The Reserve Bank of India in a draft guideline has said banks would require its prior approval for outsourcing services when the service provider is located outside India. This also applies when outsourcing is in relation to doorstep banking.
Banks have been asked to abstain from outsourcing core management functions such as corporate planning, organisation, management and control.
Also they have to keep away from outsourcing in decision-making functions such as determining compliance with know your customer norms for opening deposit accounts, according sanction for loans and management of investment portfolio.
Based on the final guidelines, banks will have to put in place a board approved policy for outsourcing. According to the guidelines, the banks would be responsible for the actions of their service provider. This includes direct selling agents (DSAs) and recovery agents.
The board of the bank, or a committee delegated by it, will be responsible for approving a framework to evaluate the risks and laying down appropriate approval authorities for outsourcing. It will also have to undertake regular review of outsourcing strategies and decide on business activities of a material nature to be outsourced.
They would also be responsible for confidentiality of information pertaining to the customers that is available with the service provider.
The underlying principles behind these guidelines are that outsourcing arrangements should neither diminish the banks' obligation to customers and RBI, nor impede effective supervision by RBI.
RBI has defined outsourcing of banking activities as a bank's use of a third party (either an affiliated entity within a corporate group or an entity that is external to the corporate group) to perform activities on a continuing basis that would normally be undertaken by the bank itself, now or in the future.
As per these guidelines, banks need to put in place a robust grievance redressal mechanism and banks which have entered into any such outsourcing arrangements, should notify RBI of such arrangements.
The central bank has also enforced that a bank should prevail on service providers to develop and establish a robust framework for documenting, maintaining and testing business continuity and recovery procedures.
Banks, in this regard, need to ensure that the service provider periodically tests the business continuity and recovery plan and may also consider occasional joint testing and recovery exercises with its service provider.
More from rediff