RBI’s outsourcing directions are already in force for NBFCs, its cybersecurity directions target banks, and its model risk guidance is still a draft, but all three keep the regulated entity accountable for what its vendors and models do.
RBI’s three documents at a glance
Two of the three are final. The model risk guidance is a draft, so every requirement in it is proposed and may change.
| Document | Status | Does it cover NBFCs? | Date |
| Managing Risks in Outsourcing Directions, 2025 (NBFC text) | Final, in force | Yes. Base layer follows most provisions but not the IT outsourcing chapter. Middle layer and above follow all of it | 28 November 2025 |
| Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions, 2026 | Final, in force | Issued for commercial banks. We found no NBFC version, so NBFCs should confirm what applies to them | 31 July 2026 |
| Guidance on Regulatory Principles for Model Risk Management, 2026 | Draft, for consultation | Yes, NBFCs of all layers | Released June 2026. Comments closed 24 July 2026 |
Three facts every NBFCs team should remember:
- The deadline has passed. Existing IT outsourcing agreements had to comply at renewal or by 10 April 2026, whichever came first. New agreements must comply from the day they are signed.
- The clock is six hours. A cyber incident must reach RBI within six hours of the provider detecting it.
- The accountability does not move. In all three documents, the regulated entity answers for what its vendors, partners and models do.
The common thread: you can hand over the work, not the accountability
Most NBFCs rely on outside parties for loan processing, collections, cloud hosting, core lending systems, KYC checks and credit-scoring models. Each of RBI’s three documents says the same thing about those arrangements: the NBFC, its board and its senior management stay answerable.
That changes the question a board should ask. It is no longer “do we have a policy?” but “can we show, with evidence, that we control what we do not own?”
This is also where the work gets difficult. Risk, compliance, IT and internal audit each hold one piece of the same vendor, and no single team sees all of it. The three rulebooks are best read together for that reason.
Outsourcing Directions 2025: what NBFCs must do
The NBFC text (RBI/DOR/2025-26/363) took effect on 28 November 2025. It covers financial services outsourcing, such as loan processing and back-office work, and, for Middle Layer NBFCs and above, material IT outsourcing, such as data centres, cloud and managed security services.
What cannot be outsourced. Core management functions stay in-house, including internal audit and the strategic and compliance functions.
Obligations that matter most:
- Board and policy: the board approves the outsourcing policy, and NBFCs need a separate policy for IT services. Outsourcing does not reduce the entity’s obligations.
- Materiality: judge it on how important the activity is and on its financial, reputational and customer impact, not on cost alone.
- Due diligence and monitoring: assess providers before signing and review their financial and operational condition during the contract. Pooled audits are allowed for providers shared by several entities.
- Sub-contractors: your prior approval is required, and the provider stays liable for its sub-contractors.
- Concentration risk: assess both the risk from several arrangements with one provider and the risk from relying on a few providers for critical functions.
- Exit strategy: keep a documented plan that keeps operations running, with safe removal or destruction of data and the provider’s cooperation during transition.
- Cloud: keep a documented cloud adoption policy covering identity and access management, multi-factor authentication and exit plans.
- Cyber incidents: the provider reports to you without undue delay, and you report to RBI within six hours of the provider’s detection. Security breaches and customer data leakage go to RBI immediately.
- Customer grievances: you remain responsible for resolving complaints about outsourced services.
- Inventory: keep an inventory of outsourced services and third-party dependencies.
Cybersecurity Directions 2026: why NBFCs should still pay attention
The Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions were issued on 31 July 2026 and replaced the 2016 Cyber Security Framework. They apply to commercial banks. Small finance banks, payments banks and local area banks are excluded, and we found no NBFC version. NBFCs should confirm with their legal or compliance team whether a separate text applies to them.
There are still two reasons for NBFC leaders to read them. First, they show what RBI now expects from a regulated lender on vendor control. Second, NBFCs that work with banks, for example through co-lending or other partnerships, should expect these expectations to reach them through contract terms. That second point is our reading, not an RBI statement.
What the directions require of banks on vendors and third parties:
- Accountability for security risk in outsourced and partner arrangements, including third-party technology arrangements that fall outside the outsourcing directions.
- Contract terms covering audit rights, RBI inspection access to critical partners, source-code escrow, background checks and NDAs for third-party staff, and sharing of vulnerability and penetration test reports with proof of fixes.
- Fresh written confirmation after material code changes that the code is free of known vulnerabilities, malware and covert channels.
- Resilience testing across interconnected vendor systems, with disaster recovery environments that mirror production.
- Incident reporting to RBI’s DAKSH platform within six hours of detection, with CERT-In also notified, and incident-handling duties assigned to outsourced personnel as well as employees.
- Vulnerability assessments at least every six months, penetration tests at least annually for critical or internet-facing systems, and disaster recovery drills at least half-yearly.
These details come from secondary summaries, so check paragraph numbers against RBI’s text before relying on them.
Draft model risk guidance: what NBFCs should prepare for
RBI released the Guidance on Regulatory Principles for Model Risk Management, 2026 for consultation in June 2026, and comments closed on 24 July 2026. We found no final version. Everything below is proposed. It covers all models an entity uses, whether built in-house, bought from a vendor or based on AI/ML, and it applies to NBFCs of all layers.
Governance:
- A board-approved model risk framework covering every model, including AI/ML.
- A board risk committee that reviews validation reports for high-risk models, approves their deployment and oversees third-party and AI models.
- Every model tiered by materiality and complexity, reviewed at least annually, with no model in use unless it is in the inventory.
- Decommissioned models kept in the inventory for at least ten years.
Vendor-built models:
- The NBFC remains accountable for third-party model outcomes.
- Independent validation is required, and a vendor certificate does not replace it.
- The board risk committee gives enhanced oversight to third-party models whatever their risk tier.
- Contracts must provide technical documentation, audit rights for the entity and the supervisor, and continuity and exit terms.
AI and generative AI:
- Controls for explainability, hallucination, bias, overfitting and data drift.
- Red-teaming or equivalent testing, especially for customer-facing or generative models.
- For customer-facing AI: protection against prompt injection, disclosure that the customer is dealing with AI, and a route to a human.
- Human oversight with override and kill-switch arrangements.
- Validation reports reaching the board risk committee within three months of completion.
Once final, the guidance would supersede Chapter 3 (Credit Risk Models) of RBI’s 2002 Guidance Note on Credit Risk Management.
How the three documents connect
The three documents are separate and RBI has not published a combined view. This mapping is our reading of the texts. They meet on one point: the NBFC stays accountable when a vendor, partner or model is involved.
| Theme | Outsourcing Directions | Cybersecurity Directions (banks) | Draft model risk guidance (proposed) |
| Accountability | Outsourcing does not reduce the obligations of the entity, its board or senior management | Banks are accountable for security risk in outsourced and partner arrangements | The entity stays accountable for third-party model outcomes |
| Board oversight | Board approves the outsourcing policy | Board approves and reviews IT and cyber policies annually | Board approves a model risk framework, with enhanced board risk committee oversight of third-party models |
| Contract terms | Audit rights, RBI inspection rights, sub-contractor controls | RBI inspection access to critical partners, vendor testing reports | Technical documentation, audit rights for the entity and supervisor, continuity and exit terms |
| Concentration | Assess reliance on one provider or a few providers | Test resilience across interconnected vendor systems | Concentration and supply chain risk for material third-party AI |
| Exit and continuity | Documented exit plan, safe data removal | Disaster recovery drills | Model continuity in the business continuity plan, fallback mechanisms |
| Incident reporting | Six hours to RBI from the provider’s detection | Six hours through RBI’s DAKSH platform, plus CERT-In | No timeline set. Board risk committee reviews breach reports |
| Independent checks | Audits, including pooled audits for shared providers | Independent vulnerability assessments and penetration tests | Independent validation of all models, even if vendor-certified |
Worked example: a vendor-hosted AI credit-scoring model at an NBFC.
- The outsourcing directions govern the contract, the sub-contractors and the exit plan.
- The cybersecurity directions, where they apply to your bank partners or to you, point to the vendor’s access, testing evidence and incident reporting.
- The draft model risk guidance would require independent validation, explainability checks and board risk committee oversight.
Whether a particular arrangement counts as outsourcing depends on the definitions in each text, so confirm that before mapping.
A four-step roadmap for NBFCs
These steps are our reading of the three documents. They are ordered so that each one feeds the next.
- Build one inventory. List every outsourced service, vendor, sub-contractor, third-party dependency and model, including inactive and decommissioned models. The NBFC outsourcing directions require an inventory of outsourced services and dependencies, and the draft says no model may be used unless it is in the inventory.
- Tier by materiality. Rate each item on operational, financial, reputational and customer impact, not on contract value alone. Review the tiers at least annually, as the draft model risk guidance proposes.
- Align contracts and validate independently. Check every material contract for audit rights, RBI inspection rights, sub-contractor controls, data security, incident reporting and exit terms. Validate models yourself, because a vendor certificate does not replace your validation.
- Report, test and escalate. Run the six-hour incident reporting chain, test exit and disaster recovery plans, and send validation and vendor risk reports to the board or its risk committee.
Where each document pushes hardest. The outsourcing directions press on contract terms, sub-contractor approval, concentration and exit. The cybersecurity directions press on testing cadence, incident reporting and vendor access. The draft model risk guidance presses on inventory, tiering, independent validation and board risk committee oversight.
Who owns what inside an NBFC
Each function holds a different part of the same vendor. These actions are suggested, based on the requirements above.
| Function | What it should own |
| Risk management | The combined inventory of vendors, sub-contractors and models. Materiality tiers, reviewed at least annually. Concentration assessment for critical functions. The model risk framework and reporting to the board risk committee |
| Compliance | Mapping each vendor and model to the document that applies, by entity type and layer. Checking material contracts for mandatory terms. Confirming that functions RBI says cannot be outsourced stay in-house. Tracking the draft model risk guidance until it is final |
| IT and information security | Vendor access control and vendor testing evidence. Detecting incidents and running the six-hour reporting chain. Cloud controls such as identity and access management and multi-factor authentication. Securing external interfaces and guarding customer-facing AI against prompt injection |
| Internal audit | Testing whether the inventory is complete and whether tiers are reasoned. Checking whether audit rights in contracts are actually used. Testing whether exit and disaster recovery plans work in practice. Reviewing whether model validation is independent of the model owner |
| Business owners and procurement | Registering and tiering every new vendor or AI tool before use. Including the required clauses in every new contract |
Self-assessment: ten questions for NBFC leadership
Answer for your own institution. Questions 1 to 9 rest on provisions already in force. Question 10 rests on the draft, so it is a readiness check, not a current requirement.
| No. | Test | Question | Source | Your answer |
| 1 | Board-approved policy | Has your board approved the outsourcing policy, with a separate policy for IT services if you are Middle Layer or above? | NBFC Outsourcing Directions | |
| 2 | Inventory | Do you keep an inventory of outsourced services and third-party dependencies, and of every model, including inactive and decommissioned ones? | NBFC Outsourcing Directions. Draft model risk guidance (proposed) | |
| 3 | Materiality | Do you judge materiality on the importance of the activity and its financial, reputational and customer impact? | NBFC Outsourcing Directions | |
| 4 | Functions that stay in-house | Have you confirmed that internal audit and the strategic and compliance functions stay with you? | NBFC Outsourcing Directions | |
| 5 | Contract clauses | Do material contracts include audit rights, RBI inspection rights, sub-contractor controls, data security, continuity and exit terms? | NBFC Outsourcing Directions | |
| 6 | Sub-contractor approval | Does your provider need your prior approval before engaging a sub-contractor, and is it liable for that sub-contractor? | NBFC Outsourcing Directions | |
| 7 | Six-hour reporting | Does your contract require the provider to report cyber incidents without undue delay, and can you report to RBI within six hours of its detection? | NBFC Outsourcing Directions | |
| 8 | Concentration | Do you assess risk from several arrangements with one provider and from reliance on a few providers for critical functions? | NBFC Outsourcing Directions | |
| 9 | Exit plan | Do you have a documented exit plan with safe data removal and provider cooperation during transition, and have you tested it? | NBFC Outsourcing Directions | |
| 10 | Independent model validation | Is every model, including vendor and AI models, validated independently of the vendor and overseen by your board risk committee? | Draft model risk guidance (proposed) |
Suggested scoring: 8 to 10 Yes means the framework looks sound. 5 to 7 means gaps to close. Below 5 needs a priority review with internal audit.
Common gaps in vendor risk management
These gaps come from vendor-risk practice, not from RBI findings. Treat them as prompts for your own review.
- Tiering by spend. Ranking vendors by annual cost can under-tier a low-cost vendor that sits on a critical process.
- Scattered inventories. Vendor lists kept in separate spreadsheets with no common method.
- Certificates taken at face value. Accepting an ISO 27001 certificate without checking that it covers the relevant service or data centre.
- No exit testing. Exit plans for critical IT vendors that were never tested.
- Weak board reporting. Static reports with no central risk scoring.
- Fourth-party blind spots. Limited visibility into the vendor’s own sub-contractors.
FAQs for NBFCs
What was the deadline for IT outsourcing compliance?
Existing IT outsourcing agreements had to comply at renewal or by 10 April 2026, whichever came first. New agreements must comply from the date they are signed.
Within how many hours must a cyber incident be reported to RBI?
Six hours. Under the outsourcing directions, the six hours run from the provider’s detection of the incident.
Can an NBFC outsource its internal audit or compliance function?
No. The NBFC directions list core management functions, including internal audit and the strategic and compliance functions, as not outsourceable.
Does the IT outsourcing chapter apply to every NBFC?
No. Base-layer NBFCs follow most provisions but not the IT outsourcing chapter. Middle Layer NBFCs and above follow all provisions.
Do the 31 July 2026 cybersecurity directions apply to NBFCs?
They are reported to apply to commercial banks, and we found no NBFC version. NBFCs should confirm what applies to them, and should expect bank partners to pass similar expectations through contracts.
Is the model risk guidance final?
No. It is a draft released for consultation in June 2026, and comments closed on 24 July 2026. Its requirements are proposed until RBI issues a final version.
Who is accountable for a vendor’s AI model?
The NBFC using it. The draft states that the entity remains accountable for third-party model outcomes, and that a vendor certificate does not replace its own independent validation.
How IPPC Group (I.P. Pasricha & Co) can help
IPPC Group (I.P. Pasricha & Co) works with NBFCs on risk, compliance and assurance. For third-party and model risk, we can help your team with:
- Building and tiering a single inventory of vendors, dependencies and models.
- Reviewing outsourcing contracts against RBI’s requirements and listing the gaps.
- Testing the six-hour incident reporting chain and exit readiness for critical vendors.
- Independent review of vendor-supplied models and preparation for the model risk guidance.
- Board and risk committee reporting on vendor and model risk.
To discuss a readiness review, write to sailfreely(Replace this parenthesis with the @ sign)capasricha.com or visit www.ippcgroup.com.
Follow us on LinkedIn : https://www.linkedin.com/company/ippcgroup
and Instagram at https://www.instagram.com/i_p_pasricha/
