RBI Outsourcing Directions, Cybersecurity Directions

RBI’s outsourcing directions, its July 2026 cybersecurity directions and its draft model risk guidance each keep the regulated entity accountable for what vendors, partners and models do. This guide shows where they connect and what risk, compliance, IT and audit teams should do.

RBI Outsourcing, Cybersecurity and Model Risk Rules: Key Facts at a Glance

Two of the three documents are final and in force. The model risk guidance is still a draft, so every requirement in it is proposed.

Document	Status	Applies to	Date
Managing Risks in Outsourcing Directions, 2025 (separate texts for banks and NBFCs)	Final, in force	Scheduled commercial banks (excluding small finance banks, local area banks, payments banks and regional rural banks). NBFCs, with IT provisions for middle layer and above	28 November 2025
Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions, 2026	Final, in force	Commercial banks. Small finance banks, payments banks and local area banks are excluded	31 July 2026
Guidance on Regulatory Principles for Model Risk Management, 2026	Draft (proposed)	All regulated entity types, including NBFCs of all layers	Released June 2026. Comments closed 24 July 2026

Key facts to remember:

Deadline passed: Existing IT outsourcing agreements had to comply at renewal or by 10 April 2026, whichever came first.
Six hours: A cyber incident must reach RBI within six hours of detection under both the outsourcing and cybersecurity directions.
Accountability: In all three documents, the bank or NBFC stays accountable for vendor, partner and third-party model outcomes.

How Are RBI’s Outsourcing, Cyber and Model Risk Rules Linked?

The three documents are separate, and they meet on one point: the bank or NBFC stays accountable when a vendor, partner or model is involved. This mapping is our reading of the texts. RBI has not published a combined view, and the model risk draft does not refer to the outsourcing directions.

Theme	Outsourcing Directions	Cybersecurity Directions	Draft model risk guidance (proposed)
Accountability	Outsourcing does not reduce the obligations of the entity, its board or senior management	Banks are accountable for security risk in outsourced and partner arrangements	The entity stays accountable for third-party model outcomes
Board oversight	Board approves the outsourcing policy	Board approves and reviews IT and cyber policies annually	Board approves a model risk framework. Board risk committee gives enhanced oversight of third-party models, whatever their tier
Contract terms	Audit rights, RBI inspection rights, sub-contractor controls	RBI inspection access to critical partners, vendor testing reports	Technical documentation, audit rights for the entity and supervisor, continuity and exit terms
Concentration	Assess reliance on one provider or a few providers	Test resilience across interconnected vendor systems	Concentration and supply chain risk for material third-party AI
Exit and continuity	Documented exit plan, safe data removal	Disaster recovery drills	Model continuity in the business continuity plan, fallback mechanisms
Incident reporting	Six hours to RBI from the provider’s detection	Six hours through RBI’s DAKSH platform, plus CERT-In	No timeline set. Board risk committee reviews breach reports
Independent checks	Audits, including pooled audits for shared providers	Independent vulnerability assessments and penetration tests	Independent validation of all models, even if vendor-certified

Worked example: a vendor-hosted AI credit-scoring model.

The outsourcing directions govern the contract, sub-contractors and exit plan.
The cybersecurity directions govern the vendor’s access, testing evidence and incident reporting.
The draft model risk guidance requires independent validation, explainability checks and board risk committee oversight.
Whether a particular arrangement counts as outsourcing depends on the definitions in each text, so confirm that before mapping.

RBI Outsourcing Directions 2025: What Banks and NBFCs Must Do

RBI issued the Managing Risks in Outsourcing Directions on 28 November 2025, and they took effect immediately. The bank text carries reference RBI/DOR/2025-26/171 and the NBFC text RBI/DOR/2025-26/363.

Who the Outsourcing Directions apply to

Banks: scheduled commercial banks, excluding small finance banks, local area banks, payments banks and regional rural banks.
NBFCs: base-layer NBFCs follow most provisions but not the IT outsourcing chapter. Middle layer and above follow all provisions.
Scope: financial services outsourcing (such as loan processing and back-office work) and material IT outsourcing (such as data centres, cloud and managed security services).

Compliance deadline for IT outsourcing agreements

Existing IT outsourcing agreements had to comply at renewal or by 10 April 2026, whichever came first.
New IT outsourcing agreements must comply from the date they are signed.

What cannot be outsourced

Banks: internal audit, the compliance function, KYC decisions for deposit accounts, loan sanctioning and investment portfolio management.
NBFCs: core management functions, including internal audit, strategic and compliance functions.

Key obligations for third-party and vendor risk management

Board and management: the board approves the outsourcing policy. NBFCs need a separate policy for IT services. Outsourcing does not reduce the entity’s obligations.
Materiality: judged on the importance of the activity, financial and reputational impact and customer impact, not only cost.
Due diligence and monitoring: assess providers before and during the contract, with periodic reviews of financial and operational condition. Pooled audits are allowed for shared providers.
Sub-contractors: prior approval is required, and the provider is liable for its sub-contractors.
Concentration risk: assess risk from several arrangements with one provider, and from reliance on a few providers for critical functions.
Exit strategy: a documented plan that keeps operations running, with safe data removal or destruction and provider cooperation during transition.
Cloud: a documented cloud adoption policy covering identity and access management, multi-factor authentication and exit plans.
Cyber incidents: the provider reports to the lender without undue delay, and the lender reports to RBI within six hours of the provider’s detection. Security breaches and customer data leakage go to RBI immediately.
Customer grievances: NBFCs remain responsible for redressing grievances about outsourced services.

RBI Cybersecurity Directions 2026: Third-Party Risk and Six-Hour Incident Reporting

RBI issued the Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions on 31 July 2026. They took effect immediately and replaced the 2016 Cyber Security Framework. A separate Digital Payment Security Controls Directions was issued the same day. These details come from secondary summaries, so check paragraph numbers against the RBI text.

Who the Cybersecurity Directions apply to

Commercial banks, including banking companies, the State Bank of India and corresponding new banks.
Small finance banks, payments banks and local area banks are excluded.
Foreign bank branches may use a comply-or-explain approach for several chapters.
I found no NBFC version of these directions. NBFC teams should check whether a separate text applies to them.

Vendor and third-party requirements in the Cybersecurity Directions

Accountability: banks are accountable for security risk in outsourced and partner arrangements. The directions also cover third-party technology arrangements that fall outside the outsourcing directions.
Contract terms: right to audit, RBI inspection access to critical partner arrangements, source-code escrow, background checks and NDAs for third-party personnel, and sharing of vulnerability and penetration test reports with remediation evidence.
ATM switch providers: specified baseline controls must be written into contracts.
Code changes: material changes need fresh written confirmation that the code is free of known vulnerabilities, malware and covert channels.
Resilience: banks must test resilience across interconnected vendor systems. Disaster recovery environments must mirror production, which affects vendor-hosted infrastructure.

Cyber incident reporting: the six-hour rule

Banks must report cyber incidents to RBI’s DAKSH platform within six hours of detection and notify CERT-In.
Responsibilities for incident handling must be assigned to outsourced personnel as well as employees.

Testing, governance and recovery requirements

Vulnerability assessments at least every six months and penetration tests at least annually for critical or internet-facing systems.
Disaster recovery drills at least half-yearly for critical systems.
The board approves and reviews IT, cyber and business continuity policies annually. A board-level IT Strategy Committee meets at least quarterly.
The CISO reports to the executive overseeing risk management, not the Head of IT, and briefs the board quarterly.

RBI Draft Model Risk Management Guidance 2026: AI/ML and Third-Party Model Requirements

This is a draft. RBI’s Guidance on Regulatory Principles for Model Risk Management, 2026 was released for consultation in June 2026, and comments closed on 24 July 2026. I found no final version. Everything below is proposed and may change.

Who the draft model risk guidance would apply to

Commercial banks (including foreign banks), small finance banks, payments banks, local area banks, regional rural banks, urban and rural co-operative banks.
NBFCs of all layers, All-India Financial Institutions, asset reconstruction companies and credit information companies.
All models the entity uses, whether built in-house, bought from a third party or based on AI/ML.

Governance requirements proposed in the draft

Board framework: a board-approved model risk management framework covering all models, including AI/ML.
Board risk committee: reviews validation reports for high-risk models and approves their deployment. It also oversees third-party and AI models.
Tiering and inventory: every model is tiered by materiality and complexity, reviewed at least annually. No model may be used unless it is in the inventory.
Retention: decommissioned models stay in the inventory for at least ten years.
Three lines of defence with independent internal audit.

Third-party and vendor model requirements proposed in the draft

The entity remains accountable for third-party model outcomes.
Independent validation is required. A vendor certificate does not replace it.
The board risk committee gives enhanced oversight to third-party models, irrespective of risk tier.
Contracts must provide technical documentation, audit rights for the entity and the supervisor, and continuity and exit arrangements.
Material third-party AI raises concentration and supply chain risk.

AI and generative AI controls proposed in the draft

Controls cover explainability, hallucination, bias and fairness, overfitting and data drift.
Red-teaming or equivalent testing, especially for customer-facing or generative models.
Customer-facing AI needs controls against prompt injection, disclosure that the customer is dealing with AI, and a route to a human.
Human oversight including override and kill-switch arrangements.
Validation reports reach the board risk committee within three months of completion.

Once final, the guidance would supersede Chapter 3 (Credit Risk Models) of RBI’s 2002 Guidance Note on Credit Risk Management.

Third-Party and Model Risk Roadmap for Banks and NBFCs: What RBI Expects, Step by Step

These four steps are our reading of the three documents, ordered so that each step feeds the next.

1. Build one inventory. List every outsourced service, vendor, sub-contractor, third-party dependency and model, including inactive and decommissioned models. The NBFC outsourcing directions require an inventory of outsourced services and dependencies. The draft says no model may be used unless it is in the inventory.

2. Tier by materiality. Rate each item on operational, financial, reputational and customer impact, not contract value alone. Review the tiers at least annually under the draft model risk guidance.

3. Align contracts and validate independently. Check every material contract for audit rights, RBI inspection rights, sub-contractor controls, data security, incident reporting and exit terms. Validate models yourself, because a vendor certificate does not replace your validation.

4. Report, test and escalate. Run the six-hour incident reporting chain, test exit and disaster recovery plans, and send validation and vendor risk reports to the board or its risk committee.

Where each document pushes hardest:

Outsourcing Directions: contract terms, sub-contractor approval, concentration and exit.
Cybersecurity Directions: testing cadence, incident reporting and vendor access.
Draft model risk guidance: inventory, tiering, independent validation and board risk committee oversight.

Role of Risk, Compliance, IT and Internal Audit in Third-Party Risk Management

These actions are suggested, based on the requirements above. Each function owns a different part of the same vendor.

Risk management: inventory, tiering and concentration

Own the combined inventory of vendors, sub-contractors and models.
Set tiers by materiality, and review them at least annually.
Assess concentration across providers for critical functions.
Run the model risk framework and report to the board risk committee.

Compliance: mapping and contract checks

Map each vendor and model to the document that applies, by entity type and layer.
Check material contracts for the mandatory terms: audit rights, RBI inspection rights, sub-contractor controls, data security, continuity and exit.
Confirm that functions RBI says cannot be outsourced stay in-house.
Track the draft model risk guidance until RBI finalises it.

IT and information security: access, testing and incident reporting

Control vendor access and collect vendor testing evidence.
Detect incidents and run the six-hour reporting chain, including the vendor’s duty to report without undue delay.
Apply cloud controls: identity and access management, multi-factor authentication and exit plans.
For AI systems, secure external interfaces and guard customer-facing models against prompt injection.

Internal audit: independent assurance

Test whether the inventory is complete and whether tiers are reasoned.
Check whether audit rights in vendor contracts are used.
Test whether exit and disaster recovery plans work in practice.
Review whether model validation is independent of the model owner.

Business owners and procurement: no unregistered vendors or tools

Register and tier every new vendor or AI tool before use.
Include the required clauses in every new contract.

Third-Party Risk Management Self-Assessment for Banks and NBFCs: 10 Questions

Answer for your own institution. Each question rests on a stated provision. Question 10 rests on the draft, so it is a readiness check, not a current requirement.

Serial	Test	Question	Source	Your answer
1	Board-approved outsourcing policy	Has your board approved the outsourcing policy, with a separate policy for IT services if you are an NBFC?	Outsourcing Directions (banks and NBFCs)
2	Vendor and dependency inventory	Do you keep an inventory of outsourced services and third-party dependencies, and of every model, including inactive and decommissioned ones?	NBFC Outsourcing Directions, inventory provisions. Draft model risk guidance, inventory (proposed)
3	Materiality assessment	Do you judge materiality on the importance of the activity, financial and reputational impact and customer impact?	Outsourcing Directions (banks), materiality provisions
4	Functions that cannot be outsourced	Have you confirmed that internal audit and the compliance function stay in-house?	Outsourcing Directions (banks and NBFCs)
5	Contract clauses	Do material contracts include audit rights, RBI inspection rights, sub-contractor controls, data security, continuity and exit terms?	NBFC Outsourcing Directions, contract provisions. Cybersecurity Directions, contract terms
6	Sub-contractor approval	Does your provider need your prior approval before engaging a sub-contractor, and is it liable for that sub-contractor?	Outsourcing Directions (banks)
7	Six-hour incident reporting	Does your contract require the provider to report cyber incidents without undue delay, and can you report to RBI within six hours of its detection?	Outsourcing Directions (banks and NBFCs). Cybersecurity Directions (banks)
8	Concentration risk	Do you assess concentration from several arrangements with one provider and from reliance on a few providers for critical functions?	Outsourcing Directions (banks and NBFCs)
9	Exit plan	Do you have a documented exit plan with safe data removal or destruction and provider cooperation during transition?	Outsourcing Directions (banks and NBFCs)
10	Independent model validation	Is every model, including vendor and AI models, validated independently of the vendor and overseen by your board risk committee?	Draft model risk guidance (proposed)

Suggested scoring: 8 to 10 Yes means the framework looks sound. 5 to 7 means gaps to close. Below 5 needs a priority review with internal audit.

Banks only: the cybersecurity directions add vulnerability assessments at least every six months, penetration tests at least annually and disaster recovery drills at least half-yearly for critical systems.

Common Gaps in Vendor Risk Management: What Teams Often Miss

These gaps come from a vendor-risk practice article, not from RBI findings. Treat them as prompts for your own review.

Tiering by spend: ranking vendors by annual cost can under-tier critical vendors.
Scattered inventories: vendor lists kept in separate spreadsheets with no common method.
Certificates taken at face value: accepting an ISO 27001 certificate without checking that it covers the relevant service or data centre.
No exit testing: exit plans for critical IT vendors that were never tested.
Weak board reporting: static reports with no central risk scoring.
Fourth-party blind spots: limited visibility into the vendor’s own sub-contractors.

As RBI strengthens its regulatory approach towards outsourcing, cybersecurity and model risk, banks and NBFCs must build capabilities to manage increasingly complex third-party relationships, technology dependencies and AI-driven decision-making.

To support professional capability development in these areas, the Risk Management Association of India (RMAI) has launched specialised training programmes covering:

✅ Third Party Risk Management & Vendor Outsourcing

✅ Cyber Security and Technology Risk Management

✅ Model Risk Management & Risk Management for AI

These programmes are designed to strengthen practical understanding of risk identification, assessment, governance, monitoring and controls in today’s evolving regulatory environment.

Take the next step in your professional development.

FAQs on RBI Outsourcing, Cyber Incident Reporting and Model Risk Guidance

Q. What was the deadline for IT outsourcing compliance under RBI’s 2025 directions?

Existing IT outsourcing agreements had to comply at renewal or by 10 April 2026, whichever came first. New IT outsourcing agreements must comply from the date they are signed.

Q. Within how many hours must a cyber incident be reported to RBI?

Six hours. Under the outsourcing directions, the six hours run from the provider’s detection of the incident. Under the cybersecurity directions, banks report through RBI’s DAKSH platform within six hours of detection and notify CERT-In.

Q. Can a bank outsource its internal audit or compliance function?

No. The outsourcing directions for banks list internal audit and the compliance function among the functions that cannot be outsourced. The NBFC directions list internal audit and the strategic and compliance functions.

Q. Is RBI’s model risk management guidance final?

No. It is a draft released for consultation in June 2026, and comments closed on 24 July 2026. Its requirements are proposed until RBI issues a final version.

Q. Who is accountable for a vendor’s AI model?

The bank or NBFC using it. The draft states that the entity remains accountable for third-party model outcomes, and that a vendor certificate does not replace its own independent validation.

Q. Do the RBI cybersecurity directions apply to NBFCs?

The 31 July 2026 directions are reported to apply to commercial banks and to exclude small finance banks, payments banks and local area banks. I found no NBFC version, so NBFCs should confirm what applies to them.

Sources and Verification Notes

RBI documents

Secondary sources

RMA INDIA

See Full Bio

RBI Outsourcing Directions, Cybersecurity Directions and Draft Model Risk Guidance: A Roadmap for Banks and NBFCs