India: Adopted Reserve Bank of India (Outsourcing of Information Technology Services) Directions, 2023

On 10 April 2023, the Reserve Bank of India (RBI) adopted the Reserve Bank of India (Outsourcing of Information Technology Services) Directions, 2023. The Directions seek to regulate the risks associated with increased outsourcing of services by Regulated Entities (REs) in the financial system. The Directions set out requirements that REs wishing to outsource IT services must follow, including evaluating the need for outsourcing, enacting an outsourcing policy, conducting due diligence on third parties, signing a legally binding outsourcing agreement, and implementing risk management and oversight frameworks. The Directions set certain minimum requirements for outsourcing agreements, including the requirement for third parties to store data only in India. The Directions enter into force on 1 October 2023.