Three Rules That Turned Vendor Contracts into a Compliance Problem for Banks, NBFCs and Fintechs
RBI's 2025 outsourcing directions, the DPDP Act and the MSMED Act all push compliance into contract clauses. Here is what banks, NBFCs and fintechs need in their vendor agreements and how to find the gaps.
For a regulated lender, a vendor agreement used to be a procurement document. Three developments have changed that. The Reserve Bank's consolidated outsourcing directions of November 2025 list, item by item, what an outsourcing agreement must contain. The Digital Personal Data Protection Act, 2023 makes the bank answerable for processing done by its vendors. And the MSMED Act's payment timelines now carry an income-tax consequence. Each one is enforced, in practice, through the words in a contract.
This article sets out what each rule requires in the agreement itself and gives a gap-finding method that works for a portfolio of hundreds of vendor contracts. Position as of October 2026.
Rule 1: RBI's Managing Risks in Outsourcing Directions, 2025
On 28 November 2025 the RBI issued the Reserve Bank of India (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025 (RBI/DOR/2025-26/171), effective immediately, together with a parallel set for NBFCs (RBI/DOR/2025-26/363) and other regulated entities. For commercial banks the 2025 Directions repeal the earlier financial-services and IT outsourcing guidance, including the 2023 IT Outsourcing Directions, and bring both into one document. Existing IT outsourcing agreements must comply at renewal or by 10 April 2026, whichever is earlier.
Two paragraphs matter most for contracts:
Financial-services outsourcing (paragraph 34 of the bank Directions) requires the agreement to cover, among other things: the activity and its service standards; the bank's access to books and records; continuous monitoring; prior approval for subcontracting; data confidentiality and the provider's liability for breaches; business continuity plans; the bank's audit rights; the RBI's right to access records and inspect the provider; a termination clause with a minimum notice period; and confidentiality that survives termination.
IT outsourcing (paragraph 69) adds a longer list, including: reporting of material adverse events; compliance with the IT Act, 2000; service level agreements; "storage of data only in India (as applicable) as per extant regulatory requirements"; disclosure of what bank and customer data the provider captures and stores; indemnities and dispute resolution; the RBI's right to inspect the provider and its subcontractors; the provider's obligation to comply with RBI directions; termination with orderly transfer to another provider; designation of essential personnel; back-to-back arrangements with OEMs; and a non-disclosure agreement for retained information.
The practical consequence: a vendor contract signed in 2022 almost certainly lacks several of these items. The Directions are explicit that the bank remains responsible; the vendor's silence is the bank's gap.
Rule 2: The DPDP Act makes the vendor's processing your problem
Under section 8(2) of the DPDP Act a Data Fiduciary (the bank or NBFC deciding why and how customer data is processed) may engage a Data Processor "only under a valid contract". Section 8(5) requires the fiduciary to protect personal data "including in respect of any processing undertaken by it or on its behalf by a Data Processor". Section 8(1) adds that this responsibility applies "irrespective of any agreement to the contrary".
The DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025) spell out the safeguards in rule 6, which include encryption or masking, access controls, logs and monitoring, backups, retention of logs and personal data for one year, and, in terms, "appropriate provision in the contract" with the Data Processor. Rule 7 requires the fiduciary to notify affected individuals and the Data Protection Board "without delay" after a breach and to file a detailed report with the Board within seventy-two hours. Those obligations sit in Phase 3 of the Rules and commence on 13 May 2027. The maximum penalty for failing to take reasonable security safeguards is Rs 250 crore (Schedule, read with section 33).
What this means in the contract: a processing clause that names the purpose, limits use, requires the vendor's own safeguards to meet rule 6, obliges the vendor to report incidents fast enough for you to meet the 72-hour report, requires erasure when the purpose ends (section 8(7)(b)), and gives you audit rights.
Rule 3: MSMED payment terms now have a tax cost
Section 15 of the MSMED Act, 2006 requires a buyer to pay a micro or small enterprise supplier by the agreed date, and the agreed period cannot exceed forty-five days from acceptance; with no written agreement, payment is due within fifteen days. Section 16 charges compound interest on delayed payments. Since Assessment Year 2024-25, clause (h) of section 43B of the Income-tax Act, 1961 allows a deduction for sums payable to micro or small enterprises only in the year of actual payment if the MSMED time limit is missed. Payment terms in vendor contracts with MSE suppliers are therefore a finance issue, not just a procurement one, and a "net 60" clause with a registered MSE is a problem clause.
A clause-gap method for a vendor portfolio
- Classify. Tag each vendor contract by (a) whether the vendor is an outsourcing arrangement under the RBI Directions, (b) whether the vendor processes customer personal data, and (c) whether the vendor is a registered micro or small enterprise (ask for the Udyam registration).
- Build the three checklists from paragraph 34 and paragraph 69 of the Directions, rule 6 and rule 7 of the DPDP Rules, and section 15 of the MSMED Act.
- Extract and compare. For each tagged contract, record whether each required clause is present, absent or partial. In a contract lifecycle system this is a metadata exercise; in a shared drive it is a reading exercise.
- Prioritise by renewal date and risk. The RBI's compliance deadline for existing IT agreements has passed; DPDP obligations commence in May 2027. Re-paper the IT and data-heavy vendors first, at renewal where possible.
- Standardise the fix. Use one addendum per rule rather than bespoke redlines, and track acceptance and execution centrally.
Checklist: ten clauses most often missing
| Clause | Source |
|---|---|
| RBI right to inspect vendor and subcontractors | Bank Directions para 69(xii) |
| Prior written consent before any subcontracting | Bank Directions para 4(2), 34 |
| Data storage only in India where required | Bank Directions para 69(vi) |
| Material adverse event and incident reporting | Bank Directions para 69(iii) |
| Orderly transfer on termination / exit plan | Bank Directions paras 69(xv), 79-82 |
| Valid processing contract with purpose and use limits | DPDP Act s. 8(2) |
| Vendor security safeguards aligned to rule 6 | DPDP Rules r. 6(1)(f) |
| Breach reporting timeline enabling 72-hour report | DPDP Rules r. 7 |
| Erasure on withdrawal of consent / purpose ending | DPDP Act s. 8(7)(b) |
| Payment term within 45 days for MSE suppliers | MSMED Act s. 15; IT Act s. 43B(h) |
Where Legatio fits. The method above depends on being able to see every vendor contract, tag it, extract the clauses and run an addendum through signature in bulk. A CLM platform such as Legatio provides the repository, clause tagging, workflow and e-signature layer for that exercise; the regulatory requirements apply whether or not you use one.
Position stated as of October 2026. General information, not legal advice. Banks and NBFCs should confirm the Directions applicable to their category.