A third party can improve an institution's capabilities while creating a dependency that must be understood and governed. The important question is not only whether the supplier can perform the contracted task. It is whether the bank or NBFC can continue meeting its responsibilities when the service changes, deteriorates or stops.
Outsourcing risk extends beyond procurement. It includes the information shared, access granted, subcontractors used, concentration of services and the feasibility of exit. A contract signed after a due-diligence checklist is completed marks the beginning of ongoing oversight, not its conclusion.
RBI's directions on managing risks in outsourcing separately address commercial banks and NBFCs. [1] [2] Institutions should assess the applicable requirements and distinguish outsourcing from other supplier arrangements according to the relevant framework. The operating principles below help make that assessment and subsequent oversight practical.
Inventory services rather than only supplier names
A supplier register should identify the services provided, business owners, supported processes, data involved and relevant systems. One supplier may provide several services with different risks. Conversely, one critical process may depend on several suppliers.
Record the legal contracting entity and the institution receiving the service. Group arrangements can obscure this relationship when procurement is centralised. The regulated entity still needs to understand its own dependency, access rights and operational responsibilities.
Maintain links to contracts, assessments, service reports and incidents. A list of vendor names without these relationships is difficult to use during a disruption. The inventory should help answer what stops working if a particular service becomes unavailable.
Assess criticality using consequences
Criticality should reflect the effect of service failure, not only annual spend. Consider customer impact, regulatory obligations, substitutability, data sensitivity, transaction volumes and the time available to recover. A low-cost service can be essential to a critical operation.
Distinguish inherent risk from the effect of controls. A service may remain inherently important even if the supplier has strong controls. Reducing its criticality rating because current performance is good can weaken the oversight needed to keep it reliable.
Document the assessment and review triggers. New data access, expanded service scope, subcontracting or increased business dependence can materially change the risk. The original onboarding rating should not remain fixed for the life of the contract.
Perform due diligence that answers specific questions
Due diligence should examine the supplier's ability to deliver the particular service. Relevant areas can include financial capacity, staffing, technical capability, security, continuity, legal permissions and prior performance. The depth should reflect the service's significance and applicable requirements.
Use evidence rather than broad assurances. A certification or independent report may be helpful, but check its scope, period, exclusions and relevance to the contracted service. It does not automatically cover every system, location or subcontractor involved.
Record gaps and conditions for proceeding. Some issues may need resolution before service begins; others may justify monitored actions if permitted. Make the decision explicit so an unresolved onboarding concern does not disappear after the contract is signed.
Put operational rights into the agreement
The contract should support the institution's ability to oversee and, where necessary, change or end the arrangement. Applicable requirements may address access, audit, confidentiality, data handling, subcontracting, continuity and termination. [1] [2] Legal review should translate those requirements into terms appropriate to the actual service.
Service levels should describe meaningful outcomes and reporting. An availability percentage can be useful, but it may not capture delayed transactions, incomplete data or recurring incidents during important processing windows. Define how failures are identified and escalated.
Clarify responsibilities at the interfaces. Many disputes arise because neither party owns a handoff, a data-quality check or a recovery step. A responsibility matrix should align with the contract and the operating procedure.
Understand subcontractors and concentration
A service may depend on infrastructure, support teams or processing locations supplied by others. Identify material subcontracting dependencies and the institution's rights to information and control under the applicable arrangement. The primary supplier's brand does not reveal the full service chain.
Assess concentration across the institution. Several independently procured services may rely on the same underlying provider or location. A disruption there can affect multiple business processes at once, even if the direct suppliers are different.
Consider sector-wide constraints when planning alternatives. If many institutions would seek the same replacement provider during a disruption, practical switching capacity may be limited. An exit plan should examine availability and migration time, not merely name another vendor.
A worked example: an outsourced collections service
Suppose a hypothetical NBFC engages a service provider for customer contact and collection support. Due diligence confirms staffing and basic systems, but the arrangement also gives agents access to account information and creates a direct effect on customer treatment.
Oversight therefore needs more than a monthly recovery figure. The institution should examine access controls, approved communication practices, complaint patterns, payment handling where relevant and the evidence of service quality. A high collection rate does not establish acceptable conduct.
If complaints reveal a repeated practice inconsistent with instructions, the response may include individual redress, restrictions on the affected activity, revised monitoring and a broader population review. The lender needs evidence that the corrective action changed behaviour, not just a supplier assurance that staff were reminded.
Monitor risk as well as service performance
Routine monitoring should cover service levels, incidents, control changes, unresolved findings and emerging dependencies. Agree what the supplier must report and what the institution verifies independently. Excessively long reports can be as unhelpful as missing information if material issues are buried.
Review changes in the supplier's financial or operational position where relevant. Ownership changes, key staff losses or a major system migration can affect delivery even before a service-level breach occurs. Establish how such developments reach the business owner.
Track overdue supplier actions with the same discipline used for internal remediation. A finding should have an owner, deadline and closure evidence. Repeated extensions may require reassessment of the arrangement, additional controls or escalation to a higher authority.
Test business continuity together
A supplier's continuity plan should connect to the institution's own recovery needs. Compare recovery assumptions, data restoration points, communication routes and the sequence of dependent services. Two individually credible plans can fail when their assumptions are inconsistent.
Test scenarios that involve the interface between organisations. Examples include delayed data delivery, loss of a processing site or unavailable support personnel. Observe whether the institution can obtain timely information and make the decisions needed to protect customers and critical operations.
The Basel operational-resilience principles provide useful background on critical operations and dependencies. [3] The practical focus is whether the service can continue or recover within the institution's tolerances, rather than whether the supplier possesses a continuity document.
Design an exit that can actually be executed
An exit plan should cover normal expiry, planned replacement and stressed termination. Identify data extraction, formats, reconciliation, access removal, knowledge transfer, contractual constraints and the resources needed for migration. Different exit scenarios may require different actions.
Test the portability of important data before it becomes urgent. A contractual right to receive information is less useful if the output is incomplete, undocumented or incompatible with the receiving system. Verify that the institution can interpret and reconcile what it receives.
Account for the transition period. The institution may need parallel operations, temporary controls or extended support. Consider customer communication and regulatory obligations where applicable. An exit that preserves data but interrupts an essential service is not a complete solution.
Check the completeness of service reporting
Supplier dashboards may focus on contracted metrics while excluding incidents classified as customer-caused, planned maintenance or subcontractor issues. Understand those definitions before interpreting a high performance score. Exclusions can be legitimate, but they may still matter to the institution's risk view.
Compare supplier reports with internal incidents, customer complaints and transaction exceptions. Differences can reveal events that did not enter the contractual reporting process or that were classified differently by the two parties.
Agree a route for resolving discrepancies and improving future reporting. The aim is a shared, evidence-based view of service performance. It should allow the institution to see the effect on its own operations even when the supplier's contractual measure remains within target.
Keep accountability visible throughout the lifecycle
Assign a business owner who understands the service and can coordinate procurement, legal, technology, security, risk and compliance input. Central oversight can establish standards and challenge decisions, but it should not leave the operating responsibility unowned.
Review the arrangement after material changes and at an appropriate interval. Confirm that its purpose, scope, criticality and evidence remain current. When the service ends, verify that access is removed, data is handled as required and residual obligations are tracked.
Effective third-party oversight follows the dependency from selection to exit. It asks what the institution relies on, what could fail, what evidence supports confidence and what action remains possible if confidence is lost. Those questions make outsourcing governance useful in daily operations and during disruption.
PRIMARY REFERENCES
Sources & further reading
Primary-source references checked on 12 October 2026. Follow the relevant authority’s current text for applicability, amendments and commencement dates. International standards provide context and are not automatically identical to domestic requirements.