CHENNAI: Banks will be prohibited from outsourcing their work in countries where they do not have a branch. In the case of other offshore outsourcing by banks in India, the prior permission of the Reserve Bank of India (RBI) needs to be obtained, according to draft guidelines on "outsourcing of financial services by banks'' issued by the RBI on Tuesday.

Prior approval of the RBI would also be needed in the case of outsourcing of "doorstep banking,'' say the draft guidelines, to which responses have been invited from "all concerned" within a month. The comments can be sent by e-mail to rakeshshukla@rbi.org.in and pjthomas@rbi.org.in.

"Typically outsourced financial services include applications processing (loan origination, credit card), document processing, investment management, marketing and research, supervision of loans, data processing and back office related activities and the like,'' according to the draft guidelines.

Risk factors

Listing the various risks that banks should have to weigh before deciding on outsourcing any financial service within the country or abroad to any agency, the guidelines say that any bank intending to outsource any of its financial activities should put in place a "comprehensive outsourcing policy" approved by its board. Such a policy should incorporate criteria for selection of activities as well as service providers, delegation of authority depending on risks and "materiality" and systems to monitor and review the operations of these activities.

Banks cannot outsource core management functions like corporate planning, organisation, management and control and decision-making functions like determining compliance with Know Your Customer (KYC) norms for opening deposit accounts, according sanction for loans and management.

Disaster recovery

The outsourcing contract should include contingency plans to ensure business continuity, and should provide for the prior approval by the bank of the use of subcontractors by the service provider. The bank should have the right to conduct audits on the service provider, whether by the bank's internal or by external auditors or by agents. Outsourcing agreements should also include a clause to recognise the right of the RBI to cause an inspection of a service provider and its books and account.

The banks and their service providers should not resort to intimidation or harassment of any kind, either verbal or physical, against any person in their debt collection efforts, say the draft guidelines. The prohibitions include acts intended to humiliate publicly or intrude into the privacy of the credit card holders' family members, referees and friends, making threatening and anonymous calls or making false and misleading representations.

Generally, a time limit of 60 days may be given to customers (of outsourced services) for preferring their complaints/grievances. Banks should constitute internal Grievance Redressal Machinery and give wide publicity about it through electronic and print media, the guidelines add.

Access to customer information by staff of the service provider should be limited to those areas where the information is required in order to perform the outsourced function.

The bank should ensure that the service provider is able to isolate and clearly identify the bank's customer information, documents, records and assets to protect the confidentiality of the information.

The bank should immediately notify RBI in the event of any breach of security and leakage of confidential customer related information. In these eventualities, the bank would be liable to its customers for any damage.

Printer friendly page  
Send this article to Friends by E-Mail