Reserve Bank of India (Credit Information Companies – Managing Risks in Outsourcing) Directions, 2025
RBI/DoR/2025-26/379
This page is the record of the instrument itself — reference, dates, scope and source. For what it means in practice, read Third-party risk management in Indian BFSI.
The record
| Reference | RBI/DoR/2025-26/379 |
|---|---|
| Issued by | Reserve Bank of India (RBI) |
| Instrument type | Directions |
| Date of issue | 28 November 2025 |
| Status | In force |
| Binds | Credit Information Companies under section 2(e) of the Credit Information Companies (Regulation) Act, 2005, for material outsourcing of IT services only. Not the Core Investment Companies the NBFC instrument calls CICs. Existing IT outsourcing agreements to comply at renewal or by 10 April 2026, whichever is earlier. |
| Dates it sets |
|
What it says
- Binds Credit Information Companies as defined under clause (e) of section 2 of the Credit Information Companies (Regulation) Act, 2005.
- Covers material outsourcing of IT services only; the instrument has no financial-services outsourcing chapter.
- Gave existing IT outsourcing agreements until renewal or 10 April 2026, whichever came first; new agreements comply from signing.
- Carries its reference as the RBI printed it, RBI/DoR/2025-26/379, where the other eight read RBI/DOR.
What accounts of this instrument get wrong
Read the instrument
The link below goes to the issuing regulator’s own copy. Where a regulator serves its text through a PDF viewer or a query-string URL, it points at the document rather than at a landing page that may not render it.
Instruments that change what this one requires
Not a reading list. Each of these alters the obligation on this page — the amendment that moved a date, the sibling that binds the entity class this one excludes, or the separate track it is routinely merged with.
- RBI NBFC outsourcing Directions, 2025 RBI/DOR/2025-26/363 — NBFCs, HFCs, Core Investment Companies, standalone primary dealers, and the AA and P2P categories.
- Credit Information Companies RBI/DoS/2026-27/470 — Credit Information Companies under the CIC (Regulation) Act, 2005.
This record is one entry in the Indian cyber regulation register, which publishes the same fields for every instrument as an open dataset. Indicative, and not legal advice: whether an instrument reaches your organisation turns on your licences and registrations, and is a determination for your legal team.
Every instrument cited here was verified against the issuing regulator's own notification on .