outsourcing of financial services: what the policy and agreement must say

The financial services chapter turns on the idea of material outsourcing, meaning arrangements that, if disrupted, could significantly affect operations, reputation, profitability or customer service. Materiality is judged on factors such as the importance of the activity, the impact on earnings, solvency and liquidity, reputation, the cost as a share of operating costs, aggregate exposure to one provider, and customer service and protection.

Activities you cannot outsource

An NBFC must not outsource core management functions, including internal audit, strategic and compliance functions, and decision making functions such as determining KYC compliance for opening deposit accounts, sanctioning loans and managing the investment portfolio. Internal auditors can be engaged on contract, and within a group some of these functions may be outsourced subject to the group provisions.

Conflict of interest

If the service provider is not a group company, it must not be owned or controlled by any director of the NBFC, or their relatives. For IT services, the Directions allow an exception only with the approval of the Board or a Board committee, followed by appropriate disclosure, oversight and monitoring.

Key clauses for the outsourcing agreement

The agreement must be in writing and vetted by the NBFC’s legal counsel on its legal effect and enforceability. Among the key provisions the Directions list:

• the activity outsourced and service and performance standards;
• the NBFC’s access to all books, records and information relevant to the activity;
• continuous monitoring and assessment of the provider;
• prior approval or consent of the NBFC for any use of subcontractors;
• confidentiality of customer data, including the provider’s liability for a security breach or leakage;
• contingency plans for business continuity;
• the NBFC’s right to audit the provider and obtain audit reports;
• the right of RBI, or persons it authorizes, to access the NBFC’s records held by the provider and to inspect the provider;
• a termination clause and a minimum period to execute termination; and
• confidentiality that survives termination, and preservation of documents and data in line with the NBFC’s legal obligations.

Monitoring and review

The NBFC must keep a central record of all material outsourcing of financial services, updated promptly and reviewed half yearly by the Board or the Risk Management Committee. Internal or external audit must assess the adequacy of risk management over outsourcing. The NBFC must also review each provider’s financial and operational condition at least annually. If a security breach or leakage of confidential customer information occurs, the NBFC must notify RBI immediately and remains liable to its customers for any damage.

Outsourcing of IT services: the additional requirements

For Middle Layer and above, Chapter IV adds requirements specific to technology vendors:

• Inventory: maintain an inventory of IT services outsourced, including key entities in their supply chains, and map your dependency on third parties.
• Exit strategy: the IT outsourcing policy must contain a clear exit strategy with plans for different exit scenarios, a minimum period to execute them, and identified alternatives, which may include a different provider or doing the work in house.
• Data and records at exit: agreements need clauses on safe removal or destruction of data, hardware and records, and must prohibit the provider from erasing or altering data during the transition unless advised by the regulator or the NBFC.
• Cooperation: the provider must be legally obliged to cooperate fully with the NBFC and the new provider for a smooth transition.
• Customer notice: if the agreement ends and the provider deals with the NBFC’s customers, give due publicity so customers stop dealing with it.

Cybersecurity and technology: the governance structure

The 2026 Directions are specific about committees and roles. The detail depends on your tier.

Base Layer, ₹500 crore and above (Chapter IV)

• An IT Strategy Committee chaired by an independent director, with the CIO and CTO as members, meeting so that no more than six months pass between meetings, with its deliberations placed before the Board.
• A designated senior executive as CIO or in charge of IT operations.
• Board approved IT, Information Security, Cybersecurity and change management policies.
• A Board approved BCP policy, with the plan tested at least annually and whenever significant IT or business changes occur.
• An IS Audit framework approved by the Audit Committee, conducted at least once a year where practicable and preferably before the statutory audit.

Middle Layer and above (Chapter V)

• A Board level IT Strategy Committee of at least three directors, chaired by an independent director with substantial IT expertise, defined as at least seven years of experience managing information systems or leading technology or cybersecurity initiatives. It must meet at least quarterly.
• An IT Steering Committee of senior management from IT and business, also meeting quarterly.
• An Information Security Committee under the ITSC, headed by someone from the risk management vertical.
• A Head of IT Function, and a CISO of senior rank who has no direct reporting line to the Head of IT and no business targets, reports to the executive overseeing risk management, and reviews cybersecurity risks before the Board, the Risk Management Committee or the ITSC at least quarterly.
• An Information Security Policy, a Cybersecurity Policy and Cyber Crisis Management Plan, and IT and cyber risk covered in the risk management policy, reviewed at least annually.

Testing, reporting and awareness deadlines

Several requirements set a hard clock. These are the ones to put in your compliance calendar:

• Cyber incident reporting: report cyber incidents to RBI on the DAKSH platform within six hours of detection. Middle Layer and above NBFCs must also proactively notify CERT-In.
• Vulnerability assessment and penetration testing (Middle Layer and above): for critical systems and those in the DMZ with a customer interface, vulnerability assessment at least every six months and penetration testing at least every 12 months, by trained and independent experts, with a documented approach.
• IT risk assessment: at least annually, brought to the notice of the CRO, CIO and Board (Chapter IV).
• Security infrastructure and policy review (Middle Layer and above): at least annually.
• BCP testing: at least annually, with results and gap analysis placed before the CIO and the Board.
• Training: an ongoing information security awareness program for all users, a way to measure its effectiveness, and an up to date repository of every user’s training status.

The training requirement matters for policy work. A repository of who has completed what is exactly the kind of record that links policy to evidence. See our guide to policy acknowledgment as audit evidence.

A pointer for banks

This guide focuses on NBFCs. Banks and other regulated entities follow a different instrument: the Master Direction on Outsourcing of Information Technology Services, 2023. It sets out its own applicability list, so check which entities it covers before relying on either document. For the HR dimension, see our guide on HR policy compliance for Indian banks and NBFCs.

Turning the Directions into a working policy set

Writing the policies is the smaller job. The Directions assume that the Board approves them, that committees review them on a set cycle, that senior management enforces them, and that staff and vendors follow them. A workable approach:

1. Map each requirement to a policy and an owner. One row per paragraph, with the policy that answers it and a named owner.
2. Set a review calendar. Annual Board review, quarterly or half yearly committee reviews, annual vendor reviews, six monthly VA and annual PT, annual BCP test.
3. Approve every policy. Keep the Board approval record for each policy.
4. Distribute to the right audience. IT, the CISO’s office, procurement, business owners and vendor managers each need the version that applies to them.
5. Collect acknowledgments and training records. The Directions expect a repository of training status, so make acknowledgment part of the same record.
6. Keep an evidence pack. Policy, approval, acknowledgments, committee minutes, vendor register and test results, ready for an inspection.

Our template library includes starting points for several of these: the Information Security Policy, Cybersecurity Policy, Vendor and Third Party Compliance Policy, Business Continuity and Disaster Recovery Policy and Access Control Policy. Each can be personalized with your company name and downloaded as a PDF. They are starting points, so adapt them to the Directions and your layer.

How PolicyCentral.ai helps

PolicyCentral.ai manages the lifecycle of the policies these Directions require. It routes each draft through review and Board approval, distributes the approved policy to the specific audiences it applies to, and delivers it in ten Indian languages. It records acknowledgments in a tamper-evident audit trail, reminds owners when a review is due, and lets staff ask plain-language questions about a policy and get an answer grounded in the current version.

If your team is aligning to the 2025 and 2026 Directions, request a demo and bring your IT outsourcing policy and your vendor register. It is the quickest way to see how approval, distribution and evidence fit together. This guide is for general information and is not legal advice. Always refer to the Directions on rbi.org.in for the authoritative text.

Frequently Asked Questions