Vendor and Processor Controls

Think about every vendor your fintech depends on: your cloud provider, your KYC checker, your credit-scoring provider, your support team, your collections agency.

Each one needs a written contract with real security duties, a real right to audit them, and clear terms for ending the relationship.

RBI does not accept "that was the vendor's fault". If something goes wrong at your vendor, RBI holds you responsible.

There is no longer one RBI outsourcing rulebook, and this changed recently.

On 28 November 2025 the RBI withdrew the circulars its Department of Regulation used to issue. It replaced them with Master Directions written separately for each type of regulated firm. The outsourcing circulars this page used to cite went in that clear-out.

Which rule binds you now depends on what kind of firm you are:

• NBFCs — the Reserve Bank of India (Non-Banking Financial Companies – Managing Risks in Outsourcing) Directions, 2025 (RBI/DOR/2025-26/363, DOR.ORG.REC.No.282/21-04-158/2025-26), effective 28 November 2025.
• Commercial banks — their own outsourcing Directions, issued in the same clear-out. We have not found the document's link yet, so we name it rather than link it.
• All India Financial Institutions — the same again: their own Directions, named here without a link for the same reason.

The transition period is over. Under the NBFC Directions, existing IT outsourcing contracts had to comply at renewal or by 10 April 2026 — whichever came first.

That date has passed. So the Directions now apply to contracts you already had, not just to new ones.

Your regulator decides which rule you follow. The RBI Directions above bind firms the RBI regulates.

If SEBI regulates you, the equivalent rule is Regulation 16C of the SEBI (Intermediaries) Regulations, 2008. That rule covers intermediaries. Through companion regulations, it also covers recognised stock exchanges, clearing corporations, depositories and participants.

The SEBI (Intermediaries) (Amendment) Regulations, 2025 added Regulation 16C. SEBI notified it on 6 February 2025. It came into force on 10 February 2025.

If you use an AI tool, you own what it does. Regulation 16C makes this simple: a SEBI-regulated firm is solely responsible for any AI or machine-learning tool it uses. It does not matter whether you built the tool or bought it. It does not matter how small the use is.

You are responsible for three things: keeping client and stakeholder data private and secure, including data you hold on someone else's behalf; whatever the tool outputs; and staying compliant with the law. SEBI can act against you if any of that fails.

Buying the tool from a vendor does not move the liability to the vendor.

Watch the boundary here. Regulation 16C creates this liability today. SEBI's June 2025 consultation paper proposes more: governance, disclosure and audit duties. None of that is in force yet.

The practical fix is ownership.

Every critical vendor needs a named internal owner. Not a shared inbox, not a rotating role — one person.

That person should know what the vendor does, what the contract says, and what happens if the relationship ends.

There is also an IT governance rulebook

If you are a bank or an NBFC, the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 2023 applies to you. It took effect on 1 April 2024. Pending confirmation

It covers who on your board owns IT risk, how you set IT strategy, how you manage vendor risk, how often you test your systems for weaknesses, and how you run disaster-recovery drills.

It sits alongside the outsourcing Directions on this page rather than replacing them.