Vendor Risk Management Under RBI, SEBI, and IRDA Guidelines
Financial institutions in India run on outsourcing. Banks, NBFCs, brokers, insurers, payment aggregators, and fintechs all depend on third parties for data centres, cloud, software, security operations, and customer-facing services. The regulators that oversee them — the RBI, SEBI, and IRDAI — have made one thing unmistakably clear: you can outsource the activity, but you cannot outsource the accountability.
Each regulator now expects regulated entities to assess, contract with, and continuously monitor their service providers under structured frameworks. For BFSI organisations, vendor risk management is no longer a procurement formality — it is a supervised obligation with real consequences for non-compliance. This guide explains what the three regulators expect and how to build a programme that satisfies all of them.
RBI: Outsourcing and IT Services Oversight
The RBI’s Framework for outsourcing of IT services requires regulated entities to maintain robust governance over service providers, particularly for material outsourcing that could affect critical operations. Boards and senior management are expected to own the outsourcing policy, conduct due diligence before engaging vendors, and ensure contracts include audit rights, security obligations, business continuity, and exit provisions.
Critically, the RBI expects ongoing monitoring rather than one-time approval. Providers handling sensitive functions such as data centres, disaster recovery, and security operations are commonly required to hold recognised certifications like ISO 27001, and concentration risk from over-reliance on a single vendor must be actively managed.
SEBI: The Cybersecurity and Cyber Resilience Framework (CSCRF)
SEBI consolidated its expectations into the Cybersecurity and Cyber Resilience Framework (CSCRF), which applies across a broad set of regulated entities. The CSCRF places clear obligations on managing third-party and vendor risk management, including due diligence, contractual security clauses, monitoring of outsourced IT, and ensuring vendors meet defined cybersecurity standards.
The framework also emphasises measurable cyber resilience — the ability to anticipate, withstand, recover from, and adapt to incidents — which extends to the vendor ecosystem. Regulated entities must be able to demonstrate that their critical service providers do not become the weak link in their resilience posture.
IRDAI: Information and Cybersecurity Guidelines
IRDAI’s information and cybersecurity guidelines require insurers and intermediaries to manage outsourcing and third-party risk as part of their overall security governance. This includes vendor due diligence, contractual safeguards, monitoring of outsourced services, and ensuring that policyholder data handled by third parties is adequately protected.
With the growing volume of sensitive health and financial data in the insurance sector, IRDAI’s expectations align closely with the broader direction of Indian regulation: documented oversight, security assurance from vendors, and accountability that stays with the regulated entity.
Measuring the Human Firewall
What gets measured gets managed. Mature programmes track phishing simulation click and report rates, training completion, time-to-report, and trends across departments. These metrics reveal where risk concentrates and demonstrate progress to leadership and auditors alike.
Crucially, the goal is not to punish employees who fail but to identify where coaching is needed. A blame-free culture encourages people to report mistakes early — which is exactly the behaviour that limits the damage of a real attack.
Common Threads Across All Three Regulators
Despite sector differences, the RBI, SEBI, and IRDAI converge on a consistent set of vendor risk expectations. Building to these common requirements lets a single, well-designed programme satisfy multiple regulators:
1. Risk-based due diligence before onboarding any material vendor.
2. Strong contracts covering security, audit rights, breach notification, and exit.
3. Certification expectations such as ISO 27001 for critical service providers.
4. Continuous monitoring of vendor posture, not just annual reviews.
5. Concentration-risk management to avoid over-dependence on single providers.
6. Board and senior-management accountability for the outsourcing programme.
Building One Programme That Satisfies Many Rules
Rather than running separate, overlapping efforts for each regulator, leading BFSI organisations build a unified vendor risk programme mapped to all applicable frameworks. A tiered vendor inventory, standardised assessments, harmonised contract clauses, and continuous monitoring create a single source of truth that can be evidenced to any auditor or regulator on demand.
This approach reduces cost and audit fatigue while improving actual security. When monitoring is continuous and evidence is centralised, demonstrating compliance becomes a by-product of running the programme well — not a separate scramble each examination cycle.
Conclusion
RBI, SEBI, and IRDAI have converged on a consistent message: financial institutions remain accountable for the security of the vendors they rely on. Documented due diligence, strong contracts, certification expectations, and continuous monitoring are now baseline requirements.
Rather than running separate programmes for each regulator, BFSI organisations should build one unified, evidence-backed vendor risk programme mapped to all applicable frameworks. Done well, demonstrating compliance becomes a by-product of running the programme effectively.
Frequently Asked Questions
What do RBI, SEBI, and IRDAI require for vendor risk?
All three require regulated entities to conduct due diligence before onboarding vendors, include security and audit clauses in contracts, monitor outsourced services continuously, and manage concentration risk. Critical service providers are often expected to hold certifications such as ISO 27001, and accountability always remains with the regulated entity.
Can financial institutions outsource accountability?
No. Regulators are explicit that you can outsource an activity but not the accountability for it. Even when a vendor handles a critical function or sensitive data, the regulated entity remains responsible for ensuring it is performed securely and in compliance with applicable guidelines.
Is ISO 27001 mandatory for BFSI vendors?
While requirements vary, regulators commonly expect providers handling sensitive functions such as data centres, disaster recovery, and security operations to be ISO 27001 certified. Certification provides recognised assurance of a vendor's security management, which is why it frequently appears in BFSI outsourcing requirements.
How Shieldbyte Infosec Can Help
Shieldbyte Infosec, a CERT-In Empanelled Security Auditor with deep BFSI experience, helps banks, NBFCs, brokers, and insurers design vendor risk programmes that satisfy RBI, SEBI CSCRF, and IRDAI expectations simultaneously. We build tiered vendor inventories, standardised assessments, and contract frameworks aligned to each regulator.
Our ShieldRisk platform delivers AI-powered continuous monitoring of your vendor ecosystem, while our audit teams provide the independent assurance regulators expect — turning vendor oversight into a repeatable, evidence-backed process.