1. What is Outsourcing Governance?

Outsourcing = Use of a third party (affiliated entity within group or external entity) to perform activities on a continuing basis that would normally be undertaken by the company itself.

Governance of Outsourcing Committee means:

1. Decide what CAN be outsourced and what CANNOT
2. Approve vendor, contract, SLA, exit plan
3. Monitor vendor continuously
4. Ensure you can bring it back in-house if vendor fails

2. Legal Framework - India + EU + Global

A. India - RBI (Strictest in World)

1. RBI Managing Risks in Outsourcing Directions, 2025 - For NBFCs / Banks / Local Area Banks
Boards (or delegated Board Committees) are required to:

• Approve comprehensive outsourcing policy
• Determine materiality thresholds
• Approve all material outsourcing arrangements
• Review outsourcing risks periodically
• Ensure annual compliance certification to RBI

2. RBI Master Direction on Outsourcing of IT Services (April 2023, effective Oct 2023)

• Applies to Banks, NBFCs (except Base Layer), All India FIs
• Board and senior management are ultimately responsible for outsourcing operations
• Must report to RBI within 6 hours of IT vendor detecting incident
• Must have IT Strategy Committee to govern all IT outsourced operations

3. RBI IT Governance Master Direction for NBFCs (7 Nov 2023, effective 1 April 2024) + NBFC Cybersecurity Directions 2026 (31 July 2026)

• Board-approved IT, InfoSec, Cyber policies mandatory
• IT Strategy Committee must institute effective governance for all IT outsourced operations

Core Rule in RBI: Core and strategic functions cannot be outsourced - Credit appraisal, decision-making, KYC decision, Board functions, Internal Audit, Compliance. Outsourcing to related parties is allowed only with Board / Audit Committee approval + SLA.

4. SEBI & IRDAI

• SEBI CSCRF / Outsourcing Circular for Market Infrastructure Institutions: Stock exchanges, depositories must have Outsourcing Committee, cannot outsource core matching / clearing.
• IRDAI Outsourcing Regulations 2017 for Insurers: Board must approve outsourcing policy, cannot outsource underwriting, claims decision.

B. Europe - EBA + DORA

EBA Guidelines on Outsourcing (2019) -> Replaced by EBA Final Guidelines on Sound Management of Third-Party Risk for Non-ICT Services (18 Sept 2026, EBA/GL/2026/09)

Key uplift:

• Management body must approve written Third-Party Risk Strategy
• Must establish a role tasked with monitoring ALL third-party arrangements
• Covers entire lifecycle: Pre-contract due diligence -> Contract -> Monitoring -> Exit
• Applies to intragroup and third-country providers too

DORA (EU) 2022/2554 governs ICT third parties: Cloud (AWS, Azure), AI vendors, cybersecurity providers.

• Board is personally responsible for ICT risk.
• Must maintain register of all ICT third parties, test resilience, have exit strategy.

This is the new global standard: EBA for Non-ICT, DORA for ICT - together they cover everything.

C. USA - OCC / Federal Reserve

OCC Bulletin 2013-29 + Interagency Guidance on Third-Party Risk Management 2023: Board must oversee third-party risk like its own risk. Cannot delegate accountability.

3. Structure of a Good Outsourcing Committee

Not just a rubber stamp. It must have:

Composition: Minimum 3 directors, majority independent, Chair must be Independent Director. Must include: CIO / CTO, CISO, Head of Risk, Head of Procurement, Head of Legal. In banks, IT Strategy Committee chair must be Independent.

Mandate - 7 Duties:

4. Landmark Case Laws - Where Outsourcing Governance Failed

CASE 1: HDFC Bank IT Outages (2018-2020) - India - The RBI Ban Case

Facts: HDFC Bank, India's largest private bank, had repeated outages in NetBanking, Mobile Banking, UPI - Dec 2019, Nov 2020. Root cause: Outsourced data centre capacity and IT infrastructure not scaled, vendor management failure.
RBI Action (Dec 2020): RBI barred HDFC Bank from launching new digital products and issuing new credit cards until IT issues fixed. Unprecedented action against a private bank.
Governance Lesson: Board's IT Strategy / Outsourcing Committee failed to monitor capacity, SLA, vendor performance. RBI held Board ultimately responsible, not vendor. This led to RBI Master Direction on IT Outsourcing 2023.

CASE 2: Capital One - AWS Breach (2019) - USA - $80 Million Fine

Facts: Capital One outsourced data storage to AWS. A former AWS employee exploited misconfigured firewall in AWS, stole data of 106 million customers.
Legal Outcome: OCC fined Capital One $80M in 2020. Court held: Outsourcing to cloud does not transfer liability. Capital One was liable for vendor's misconfiguration because its Outsourcing Committee failed to audit AWS configuration.
Principle: You own the data, even if Amazon holds it.

CASE 3: TSB Bank IT Migration - UK (2018) - £48 Million Fine + £32 Million Compensation

Facts: TSB outsourced IT migration from Lloyds to Spanish parent Sabadell's platform (Proteo4UK). Migration failed, 1.9M customers locked out for weeks, fraud increased.
FCA / PRA Action (2022): Fined TSB £48.65M. Found Board failed to govern outsourcing - no adequate testing, no exit plan, no understanding of vendor complexity.
Governance Lesson: This is textbook case cited by EBA. Board approved outsourcing without understanding it. Committee must have technical competence, not just approve paper.

CASE 4: Life Insurance Code Breach - Australia (2026) - 10,000 Breaches

Facts: Life Insurance Code Compliance Committee (Life CCC) published sanction on 1 Sept 2026: Insurer outsourced claims handling, vendor breached code 10,000 times - delays, wrong denials.
Held: Outsourcing a function does not transfer liability. Insurer got formal warning and had to prove governance, controls, assurance are sufficient.
Principle: Regulator will punish the principal, not the agent.

CASE 5: Btec AS v. Nordlo Norge AS (Norway, 2025) - €5.5 Million Lesson

Facts: Manufacturer outsourced IT to Nordlo. Nordlo failed to maintain backup / business continuity, ransomware attack shut down production.
Norwegian Court Held: Manufacturer could not escape liability to its customers by blaming IT vendor. Board failed to ensure BCP and supplier management.
Principle: You can outsource work, never accountability.

CASE 6: CrowdStrike Outage (July 2024) - Global - DORA Test Case

Facts: CrowdStrike, a cybersecurity vendor used by banks, airlines, hospitals globally, pushed faulty update. 8.5M Windows systems crashed.
Governance Impact: In EU, this became the test for DORA. Banks that had no exit plan, no resilience testing, no alternative vendor were found non-compliant by ECB. In India, RBI asked banks to report if they were dependent on CrowdStrike.
Lesson: Concentration risk - If 100 banks use same vendor, vendor failure = systemic failure. Outsourcing Committee must monitor concentration.

CASE 7: Satyam / IL&FS - Outsourcing of Audit & Internal Controls

In Satyam, internal audit was outsourced to PwC affiliate, but Audit Committee never monitored it. In IL&FS, risk management was outsourced to consultants, board relied blindly.
Principle from Indian Courts: Blind reliance on outsourced expert is breach of Sec 166 diligence. Board must independently verify.

CASE 8: Stephanus Bernardus Burger v. Risk Solutions BG Ltd [2026] EWCA Civ 804 - UK Court of Appeal

Facts: Business used external contractor, contractor's employee committed wrong.
Held: Modern expansion of vicarious liability has NOT replaced traditional rule - business is NOT generally liable for true independent contractor's wrongdoing, unless business retained control or assumed duty.
Nuance: This is the defence. If you can prove you had proper Outsourcing Committee, due diligence, no control over day-to-day, you may escape liability. If you had no governance, you lose this defence.

5. Governance Gap Liability for Outsourcing

Courts now apply a 4-step test:

1. Was the function Material? If yes, Board approval was mandatory. If Board did not approve, gap = liability.
2. Did contract have Audit / Exit / BCP clauses? If no, Committee failed.
3. Did Committee monitor SLA? If minutes show no quarterly review, lack of diligence under Sec 149(12) Companies Act.
4. Could you exit? If you were locked-in to vendor with no alternative, you created concentration risk.

If 1-4 fail, directors are personally liable under Sec 166, Sec 447 (if fraud), and RBI can remove directors under Banking Regulation Act Sec 36AA.

6. Best Practice Checklist for Outsourcing Committee

1. Maintain Outsourcing Register - Every vendor, materiality, contract end date, exit plan
2. Never outsource: Credit decision, KYC decision, Compliance, Internal Audit, Board decisions
3. Always include: Right to audit by RBI / CNMV / SEBI, Data ownership, 6-hour incident reporting, Sub-outsourcing ban without approval
4. Quarterly Review: SLA, incidents, vendor financials, concentration
5. Annual Board Certification: To RBI that outsourcing policy complied with
6. Exit Drill: Once a year, test if you can bring function back in-house in 90 days

Summary

Old Thinking: Outsourcing = Cost Saving
New Law (RBI 2025 + EBA 2026 + DORA): Outsourcing = Risk Transfer That Fails in Court

The Outsourcing Committee is not a procurement committee. It is a risk committee that ensures the company does not become a hollow shell - a brand with no control over its own operations.