Reserve Bank of India (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025

The record

What it says

• Binds commercial banks, with immediate effect from 28 November 2025.
• Gave existing IT outsourcing agreements until 10 April 2026 to comply.
• Repeals the 2023 Master Direction on Outsourcing of IT Services for the banks it covers.
• Remains in force after the 2026 cybersecurity Directions, whose third-party paragraphs apply only to arrangements falling outside this instrument.

What accounts of this instrument get wrong

Read the instrument

The link below goes to the issuing regulator’s own copy. Where a regulator serves its text through a PDF viewer or a query-string URL, it points at the document rather than at a landing page that may not render it.

• RBI/DOR/2025-26/171 — RBI’s own copy

Instruments that change what this one requires

Not a reading list. Each of these alters the obligation on this page — the amendment that moved a date, the sibling that binds the entity class this one excludes, or the separate track it is routinely merged with.

• RBI NBFC outsourcing Directions, 2025 RBI/DOR/2025-26/363 — NBFCs, HFCs, CICs, standalone primary dealers and the account aggregator and P2P categories.
• Commercial Banks RBI/DoS/2026-27/410 — Banking companies other than Small Finance Banks, Payments Banks and Local Area Banks.

This record is one entry in the Indian cyber regulation register, which publishes the same fields for every instrument as an open dataset. Indicative, and not legal advice: whether an instrument reaches your organisation turns on your licences and registrations, and is a determination for your legal team.