Contract, vendor and compliance management for banks and NBFCs

Outsourcing contracts have a prescribed minimum content

The Reserve Bank of India (Outsourcing of Information Technology Services) Directions, 2023, effective 1 October 2023, list in paragraph 16 what every IT outsourcing agreement must contain: data stored only in India, confidentiality controls with the provider's liability for a breach, business-continuity plans and testing, the regulated entity's right to audit the provider and its sub-contractors, the RBI's right to access infrastructure and data held by the provider, prior consent for sub-contracting, and termination rights with an orderly transfer. Paragraph 17.8 requires providers to report cyber incidents fast enough for the entity to report to the RBI within six hours; paragraph 17.10 asks for an assessment of concentration risk where several services sit with one provider; Chapter X requires a documented exit strategy. For NBFCs, the Reserve Bank of India (Non-Banking Financial Companies – Managing Risks in Outsourcing) Directions, 2025, dated 28 November 2025, set out the equivalent clause list for financial-services outsourcing in paragraph 34 and for IT services in paragraph 74, and paragraph 17 makes the NBFC responsible for the conduct of its direct sales agents and recovery agents.

• Playbook: a clause library in IntelloContract carrying the paragraph 16, 34 and 74 clauses, so every vendor agreement starts compliant and AI review flags any deviation before signature.
• Vendor record: IntelloVendor holds the sub-contractor consents, audit reports and concentration-risk assessment against each provider.
• Calendar: IntelloComply tracks exit-strategy reviews, periodic risk reassessments and incident-reporting drills as recurring obligations with owners.

Loan documentation that the RBI has rewritten since 2023

Three RBI circulars changed what a loan agreement must say. The Fair Lending Practice circular of 18 August 2023 requires defaults to be charged as penal charges, not penal interest, with no capitalisation, under a Board-approved policy, with the quantum and reason disclosed in the loan agreement and the Key Fact Statement; existing loans had to be re-papered by 30 June 2024. The Key Facts Statement circular of 15 April 2024 requires a KFS with an Annual Percentage Rate for retail and MSME term loans sanctioned on or after 1 October 2024, and bars any charge not shown in the KFS without the borrower's explicit consent. The Responsible Lending Conduct circular of 13 September 2023 requires original property documents to be released within 30 days of full repayment, with compensation of ₹5,000 per day of delay attributable to the lender. The Reserve Bank of India (Digital Lending) Directions, 2025 add a written contract with each lending service provider that defines roles and obligations, fees paid by the lender rather than the borrower, a cooling-off period, nodal grievance officers on both sides and data stored only on servers in India.

• Templates: loan agreements, sanction letters and KFS forms maintained as versioned Word templates, so a circular change is one template edit, not a hunt through branches.
• Execution: Aadhaar OTP eSign for borrowers, DSC for authorised signatories and e-stamping with the correct state duty in a single flow.
• Repository: every executed agreement indexed with its KFS version, release-due date and security documents, so the 30-day release clock is tracked, not remembered.

KYC vendors and the liability that cannot be outsourced

The Master Direction – Know Your Customer (KYC) Direction, 2016, as updated on 14 August 2025, allows video-based customer identification on par with face-to-face verification subject to encryption, geo-tagging, liveness checks and testing by CERT-In-empanelled auditors, requires records to be kept for at least five years after a transaction or the end of a relationship, and states that where a regulated entity relies on a third party for due diligence, the ultimate responsibility remains with the entity. Contracts with KYC processors, video-KYC providers and business correspondents therefore need retention, audit, CERT-In-audit and liability terms, and the vendor record needs the audit evidence attached.

Debt-listed NBFCs and SEBI LODR

For NBFCs with listed non-convertible debt and no listed equity, Chapter VA of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, inserted with effect from 28 March 2025, applies once outstanding listed debt reaches ₹5,000 crore, the threshold having been raised from ₹1,000 crore by the amendment of 22 January 2026. Schedule XII, inserted with effect from 19 December 2025, sets related-party transaction materiality as a slab of consolidated turnover. Inter-group service agreements and vendor contracts with related parties need to be screened against that slab before signature, which is an approval-routing rule in IntelloContract and a disclosure obligation in IntelloComply.

Why one platform

Regulators look at the contract, the vendor and the control together. IntelloSync keeps the contract, the vendor record, the obligation and the evidence on one repository with one permission model. IntelloContract drafts and negotiates agreements as real Word documents, routes approvals and executes with Aadhaar eSign, DSC or virtual signatures and e-stamping. IntelloVendor onboards and risk-scores third parties. IntelloComply puts statutory and contractual obligations on a calendar with owners, reminders, evidence and an audit trail. IntelloVault stores and indexes every signed document. Pricing is per module with unlimited users, and the platform is ISO/IEC 27001:2022 certified.