Master Circular on Outsourcing and Third-Party Risk Management

11 October 2026

Circular BM 1234

To: All Licensed Banks
Finance and Leasing Companies
Money Exchange Establishments
Payment Service Providers
(Licensed Institutions)
Operating in the Sultanate of Oman

After compliments,

Subject: Master Circular on Outsourcing and Third-Party Risk Management

1. In pursuance of Articles (58) and (138) of the Banking Law 02/2025, and Article (14) of the National Payment Systems Law 8/2018, the Central Bank of Oman had reviewed the existing instructions related to Outsourcing of Licensed Activities with a view to strengthening governance, operational resilience, customer protection, cybersecurity, business continuity and third-party risk management practices within the banking and financial sector.

2. During the review, due consideration was given to technological developments, digital transformation initiatives, reliance on third-party service providers and relevant best international practices. The revised and consolidated Instructions on Outsourcing and Third-Party Risk Management are set out in Annexure I to this Circular.

3. These instructions shall apply to all outsourcing and third-party arrangements entered into by the Licensed Institution, including technology enabled, cloud based, intra-group and shared service arrangements.

4. These instructions shall come into force from January 01, 2027, and supersede all previous BM circulars, circular letters issued by the Central Bank on the subject matter and as specified in Annexure II.

5. Availing cloud services shall constitute a form of outsourcing for the purpose of these Instructions and shall comply with the applicable requirements contained herein, in addition to the instructions as per Circular No. BM 1185 dated May 08, 2022 on Rules for availing Cloud Services by Licensed Institutions and as amended from time to time.

Circular BM 1234

6. Licensed Institutions shall review all existing outsourcing and third-party arrangements and ensure compliance with these instructions within the timelines specified herein.

7. Licensed Institutions shall, having regard to the availability of skilled and specialised manpower within the Sultanate of Oman, progressively develop and retain appropriate in-house capabilities, particularly in areas integral to their operations. Appropriate measures shall be taken to strengthen internal expertise, facilitate knowledge and skill transfer and to avoid undue or long-term dependence on outsourcing arrangements.

Best regards,

Ahmed Al Musalmi
The Governor

Encl: Annexure I & II

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

1. Objective
   1.1. These instructions aim to establish the minimum regulatory and supervisory requirements governing outsourcing and third-party arrangements entered into by Licensed Institutions.

2. Definitions
   2.1. Outsourcing - An arrangement whereby a Licensed Institution engages a third party, whether affiliated or non-affiliated including intra-group arrangements, to perform activities, services, functions or processes on an ongoing basis that would otherwise be undertaken by the Licensed Institution itself and any other arrangements involving handling of customer data and banking information.

2.2. Third-Party Arrangement - An arrangement whereby a Licensed Institution engages a third-party service provider for the provision of services, systems, infrastructure, platforms, technology, data processing, operational support or other services, whether or not such arrangement constitutes outsourcing.

2.3. Material Outsourcing Arrangement - An outsourcing arrangement which, if disrupted, defective, unavailable, failed or inadequately managed, may materially impair or pose significant risks to:

i) the Licensed Institution's financial condition, reputation, safety or soundness;

ii) operational continuity, quality or delivery of services;

iii) customer protection;

iv) confidentiality, integrity, availability or recoverability of customer, accounting or operational data;

v) compliance with applicable laws, regulations or prudential requirements; or

vi) the Central Bank's ability to conduct effective supervision, examination or enforcement.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

2.4. Intra-group Outsourcing - An outsourcing arrangement between entities belonging to the same financial group or corporate group, including Head Office, Regional Office, shared services centre or group technology provider arrangements.

2.5. Sub-contracting - An arrangement whereby a service provider further outsources part or all of the outsourced activity to another party.

2.6. Technology-enabled Outsourcing - includes outsourcing arrangements involving information technology systems, cloud services, digital platforms, data processing, managed technology services, cybersecurity services, infrastructure hosting, application support or other technology related services.

3. General Principles
   3.1. During outsourcing and third-party arrangements, Licensed Institutions shall remain fully responsible and accountable at all times for the sound and prudent management of their business and for compliance with applicable laws, regulations and Central Bank instructions.

3.2. Outsourcing and third-party arrangements shall not:

i) impair the safety and soundness of Licensed Institutions;

ii) diminish the accountability of the Board of Directors or Senior Management of the Licensed Institution;

iii) impair customer protection obligations;

iv) weaken governance, internal controls or risk management;

v) impair operational resilience or business continuity;

vi) create excessive dependency on service providers; or

vii) impede the Central Bank's ability to conduct effective supervision, examination or enforcement.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

3.3. Licensed Institutions shall maintain sufficient in-house expertise, oversight capability and operational understanding to effectively monitor, supervise and manage outsourced and third-party arrangements. Reliance on outsourcing and third-party arrangements shall not result in the Licensed Institution becoming materially dependent on third-party personnel for the ongoing operation, oversight or management of regulated activities.

3.4. Licensed Institutions shall establish appropriate arrangements to ensure knowledge transfer and retention in relation to outsourced arrangements, including through an effective hybrid operating model, documentation, training or other suitable measures.

3.5. Licensed Institutions may outsource supporting, administrative, analytical, technological or processing activities relating to regulated functions, subject to compliance with the instructions provided herein and that the Licensed Institution retains the final authority, oversight, accountability and decision-making responsibility, including addressing of associated risks.

3.6. Where an outsourcing arrangement involves sharing of or providing access to customer information to the service provider, the Licensed Institution shall ensure that such information or access is limited to what is strictly necessary for the performance of the outsourced activity and is provided on a need-to-know and least privilege basis.

3.7. Licensed Institution shall also ensure apart from compliance with applicable instructions on data protection, that customer consent is appropriately obtained through contractual terms or legally enforceable arrangements and that all applicable legal and regulatory requirements relating to confidentiality and data protection are complied with.

3.8. Licensed Institution shall put in place appropriate safeguards governing the handling of confidential and sensitive data by the service provider, including data classification, encryption, access controls, user authentication, logging and monitoring access, controls over downloading, copying, transmission and onward disclosure of such data and use of appropriately secured communication channels, commensurate with the nature and sensitivity of the information so involved.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

3.9. Unless otherwise specified, Licensed Institutions shall apply the governance, risk management, due diligence, concentration risk, business continuity and incident management under these instructions to third-party arrangements, as appropriate, to the nature, scale, complexity and risk profile of such arrangements.

4. Governance and Risk Management
   4.1. The Board of Directors shall retain ultimate responsibility for all outsourcing and third-party arrangements entered into by the Licensed Institution and shall ensure that such arrangements are consistent with the institutions business strategy, risk appetite, operational resilience objectives and regulatory obligations.

4.2. Licensed Institutions shall adopt a Board-approved Outsourcing and Third-party Risk Management policy, proportionate to their nature, scale, complexity of operations, risk profile and materiality of outsourced activities.

4.3. The Board of Directors shall approve the policy, risk appetite and governance framework, including criteria for classification of outsourcing arrangements. The Board shall review these matters, together with the periodic reporting on material outsourcing arrangements, significant incidents, concentration risks and remediation measures, at least annually.

4.4. Senior Management shall be responsible for the effective implementation, ongoing monitoring and periodical review (at least annually) of all outsourcing and third-party arrangements and shall ensure that Licensed Institution maintains sufficient oversight capability, governance arrangements and competent personnel to effectively manage, monitor and supervise such arrangements.

4.5. Senior Management shall ensure that outsourcing and third-party arrangements do not diminish the Licensed Institution's ability to manage risks, discharge its regulatory obligations or maintain accountability for outsourced activities.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

4.6. Senior Management shall ensure appropriate oversight and periodic review of service provider access to Licensed Institution's systems and data.

5. Classification of Outsourcing Arrangements
   5.1. Licensed Institutions shall classify outsourcing arrangements as:

i) Material Outsourcing Arrangements; or

ii) Non-Material Outsourcing Arrangements.

5.2. In determining materiality, Licensed Institutions shall consider, at a minimum:

i) the nature and importance of the outsourced activity;

ii) customer impact;

iii) transaction volumes and values;

iv) involvement of customer-sensitive, accounting or operational data;

v) dependency on the service provider;

vi) substitutability of the service provider;

vii) operational resilience implications;

viii) concentration risk;

ix) cross-border or jurisdictional risk;

x) sub-contracting dependencies;

xi) recovery and exit complexity; and

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

xii) extent to which the arrangement may affect the Licensed Institution's ability to develop, retain, and sustain critical capabilities and expertise within the institution necessary for the effective oversight and management of the outsourced activity.

5.3. The following arrangements shall be treated as material outsourcing arrangements (indicative list and not exhaustive):

i) Core banking/ Core system hosting, operation or support;

ii) Payment processing, switching, clearing or settlement systems;

iii) Customer data processing or hosting;

iv) Digital banking or payment platforms;

v) Database and IT infrastructure Administration (including network and server administration);

vi) Administrator Privilege in Information Technology and Infrastructure Management;

vii) Cybersecurity operations or security monitoring services;

viii) Disaster recovery or data centre services;

ix) Card processing systems;

x) Cloud services involving material systems or sensitive data;

xi) Outsourcing involving customer, accounting or operational data; and

xii) Any activity designated by the Central Bank as material outsourcing arrangements from time to time.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

5.4. Licensed Institutions shall review the materiality classification of all outsourcing arrangements periodically (at least annually) and whenever there is a material change in the outsourced activity, service provider, subcontracting structure, jurisdiction, technology platform or delivery model.

5.5. The justification for treating an outsourcing arrangement as material or not shall be documented and made available for supervisory and examination review.

6. Functions which cannot be Outsourced
   6.1. The responsibilities of the Board of Directors and Senior Management relating to governance, strategy, risk appetite, oversight and accountability shall not be outsourced.

6.2. Licensed Institutions shall not outsource:

i) Compliance function and accountability for regulatory compliance;

ii) Internal audit function and reporting to the Board or Audit Committee. Outsourcing of the internal audit function for certain categories of licenses, as permitted by the Central Bank shall continue to apply in accordance with the extant instructions. However, such arrangement shall be treated as material outsourcing arrangement needing prior approval from the Central Bank.

iii) Risk management function;

iv) Credit approval authority;

v) AML/CFT Transaction Monitoring, including sanction screening;

vi) Call-centre operations / Helpdesk, involving customer-facing inbound and outbound call handling/communication and related customer service activities;

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

vii) Direct sales activities undertaken through Direct Sales Agents (DSAs) or any other third-party arrangements involving solicitation or acquisition of customers or sale of financial products or services;

viii) Personal Assistants, and Secretarial, coordination, executive or administrative assistance functions directly assigned to, or supporting, the members of the Board or Senior Management;

ix) Final decision-making relating to customer acceptance, AML/CFT escalation or suspicious transaction reporting;

x) Institution's strategy function and related decision making;

xi) Investment and treasury function and related decision making;

xii) Oversight of outsourcing arrangements; and

xiii) Final approval and submission of prudential and regulatory returns.

6.3. The restrictions under Para (6.2) above, shall not prohibit the outsourcing of following activities, provided that the Licensed Institution retains full accountability, independence, oversight and final decision-making authority:

i) supporting systems or technological tools;

ii) analytical or processing support services;

iii) managed technology services;

iv) compliance technology solutions;

v) advisory or consulting services;

vi) audit support services (not involving internal audit function); or

vii) specialised technical expertise engaged on a temporary or project-specific basis and not as a replacement for permanent staffing arrangements, provided such arrangement does not result in the Licensed Institution becoming materially dependent on third-party personnel.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

7. Outsourcing of IT Services and Technology Arrangements
   7.1. Licensed Institutions may outsource information technology services and technology arrangements, including IT infrastructure management, maintenance and support, application development, data centre services, cloud computing services, payment system technology services, data processing or other technology-enabled arrangements related to banking operations provided that such outsourcing shall not:

i) transfer regulated responsibilities or final decision-making authority to the service provider;

ii) impair the integrity, availability or recoverability of customer, accounting or operational records;

iii) impair operational resilience or business continuity;

iv) impair the Central Bank's supervisory or examination access to systems, records, data or audit information; or

v) create undue concentration, operational, legal, reputational or jurisdictional risks.

vi) be in non-compliance with the instructions specified herein.

7.2. Technology-enabled outsourcing shall comply with CBO instructions on Cybersecurity and Resilience, Business Continuity Management, Rules for availing cloud services, Payment Systems and Data Protection.

7.3. Access to the Licensed Institution's systems, applications, infrastructure and technology resources by service provider personnel shall be granted only on a need-to-know and least-privilege basis, commensurate with the functions performed. Privileged or administrator access, where necessary, shall be specifically authorised, time-bound where appropriate, subject to enhanced monitoring and periodically reviewed.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

7.4. Service provider personnel shall be assigned unique user credentials and shall not use, share or otherwise have access through the credentials of employees or other users of Licensed Institution. All access and privileged activities shall be appropriately logged, monitored and subjected to periodic review.

8. Prior Approval Requirements
   8.1. Material outsourcing arrangements with a service provider domiciled in the Sultanate of Oman can be undertaken without seeking prior approval from the Central Bank of Oman, subject to satisfying the following conditions:

i) Apart from satisfactory due-diligence requirements and capabilities, the service provider shall have physical presence in the Sultanate of Oman.

ii) The service provider shall have the capacity to independently offer the services within the Sultanate of Oman.

iii) In case there is sub-contracting, the sub-contracting entity shall also be domiciled in the Sultanate of Oman.

iv) The Omanisation ratio of the service provider shall not be less than 50%. Where sub-contracting is permitted, the sub-contracting entity shall also maintain an Omanisation ratio of not less than 50%. Where a higher Omanisation ratio is prescribed by the competent authority for either entity, such higher ratio shall apply to the respective entity.

v) There shall be compliance with all other requirements specified herein.

vi) Licensed Institution shall notify the Central Bank, at least two months prior to the effective engagement date of any material outsourcing arrangement. The notification shall include details of the arrangement, including the nature and scope of services, particulars of the service provider, the due diligence conducted, effective date of engagement and confirmation of compliance with the requirements specified herein.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

The notification does not require acknowledgement from the Central Bank and the licensed institution may implement the arrangement on the notified effective date. The Central Bank shall, within the two-month notification period referred to above, seek further information as it considers necessary.

8.2. Where a Licensed Institution is unable to comply with any of the conditions specified under Para 8.1(i) to (v), the proposed material outsourcing arrangement shall be subject to prior approval of the Central Bank.

8.3. All other material outsourcing arrangements with a service provider domiciled outside the Sultanate of Oman shall require prior approval from the Central Bank of Oman.

8.4. A Licensed Institution seeking prior approval from the Central Bank shall submit the following information, to enable the Central Bank to assess the proposed arrangement, including at a minimum:

i) Description of the proposed outsourcing arrangement, including:

• nature and scope of the outsourced activity;

• rationale for outsourcing;

• commencement date and duration;

• whether the arrangement is intra-group, offshore or technology-enabled, including jurisdictions involved of the service provider.

ii) Assessment of materiality of the arrangement;

iii) Approval of the arrangement by a Board level committee or a competent management committee duly authorised under the Board approved outsourcing policy;

iv) Risk assessment covering:

• Operational risk;

• Cybersecurity risk;

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

• Data confidentiality and privacy risk;

• Legal, regulatory and jurisdictional risk;

• Concentration risk;

• Operational resilience implications;

• Subcontracting risks; and

• Exit and transition risks;

v) Details of the proposed service provider, including:

• Ownership and group structure;

• Financial condition;

• Regulatory status of the service provider;

• Relevant experience and capability demonstrating the conduct of the outsourced activity;

• Operational resilience capability;

• Material subcontracting arrangements;

• Relevant certifications or independent assurance reports;

vi) Details of customer or operational data involved, including:

• Nature and classification of data;

• Hosting, storage and processing locations;

• Cross-border transfer arrangements; and

• Encryption and security controls;

vii) Confirmation that the outsourcing agreement incorporates the applicable contractual requirements specified under Para (12) below of these instructions.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

viii) Confirmation from the Head of Compliance that the proposed arrangements comply with the requirements of Article (58) and (59), or Articles (141) and (142), as applicable, of the Banking Law 02/2025, and Article (14) of the NPSL 8/2018, and all other requirements of this circular.

ix) Institution specific contingency, recovery and exit plans, including transition arrangements in the event of disruption, termination or service provider failure;

x) Confirmation that the Licensed Institution retains adequate in-house expertise to govern and oversee the outsourced arrangement;

xi) Confirmation that the Licensed Institution has done the necessary due diligence on the service provider to its full satisfaction; and

xii) Such other information or documentation as may be required by the Central Bank.

8.5. Approval granted by the Central Bank shall not relieve the Licensed Institution from its responsibility to ensure regulatory compliance of the outsourcing arrangement.

8.6. Non-material outsourcing arrangements, as determined in accordance with the materiality assessment criteria prescribed under these instructions, may be undertaken without seeking prior approval from the Central Bank, subject to compliance with the applicable requirements under these instructions.

9. Foreign Bank Branches and Intra-group Arrangements:
   9.1. Branches of foreign banks operating in the Sultanate of Oman may utilise their Head Office, regional office or group-wide outsourcing arrangements, including shared-service, regional-processing or technology arrangements, subject to prior approval mentioned in Para (8) above and in compliance with the instructions outlined as per Para (9.2) below.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

9.2. Foreign bank branches shall ensure that:

i) It maintains appropriate and sufficient local staff to demonstrate adequate local oversight and accountability over its operations;

ii) The Central Bank shall have unrestricted supervisory, examination and access rights in relation to the outsourced activities and relevant records;

iii) Customer information, accounting records, transaction records and relevant operational records remain accessible to the Central Bank at all times;

iv) The arrangement does not impair operational continuity within the Sultanate of Oman;

v) The Head Office or relevant group entity provides such undertakings or confirmations as may be required by the Central Bank;

vi) Any audit findings, supervisory concerns or material deficiencies identified by the Home Supervisor, Head Office, External auditors, Internal Audit function or any other competent authority in relation to the outsourced arrangement are promptly communicated to the Central Bank.

vii) The Central Bank may impose additional conditions or safeguards where offshore or intra-group outsourcing arrangements are considered to pose heightened risk.

9.3. Intra-group outsourcing shall not be treated as lower risk merely because the service provider is part of the same group. Licensed institution shall conduct appropriate due diligence, risk assessment, monitoring and exit planning for intra-group arrangements.

9.4. Notwithstanding the provisions under Para (6.2) above, the Central Bank may, on a case-by-case basis and subject to prior approval, permit a foreign bank branch to rely on its Head Office, Regional Office or group-wide entity for the performance of certain functions specified therein, having regard to the nature, scale and complexity of its operations provided that the branch retains adequate local oversight and accountability and compliance with applicable regulatory requirements.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

10. Register for Outsourcing and Third-Party Arrangements
    10.1. Licensed Institutions shall maintain:

i) Comprehensive and up-to-date outsourcing and third-party arrangement register. The register shall include, at a minimum:

• service provider details;

• outsourced activities or third-party services;

• number of personnel from the service provider engaged under the arrangement and number of personnel of the Licensed Institution assigned to oversee, manage or support the arrangement;

• omanisation ratio of the service provider;

• materiality classification;

• data hosting or processing locations;

• subcontracting arrangements;

• contract duration;

• approval status, where applicable;

• target date to internalize the function or arrangement, where applicable; and

• exit arrangements (transition timeline and existing capabilities/ alternative options).

ii) The register shall be submitted to the Surveillance department through FTP on an annual basis, within 30 days from the end of each calendar year. The first regular annual submission shall be for the year ending 31st December 2027. Licensed Institutions shall, however, submit an initial register of all existing arrangements as at 31st December 2026 within 30 days from the effective date of these instructions.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

11. Due diligence Requirements
    11.1. Prior to entering into material outsourcing arrangements, Licensed Institutions shall conduct documented due diligence on the service provider, including assessment of:

i) financial soundness and reputation;

ii) technical capability;

iii) operational resilience;

iv) cybersecurity capability;

v) ownership and control structure;

vi) any direct or indirect related party relationships involving the service provider or its sub-contractors and any actual, potential conflict of interests arising therefrom;

vii) Associated country risk;

viii) legal and regulatory compliance;

ix) subcontracting dependencies;

x) audit reports and certifications;

xi) business continuity capability; and

xii) exit support capability.

11.2. Any conflict of interest identified during the selection, due-diligence or on-going monitoring of a service provider shall be appropriately documented, disclosed and managed in accordance with the Licensed Institution's applicable related party policies.

11.3. The due diligence and suitability of the service provider for material outsourcing arrangements shall be reviewed at least annually and upon any material change in the risk profile of the service provider, jurisdiction, sub-contracting arrangement or service delivery model.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

12. Contractual Requirements under the Outsourcing agreement
    12.1. The activities to be outsourced and respective contractual liabilities and obligations of the service provider and the Licensed Institution shall be clearly specified in the outsourcing agreement.

12.2. All outsourcing agreements shall include at the minimum provisions relating to:

i) scope of services and service levels;

ii) customer data confidentiality and data protection including data ownership, permitted access and use of data, storage locations, onward disclosure and notification timelines in the event of a data breach;

iii) licensed institution's ability to access all records related to the outsourced activity;

iv) audit rights;

v) compliance with Article (58) and (59), or Articles (141) and (142), as applicable, of the Banking Law 02/2025, and Article (14) of the NPSL 8/2018;

vi) unrestricted access rights for the Central Bank, External auditors, Internal auditors and persons appointed by the Central Bank to relevant infrastructure (devices and equipment's), records, systems, personnel, premises and information relating to outsourced activity;

vii) the service provider shall undertake to furnish all reports, data, information, records, documents, correspondence or any other materials required by the Central Bank, in the manner and at the times specified by the Central Bank;

viii) the service provider shall undertake to appear before the Central Bank whenever requested to do so;

ix) incident notification obligations;

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

x) clear reporting and escalation mechanisms;

xi) business continuity and disaster recovery;

xii) subcontracting restrictions;

xiii) termination rights;

xiv) data return and portability;

xv) secure deletion of data;

xvi) competent forum for dispute resolution; and

xvii) compliance with applicable laws of the Sultanate of Oman and Central Bank instructions.

13. Sub-Contracting
    13.1. Service providers shall not sub-outsource material outsourcing arrangement activities without giving prior notice to the Licensed Institution.

13.2. Licensed Institutions shall ensure that risks arising from subcontracting arrangements are appropriately identified, assessed, monitored and managed.

13.3. Any sub-contracting of a material outsourcing arrangement shall be notified to the Central Bank. Where the proposed sub-contracting materially changes the risk profile, jurisdiction, data handling, service delivery model or resilience of an arrangement requiring prior approval under these instructions, prior approval of the Central Bank shall be obtained.

13.4. Licensed Institutions shall ensure that material subcontractors are subject to requirements equivalent to those applicable to the primary service provider.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

14. Concentration Risk
    14.1. Licensed Institutions shall identify, assess and manage concentration risk arising from:

i) dependence on a single service provider;

ii) dependence on a single technology or infrastructure provider;

iii) dependence on group shared-service arrangements;

iv) technology lock-in;

v) jurisdictional concentration; and

vi) systemic concentration affecting the financial sector.

14.2. The Central Bank may require additional safeguards, diversification arrangements, contingency measures or exit arrangements where concentration risk is considered excessive.

15. Business Continuity and Exit Management
    15.1. Licensed Institutions shall comply with applicable requirements specified in Master Circular on Business Continuity Management (Circular No. BM 1225) and shall maintain documented business continuity, disaster recovery and exit plans for material and non-material outsourcing arrangements. This shall involve the identification of alternative service providers or arrangements for bringing the service in-house. The plan must consider how long the transition would take and what interim arrangements would apply.

15.2. Exit plans shall ensure continuity of operations in the event of:

i) service disruption;

ii) insolvency of the service provider;

iii) cyber incidents;

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

iv) deterioration of service quality;

v) contract termination;

vi) service provider failure; or

vii) regulatory restriction.

15.3. Licensed institutions shall periodically monitor and test business continuity, recovery, migration and exit arrangements for material outsourcing arrangements. The frequency of such testing shall be proportionate to the materiality and risk profile of the arrangement and shall be conducted at least annually or more frequently where warranted.

15.4. The results of such tests, identified gaps and remedial measures shall be reported to the Board level Risk Management Committee in case of local banks and to equivalent governing committee or Senior Management in case of branches of foreign bank and other licensed institutions, as applicable.

16. Audit and Compliance
    16.1. The internal audit function must review and report to the Board or the Board audit committee in case of banks and to Board/Management committee in case of other licensed institutions (at least on annual basis), on compliance with and the effectiveness of the Licensed Institutions Outsourcing and third-party risk management policies and procedures with the instructions referred herein.

16.2. The compliance function must regularly review and report to Senior Management, or to the Board as necessary (at least on annual basis), on the compliance of Outsourcing and Third-party arrangements with the law, regulations, instructions and policies applicable to the Licensed Institutions.

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

17. Incident Reporting
    17.1. Licensed Institutions shall promptly notify the Central Bank (to the Manager, Examination department and Manager, Surveillance department) of any material incident affecting Material Outsourcing Arrangement, including:

i) service disruption;

ii) cyber incidents;

iii) customer data breaches;

iv) operational failures;

v) service provider failures; or

vi) material subcontractor failures.

17.2. The notification shall include, at a minimum:

i) nature of the incident;

ii) operational and customer impact;

iii) remedial measures;

iv) recovery timeline; and

v) preventive actions.

17.3. Incident reporting under these instructions shall be without prejudice to any other reporting obligations under applicable CBO instructions on Cybersecurity, Business Continuity, Payment Systems, Consumer Protection, AML/CFT or any other relevant regulatory requirement.

18. Notwithstanding the provisions contained in these instructions, the Central Bank may, where considered necessary for prudential, operational resilience, consumer protection, cybersecurity, financial stability or supervisory reasons:

i) require additional controls or safeguards for material outsourcing arrangements;

Annexure - I
Master Circular on Outsourcing and Third-Party Risk Management

ii) impose conditions on approval;

iii) require remediation of identified deficiencies;

iv) restrict or prohibit an outsourcing arrangement;

v) require migration of activities, systems or data;

vi) require termination of an outsourcing arrangement;

vii) impose any other supervisory measures as it deems appropriate.

19. These instructions shall apply to all new outsourcing and third-party arrangements entered into on or after the effective date. Licensed Institutions shall review all existing outsourcing and third-party arrangements as at the effective date and ensure compliance with these Instructions on or before June 30, 2027.

Annexure - II
Master Circular on Outsourcing and Third-Party Risk Management

List of BM Circular and Circular letter withdrawn with effect from 01st January 2027:

S No	Date	Circular Number	Subject
1.	April 16, 2011	BM 1080	Outsourcing
2.	May 27, 2013	BDD/CBS/CB/2013/4835	Outsourcing Arrangements