RBI’s norms on outsourcing IT services aimed at improving corporate governance, say experts

Reserve Bank’s regulation on outsourcing of IT providers by banking sector entities is aimed toward enhancing company governance and can shield the curiosity of customers, say business specialists.

The Reserve Bank of India (RBI) has lately come out with detailed norms for the outsourcing of IT providers by banks, NBFCs and different regulated monetary sector entities to make sure that such preparations don’t undermine their tasks and obligations to clients.

These norms got here within the backdrop of the present follow of regulated entities (REs) of extensively leveraging IT and IT-enabled providers (ITeS) to help their business fashions and likewise the services and products being supplied to clients.

Commenting on the Master Direction issued by the RBI on ‘Outsourcing of Information Technology Services’, Monish G Chatrath, Managing Partner, MGC Global Risk Advisory LLP, mentioned, “Strong corporate governance practices and comprehensive risk management frameworks are aspects that are imperative to enhance the resilience of the BFSI sector in India. This is a significant development that is in the best interests of the consumers…”.

He additional mentioned the instructions have introduced below purview these IT & ITeS duties which have the potential to considerably influence the business operations of regulated entities within the occasion of a disruption or compromise and people that may have materials influence on the purchasers of the regulated entities within the occasion of any unauthorised entry, loss or theft of buyer info.

The Master Direction on ‘Outsourcing of Information Technology Services’ will come into impact from October 1, 2023. The RBI mentioned the underlying precept of the Master Direction is to make sure that outsourcing preparations neither diminish REs’ capacity to fulfil its obligations to clients nor impede efficient supervision by the RBI.

Siddhartha Tipnis, Partner, Deloitte India, mentioned the RBI’s directives present key foundational broad strokes to regulated entities for managing know-how outsourcing relationships throughout the continuum: Evaluation – Onboarding – Service Experience/Management – Performance Management – Ongoing Risk/Compliance Management – Overall Relationship Management. This framework, Tipnis mentioned, will usher in much more rigour as to how REs handle these business essential relationships and is anticipated to mature RE working fashions, processes, methods and streamline/formalise some intuitively adopted practices round know-how outsourcing.

“With less than 180 days for the directives to become effective, we certainly see this topic being an important part of Board agenda this season. Key RE committees/ groups such as Risk Management Group, Information Security group, amongst others are likely to oversee implementation,” Tipnis added.

As per the RBI, REs have put in place a threat administration framework that “shall comprehensively deal” with the processes and tasks for identification, measurement, mitigation, administration, and reporting of dangers related to outsourcing of IT providers preparations.

Shreya Suri, Partner, IndusLaw, opined that the grasp instructions have been an anticipated growth, given the proactive method of RBI in relation to developments and improvements within the digital and know-how house.

While sure diploma of dependency of regulated entities on essential IT providers has been customary, with the approaching of pandemic and the motion of many sectors together with monetary sector to the web house, this dependency has been at a steep incline, Suri mentioned.

“Prior to the master directions, the prevalent outsourcing guidelines were scattered for different classes of REs, however, the master directions attempt to streamline and unify the regulations for all REs,” Suri mentioned.

As per the Master Direction, an RE desiring to outsource any of its IT actions should put in place a complete board-approved IT outsourcing coverage.

The coverage ought to incorporate, inter alia, the roles and tasks of the board, committees of the board (if any), and senior administration, IT operate, business operate in addition to oversight and assurance features in respect of outsourcing of IT providers.