Preliminary, scope and definitions
Separate financial-services outsourcing from material IT outsourcing and entity exclusions.
Outsourcing and IT Governance
Paragraph-wise corpus with Finin2min interpretation, examples, evidence controls and practical Q&A. Source: Commercial Banks Managing Risks in Outsourcing Directions, 2025.
11 unitsBanking Regulation Act, 1949 section 35A; IT/data overlaysCurrent-source controlled
Module register
Board and committee responsibilities
Board accountability continues; approve framework, materiality, policies, review and compliance certificate.
Material outsourcing and prohibited outsourcing
Classify materiality; do not outsource core management, compliance or sanction decisions.
Accountability, oversight and policy
Retain control, customer liability, FIU reporting and a complete Board-approved policy.
Risk, confidentiality and security
Assess strategic, reputation, compliance, operational, legal, exit, concentration and country risk; report breaches.
Service-provider due diligence
Evaluate capability, financial soundness, legal/reputation, security, subcontractors and continuity.
Outsourcing agreement and access rights
Cover scope, SLA, audit, RBI access, confidentiality, subcontracting, BCP, termination and records.
Monitoring, continuity, exit and special arrangements
Maintain inventory, performance, incident, reconciliation, contingency, group/offshore and grievance controls.
IT-outsourcing definitions and governance
Identify material IT services, Board/Senior/IT roles and conflicts.
IT risk, cloud, SOC and contract
Map architecture, concentration, data, cloud shared responsibility, SOC and supervisory access.
IT monitoring, BCP, exit and reporting
Test resilience, portability, exit, incident, audit and regulatory notification.