RBI (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025
RBI's binding direction on outsourcing of financial services and IT services by commercial banks, replacing the 2023 IT Outsourcing Master Direction and the 2006 outsourcing guidelines.
- Issued by
- Reserve Bank of India
- Applies in
- India
- Edition
- RBI/DOR/2025-26/171 (28 Nov 2025)
- Area
- Operational resilience & ICT
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- Para 9Board and senior management keep ultimate responsibilityGovernance
- Para 15Do not outsource core functions such as internal audit and complianceThird parties
- Para 29Do due diligence on service providersThird parties
- Para 56Report service provider cyber incidents to RBI within six hoursReporting
- Para 68Put the mandatory terms in IT outsourcing agreementsThird parties
- Para 77Keep an inventory of outsourced servicesThird parties
- Para 79Maintain exit strategiesResilience
- Para 92Apply cloud-service controls (governance, IAM, logging, BCP, exit)Cybersecurity
How Amoreg keeps you on it.
Enable the RBI (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025 and the Monitor suggests RBI as a source. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 8 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read rbi.org.in/Scripts/NotificationUser.aspx
- Check the library against 8 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: board and senior management keep ultimate responsibility
- Rule
- RBI (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025, Para 9
- Area
- Governance
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls
- NIS2 DirectiveCybersecurity risk-management measures and incident reporting for essential and important entities.European Union · 4 controls
- UK Operational Resilience (FCA SYSC 15A / PRA SS1/21)Important business services, impact tolerances, mapping and scenario testing.United Kingdom · 5 controls
- UK Outsourcing & Third-Party Risk (SYSC 8 / PRA SS2/21)Requirements for outsourcing and third-party arrangements, including critical third parties.United Kingdom · 5 controls
- CSSF Circular 20/750 — ICT and security risk managementEBA ICT and security risk guidelines applied to Luxembourg entities outside DORA's scope.Luxembourg · 5 controls
- CSSF Circular 22/806 — Outsourcing arrangementsThe single outsourcing framework, now applying to DORA entities for business process outsourcing only.Luxembourg · 5 controls
Also in India
- SEBI (Intermediaries) Regulations, 2008SEBI regulations for all registered intermediaries, covering registration, fit-and-proper criteria, general conduct, inspection and enforcement.India · 8 controls
- SEBI (Prohibition of Insider Trading) Regulations, 2015SEBI regulations preventing insider trading and controlling unpublished price sensitive information (UPSI) at listed companies, intermediaries and fiduciaries.India · 8 controls
- SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015SEBI regulations for the continuing disclosure and corporate governance obligations of listed entities, read with the LODR master circular.India · 8 controls
- SEBI (Investment Advisers) Regulations, 2013SEBI regulations for the registration, qualifications and client-facing conduct of investment advisers, read with the IA master circular.India · 8 controls
- SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)SEBI framework setting cybersecurity and cyber resilience requirements for SEBI-regulated entities, graded by entity category.India · 8 controls
- RBI (Commercial Banks – Know Your Customer) Directions, 2025RBI's binding KYC/AML/CFT direction for commercial banks under the PML Act and Rules, replacing the repealed 2016 KYC Master Direction.India · 8 controls
Questions
Does Amoreg watch for changes to the RBI (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025?
Yes. Enable it and the Monitor suggests Reserve Bank of India as a source; every publication it records keeps its source, stage and date.
Can Amoreg check our policies against the RBI (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records RBI/DOR/2025-26/171 (28 Nov 2025). Editions were last verified in August 2026, and the Monitor records new publications as they appear.