The Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023 were issued on 7 November 2023 and came into effect on 1 April 2024. They cover commercial banks, NBFCs in the Top, Upper and Middle Layers, credit information companies and five named All India Financial Institutions. Local area banks and core investment companies are excluded.
Who is covered
Section 2 lists: banking companies, corresponding new banks and State Bank of India; NBFCs in the Top Layer, Upper Layer and Middle Layer under RBI's scale based regulation; credit information companies; and the All India Financial Institutions EXIM Bank, NABARD, NaBFID, NHB and SIDBI. Small finance banks and payments banks are included through the footnote on banking companies. Local Area Banks and NBFC Core Investment Companies are not covered.
If you build software for these institutions, you are usually a vendor to a regulated entity. The direction reaches you through contracts and assurance requests rather than directly.
The chapter map
- Chapter II, IT governance: board, IT strategy committee, steering committee, head of IT.
- Chapter III, infrastructure and services: third party arrangements, change and patch management, audit trails, cryptographic controls, access controls, teleworking.
- Chapter IV, risk: risk assessment, vulnerability assessment and penetration testing, cyber incident response.
- Chapter V, business continuity and disaster recovery.
- Chapter VI, information systems audit.
What lands on development teams
- Audit trails: applications that touch critical or sensitive information must have logging that supports audit and forensics (section 15).
- Cryptography: strong key lengths, algorithms and protocols, with no use of deprecated or demonstrably insecure ones (section 16).
- Patch and change management with documented procedures (section 13).
- Vulnerability assessment and penetration testing on a set schedule, covered in a separate post.
- Vendor assurances on application security, also covered separately.
- DR drills and tested backups, covered separately.
How to use this as a vendor
Expect customers to ask for evidence mapped to sections. A short table that maps each relevant section to your control and artifact answers most requests. Keep the claims factual: describe what you do, and do not claim your product makes the customer compliant.
Try it yourself
Open the demo and see how controls map to framework requirements. Notice how one control can serve several sections.
Click through it at your own pace, or open it full screen.
Safeguard's compliance and evidence automation can organise evidence against framework controls. It does not certify anyone against an RBI direction.
Quick check
Does a SaaS vendor to a bank fall under this direction?
The direction addresses the regulated entities. A vendor meets it through the customer's contract and assurance process.
When did it take effect?
1 April 2024, per section 1(c).
Sources
Last reviewed: 19 October 2026.
