RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices

RBI/2023-24/107
DoS.CO.CSITEG/SEC.7/31.01.015/2023-24

November 7, 2023

The Chairman/Managing Director/Chief Executive Officer
Scheduled Commercial Banks (excluding Regional Rural Banks);
Small Finance Banks; Payments Banks;
Non-Banking Financial Companies;
Credit Information Companies; and
All India Financial Institutions (EXIM Bank, NABARD, NaBFID, NHB and SIDBI)

Madam/Dear Sir,

Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices

Please refer to paragraph IV (8) of the Statement on Developmental and Regulatory Policies released with the Bi-monthly Monetary Policy Statement 2021-22 on February 10, 2022, wherein it was announced that draft guidelines, updating and consolidating the instructions relating to Information Technology (IT) Governance and Controls, Business Continuity Management and Information Systems Audit, will be issued by the Reserve Bank of India.

2. Accordingly, a draft Master Direction on the subject was published in October 2022 seeking public comments.  Based on feedback received, the final Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023 are enclosed herewith.

Yours faithfully,

(T.K.Rajan)
Chief General Manager

Encl: Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023