Reserve Bank of India (Rural Co-operative Banks – Managing Risks in Outsourcing) Directions, 2025

RBI/DOR/2025-26/318 DOR.ORG.REC.No.237/21-04-158/2025-26 November 28, 2025 Reserve Bank of India (Rural Co-operative Banks – Managing Risks in Outsourcing) Directions, 2025 Table of Contents Chapter I – Preliminary A. Short Title and Commencement B. Applicability and Scope C. Definitions Chapter II – Role of the Board A. Board-Approved Policy B. Key responsibilities Chapter III – Outsourcing of Financial Services A. Activities that shall not be outsourced B. Authorisation, Accountability, and Oversight C. Governance Framework C.1 Outsourcing Policy C.2 Role of Senior Management D. Risk Management D.1 Evaluation of the Risks D.2 Confidentiality and Security of Information E. Outsourcing Process E.1 Service Provider Evaluation E.2 Outsourcing Agreement E.3 Monitoring and Control of Outsourced Activities E.4 Business Continuity and Management of Disaster Recovery Plan E.5 Termination F. Specific Outsourcing Arrangements F.1 Offshore outsourcing G. Redressal of Grievances related to Outsourced Services Chapter IV – Repeal and Other Provisions A. Repeal and saving B. Application of other laws not barred C. Interpretations

In exercise of the powers conferred by Section 35A read with Section 56 of the Banking Regulation Act, 1949, as amended vide Banking Regulation (Amendment) Act 2020 (39 of 2020), and all other provisions / laws enabling the Reserve Bank of India (‘RBI’) in this regard, RBI being satisfied that it is necessary and expedient in the public interest so to do, hereby, issues the Directions hereinafter specified.

Chapter I – Preliminary

A. Short Title and Commencement

1. These Directions shall be called the Reserve Bank of India (Rural Co-operative Banks - Managing Risks in Outsourcing) Directions, 2025.
2. These Directions shall come into force with immediate effect.

B. Applicability and Scope

3. These Directions shall be applicable to all Rural Co-operative Banks, hereinafter collectively referred to as 'RCBs' and individually as an 'RCB'. For the purpose of these Directions, ‘Rural Co-operative Banks’ mean State Co-operative Banks and Central Co-operative Banks, as defined in the National Bank for Agriculture and Rural Development Act, 1981.
4. These Directions apply to outsourcing arrangements entered in by an RCB with a service provider, located in India or elsewhere, for outsourcing of financial services like applications processing (loan origination, credit card), document processing, marketing and research, supervision of loans, data processing, and back office related activities.
5. These Directions shall not apply to outsourcing of activities unrelated to banking services like usage of courier, catering of staff, housekeeping and janitorial services, security of the premises, movement and archiving of records.

C. Definitions

6. In these Directions, unless the context otherwise requires, (1) 'Outsourcing' means use of a third party by the RCB to perform activities on a continuing basis that would normally be undertaken by the RCB itself, now or in the future. 'Continuing basis' shall include agreements for a limited period. (2) ‘Material Outsourcing’ means arrangements, which if disrupted, have the potential to significantly impact the business operations, reputation, or profitability of an RCB. ‘Materiality’ of outsourcing shall be based on the: (i) level of importance to the RCB of the activity being outsourced as well as the significance of the risk posed by the same; (ii) potential impact of the outsourcing on the RCB on various parameters such as earnings, solvency, liquidity, funding capital, and risk profile; (iii) likely impact on the RCB’s reputation and brand value, and ability to achieve its business objectives, strategies and plans, should the service provider fail to perform the service; (iv) cost of the outsourcing as a proportion of total operating costs of the RCB; (v) aggregate exposure to that particular service provider, in cases where the RCB outsources various functions to the same service provider; and (vi) significance of activities outsourced by RCB in the context of customer service and protection.

7. All other expressions unless defined herein shall have the same meaning as have been assigned to them under the Banking Regulation Act, 1949 or the Reserve Bank of India Act, 1934 or the Companies Act, 2013 and Rules made thereunder, or any statutory modification or re-enactment thereto, or Glossary of Terms published by RBI or as used in commercial parlance, as the case may be.

Chapter II – Role of the Board

8. The outsourcing of any activity by an RCB does not diminish its obligations, and those of its Board and Managing Director (MD) / Chief Executive Officer (CEO) along with the Senior Management, who have the ultimate responsibility for the outsourced activity.

A. Board-Approved Policy

9. An RCB intending to outsource any of its financial services shall put in place a comprehensive Board-approved outsourcing policy, the coverage of which is indicated in paragraph 16.

B. Key responsibilities

10. The Board shall be responsible for putting in place a framework to evaluate the risks and materiality of all existing and prospective outsourcing arrangements, laying down appropriate approval authorities depending on risks and materiality, and undertaking regular review. It shall be responsible, inter alia, for: (i) approving a framework to evaluate the risks and materiality of all existing and prospective outsourcing arrangements, and the policies that apply to such arrangements; (ii) laying down appropriate approval authorities for outsourcing depending on risks and materiality; (iii) undertaking regular review of the framework for its efficacy and updating the same to ensure that the outsourcing strategies and arrangements have continued relevance, effectiveness, safety, and soundness; (iv) deciding on business activities of a material nature to be outsourced and approving such arrangements; (v) assessing management competencies to develop sound and responsive outsourcing risk management policies and procedures commensurate with the nature, scope, and complexity of outsourcing arrangements; (vi) setting up suitable administrative framework of management; (vii) reviewing records of all material outsourcing on half-yearly basis; (viii) ensuring that a robust system of internal audit of all outsourced financial activities is put in place and monitoring the same; and (ix) ensuring submission of an Annual Compliance Certificate giving the particulars of contracts for outsourcing of financial services, the prescribed periodicity of audit by internal / external auditor, major findings of the audit, and action taken, to NABARD.

Chapter III – Outsourcing of Financial Services

A. Activities that shall not be outsourced

11. An RCB which chooses to outsource financial services shall however not outsource core management functions including policy formulation, Internal Audit and compliance, compliance with KYC norms, credit sanction, and management of investment portfolio. Provided that with respect to Internal Audit, where required, experts, including former employees, could be hired on a contractual basis subject to: (i) the Audit Committee of Board (ACB) / Board being assured that such expertise does not exist within the audit function of the RCB; (ii) any conflict of interest in such matters being recognised and effectively addressed; and (iii) ownership of audit reports in all cases resting with regular functionaries of the internal audit function.

B. Authorisation, Accountability, and Oversight

12. An RCB, which desires to outsource financial services, shall not require prior approval from RBI / NABARD. However, such arrangements shall be subject to on-site / off-site monitoring and inspection / scrutiny, by RBI / NABARD.
13. As stated in paragraph 8 of these Directions, the outsourcing of any activity by an RCB shall not diminish its obligations including to its customers and RBI / NABARD, and those of its Board and MD / CEO along with the Senior Management, who have the ultimate responsibility for the outsourced activity. An RCB shall, therefore, be responsible for the actions of its service provider including Business Correspondent (BC) and its retail outlets / sub-agents and the confidentiality of information pertaining to the customers that is available with the service provider. An RCB shall retain ultimate control of the outsourced activity.
14. An RCB shall ensure that: (i) all relevant laws, regulations, rules, guidelines, and conditions of approval, licensing or registration have been considered when performing due diligence in relation to outsourcing; (ii) outsourcing, whether the service provider is located in India or outside, does not impede RBI / NABARD in carrying out its regulatory / supervisory functions and objectives and diminish the ability of an RCB to fulfil its obligations to the regulator / supervisor; (iii) outsourcing, whether the service provider is located in India or outside, does not impede or interfere with the ability of an RCB to effectively oversee and manage its activities, and fulfil its obligations; (iv) outsourcing would not result in the compromise or weakening of an RCB’s internal control, business conduct, or reputation; (v) the service provider employs the same high standard of care in performing the services as would be employed by the RCB, if the activities were conducted within the RCB and not outsourced; and (vi) the service provider shall not be owned or controlled by any director or officer / employee of the RCB or their relatives having the same meaning as assigned under Companies Act, 2013 and the Rules framed thereunder, as amended from time to time.
15. An RCB shall be responsible for filing Currency Transactions Reports (CTRs) and Suspicious Transactions Reports (STRs) to FIU or any other competent authority in respect of its customer related activities carried out by the service provider.