RBI’s NBFC Outsourcing Directions: The Vendor Governance Rulebook, Layer by Layer

Short answer: the Reserve Bank of India (Non-Banking Financial Companies – Managing Risks in Outsourcing) Directions, 2025, issued on November 28, 2025 and effective immediately, replace the older outsourcing guidance for NBFCs with one rulebook. It covers financial services outsourcing for all in-scope NBFCs and adds an IT outsourcing chapter for Middle Layer and above. The core rule is unchanged: the NBFC, its Board and senior management keep ultimate control of anything a vendor does.

What is new for most teams is the detail: a list of functions that cannot be outsourced, a half-yearly Board record of material arrangements, named contract clauses, concentration and exit planning. This is an operational reading for risk, compliance and audit teams, not legal advice. Paragraph numbers below follow the RBI text as reproduced by TaxGuru; verify them on the RBI website.

Who Is Covered, and Which Chapters Apply

Paragraph 3 applies the Directions to the listed NBFC categories, including NBFC-ICC, NBFC-MFI, NBFC-Factor, NBFC-P2P and NBFC-AA, housing finance companies, core investment companies and standalone primary dealers. Application then depends on the regulatory layer. A separate version exists for commercial banks, so do not mix the two texts.

Timing matters. New IT outsourcing agreements must comply from the date they are signed. Existing IT agreements had to comply at renewal or by April 10, 2026, whichever came first, so any contract still on legacy terms is now overdue. Our earlier guide to RBI outsourcing guidelines describes the previous framework; use this article for the 2025 text.

What You Cannot Outsource, and What You Still Own

Non-outsourceable functions. Paragraph 15 bars outsourcing of internal audit, strategic and compliance functions, and decision-making functions. The examples given include KYC compliance determinations, loan sanctioning (including retail loans) and management of the investment portfolio. Internal auditors may be on contract. Check any arrangement where a vendor’s system or staff effectively makes the credit or KYC decision, not just supports it.

Agents are in scope. The NBFC remains responsible for its service providers, including direct selling agents, direct marketing agents and recovery agents (paragraph 17). Customer grievances about outsourced services stay with the NBFC. For lenders with large field networks, this is often the least-governed part of the vendor estate.

No prior RBI approval, but full inspection. Financial services outsourcing does not need prior RBI approval, yet it remains subject to RBI monitoring and inspection. Approval is not the control; your own records are. See outsourcing risk management in financial services for the wider context.

Material Outsourcing: The Record, the Review and the Concentration Test

An arrangement is material if its disruption could significantly affect business operations, reputation, profitability or customer service (paragraph 14). For IT services, materiality also covers arrangements where unauthorised access, loss or theft of customer information could materially affect customers (paragraph 58(2)). Four obligations follow.

A central record. Maintain a central record of material financial outsourcing, updated promptly and reviewed half-yearly by the Board or its Risk Management Committee (paragraph 36). The Board may delegate this review, but only to the Risk Management Committee (paragraph 12(1)(vii)). For IT arrangements, the IT function keeps a central database (paragraph 64(2)).

Ongoing monitoring. The summary of the Directions on RBI’s site describes at least annual review of a provider’s financial and operational health. Build this into a vendor tiering model so material vendors are reviewed more often than the minimum.

Concentration. Paragraph 67 asks NBFCs to assess concentration risk from multiple arrangements with one provider and from critical functions sitting with a few providers. A single cloud host running your loan origination, collections and customer app is one dependency, however many contracts it has. See vendor concentration risk.

Group entities. Outsourcing to a group company needs a Board-approved policy and service level agreements, customers must be told which entity provides the service, and risk management must match that for unrelated parties (paragraphs 45 to 51). Related-party status is not a shortcut around diligence.

Contract Clauses to Re-Check Against the Text

Paragraph 34 lists clauses for financial services contracts, including service standards, access to records, monitoring, subcontractor consent, confidentiality, audit rights, RBI access and inspection rights, termination and data preservation. Paragraph 74 adds IT-specific terms such as access to data and logs, defined material adverse event reporting and disclosure of the data captured and stored. Review the full lists with counsel; the points below are the ones most often missed.

• Subcontracting: prior NBFC approval, and the provider contractually liable for its subcontractors (paragraphs 34(iv) and 74(xiii)). This is your fourth-party control.
• Audit and inspection: rights for the NBFC and for RBI that the vendor cannot make conditional on its own consent.
• Data location: storage in India where applicable under existing requirements (paragraph 74(vi)); for offshore financial outsourcing, original records stay in India (paragraph 53(viii)).
• Incident reporting: providers must report cyber incidents without undue delay so the NBFC can report to RBI within six hours of the provider detecting them (paragraph 61). Read how this interacts with the newer RBI cybersecurity directions.

The wider drafting approach is covered in vendor contract risk management.

Exit and Transition Are Now Written Requirements

For IT outsourcing, paragraphs 84 to 88 require a clear exit strategy that covers continuity during and after exit, different exit scenarios with a minimum execution period where needed, identified alternatives (another provider or in-house delivery), secure removal or destruction of data, a bar on the provider altering or erasing data during transition unless directed, and full cooperation with the NBFC and any new provider. A signed clause is not a plan. Test it against the guidance in vendor offboarding as a critical control and vendor business continuity planning.

Worked Example: A Microfinance NBFC (Illustrative)

This is a hypothetical scenario, not a customer case study. A Middle Layer NBFC-MFI uses a cloud loan management system, a field collection agency and a group company for back-office processing. A review against the Directions finds three gaps: the collection agency contract allows subcontracting without NBFC approval, the cloud contract names no exit assistance or data return process, and the group arrangement has no service level agreement.

The remediation is an addendum requiring approval for subcontractors and flow-down of obligations, an exit annex covering data return and destruction, and a written SLA for the group entity. Each item is logged with an owner and date, the three vendors are added to the Board’s half-yearly material outsourcing record, and the concentration view shows the cloud host supports origination and collections. That file is what an RBI inspector would ask to see.

A Five-Step Remediation Plan

Steps three to five are where manual files break down across hundreds of agents and vendors. Crest.Digital’s TPRM agents can watch vendor signals and compile the record, and Voice AI for GRC can chase renewals and evidence. People still decide materiality and risk acceptance; the agents gather and log the evidence.

Frequently Asked Questions