DevOps Outsourcing Services and the RBI: What Goes in the Contract?

Most fintechs buying DevOps outsourcing services sign a contract written for a software vendor: a scope, a monthly fee, an SLA, a confidentiality clause. If the company holds an NBFC licence, that contract has been non-compliant since 10 April 2026, and the vendor is probably not the one who will notice.

The RBI (Non-Banking Financial Companies – Managing Risks in Outsourcing) Directions, 2025 came into force on 28 November 2025. Paragraph 2 gave existing IT outsourcing agreements until renewal or 10 April 2026, whichever came first. New agreements had to comply from the day they were signed.

We are one of the vendors this applies to, so what follows is partly a description of our own contracts. Read it that way.

Does a DevOps partner count as IT outsourcing under the RBI?

Yes, and the direction is unusually specific about it. Paragraph 5(1) lists what falls inside: IT infrastructure management, maintenance and support; network and security solutions; application development and testing; data centre operations; cloud computing services; managed security services. An embedded DevOps team running your AWS account is three of those at once.

Paragraph 5(2) lists what falls outside, and the list is worth reading because people assume it is longer than it is. External audits including VA/PT, SMS gateways, hardware procurement, off-the-shelf software licences without customisation, and OEM maintenance are excluded. A team that writes your Terraform and holds your pager is not on that list.

The direction applies to Middle and Upper Layer NBFCs in full (Chapters III and IV). Base Layer NBFCs get Chapter III, which is the financial-services outsourcing chapter, so the IT-specific clauses below bind you fully only from the Middle Layer. Check your layer before you read further; we set out how the tiers work in the companion post on the 2026 cybersecurity direction.

Why has the deadline already passed?

Because the direction did not give a transition window for new contracts at all, and gave existing ones a fixed date rather than a period. If your DevOps vendor agreement was signed in 2024 and has not been re-papered, it is the one the direction was written for.

The practical consequence is that this is not a procurement question for next year. It is a paper exercise with your current vendor, and it can usually be done in an afternoon with an addendum. The hard part is knowing what the addendum has to say.

What has to be in the contract?

Paragraph 74 is the list for IT outsourcing, and it is long. These are the items we see missing most often from contracts that were written by the vendor:

1. Your right to audit the vendor, with internal or external auditors, including audits of the vendor's subcontractors (paragraph 34(vii) and 74).
2. The RBI's right to inspect the vendor and any subcontractor, and to access your IT infrastructure, applications and data held by them (paragraph 74(xii)).
3. Storage of data only in India, where the regulation requires it (paragraph 74(vi)). Your vendor's monitoring stack and ticketing system count if customer data ends up in them.
4. Prior consent for subcontractors, and the vendor being contractually liable for its subcontractors' performance and risk practices (paragraph 74(i) and (xiii)).
5. A list of the incidents the vendor must report to you — data breaches, denial of service, unavailability — and how fast (paragraph 74).
6. Termination rights that include an orderly transfer to another provider or back in-house (paragraph 74(xv)).
7. Named essential personnel with backups, who can work on-site during an emergency (paragraph 74(xvii)).
8. The vendor's obligation to follow RBI directions issued about the outsourced service (paragraph 74).

Two clauses in that list change how the work is done, not just what the paper says. The audit right means the vendor's actions in your account have to be attributable to named people on your side of the trail, or there is nothing to audit. The data-in-India clause means the vendor cannot pipe your CloudWatch logs to a SaaS observability tool hosted in Virginia because that was quicker. We cover the second problem, and where data leaks out of Indian regions without anyone deciding it should, in the data localisation post.

Where does the six-hour clock land on the vendor?

Paragraph 69(iii) is the one to put in front of whoever runs your account. Cyber incidents must be reported by the service provider without undue delay, so that the NBFC can report to the RBI within six hours of detection.

Read that carefully: the vendor's delay eats into your six hours. If your DevOps team notices a compromised credential at 11pm and mentions it in the morning standup, you have already lost the window, and paragraph 28 says you remain liable to your customers for the damage.

The contract needs a number. One hour from detection to a named contact at the client, by phone and in writing, is achievable and is what we would sign, and it should be rehearsed like the rest of the incident runbook. A vendor that will not put a number on it is telling you what will happen.

What does an exit strategy mean for an account someone else built?

Paragraphs 84 to 88 require the IT outsourcing policy to contain a clear exit strategy, with plans for different termination scenarios and a minimum period to execute them. Paragraph 42 requires the vendor to be able to isolate your information and hand it over or destroy it. For cloud specifically, paragraphs 96 and 97 require agreed turnaround times for returning your data and service collaterals, secure purge, and a plan for how cloud-hosted services will be moved out with minimal impact.

For an AWS account this is a concrete test, and it is the same test we suggested in the hire-or-partner comparison: if the vendor left on Friday, could your own engineers run the account on Monday?

The answer is yes only if the infrastructure is in your repositories as code, the runbooks live with it, the pipelines run on your identities and not the vendor's, and nothing depends on a laptop or a personal account belonging to someone who no longer works for you. The same cloud paragraphs also require encryption keys and HSMs to be under the NBFC's control, which rules out the arrangement, common in practice, where the vendor's KMS keys encrypt the client's data.

An exit clause that reads "the parties will cooperate in good faith" does not meet any of this.

What can you not hand to a vendor at all?

Paragraph 15 draws the line: internal audit, compliance, strategic functions and decision-making such as KYC determinations and loan sanctions cannot be outsourced. Paragraph 59 adds that the vendor cannot be owned or controlled by a director or key managerial person of the NBFC, or their relatives, without board approval and disclosure.

Neither of those sounds like DevOps until you look at what an embedded team is asked to approve. Production change approval is an operational task and can be delegated. The decision about what the change-management policy is cannot. A vendor writing your IT policy for you to sign is on the wrong side of paragraph 15, and we would decline that work for that reason.

What should you ask a DevOps outsourcing company before signing?

Seven questions. The direction is the reason for each; ask them of us too.

1. Will you sign the paragraph 74 clauses as written, including RBI inspection of your premises and your subcontractors? A pause here is an answer.
2. Which subcontractors and SaaS tools will touch our data, and where is each hosted? You are entitled to the list under paragraph 74.
3. What is your incident notification time to us, in hours, in writing?
4. Who are the named essential personnel for our account, and what happens when two of them are unavailable?
5. Do your engineers act in our account on identities we issue and can revoke, with CloudTrail showing their names?
6. On the day the contract ends, what do we hold, and what do you still hold? Ask for the answer as a list of repositories and accounts.
7. Are our KMS keys ours?

Then check the vendor against paragraph 38: review its financial and operational condition at least annually. For a small vendor that is an awkward conversation. Have it anyway, because a vendor that folds is an exit scenario the direction requires you to have planned for.

Where we sit

We sell exactly this, and it would be strange to pretend otherwise. So the honest version: the direction makes a good vendor cheaper to buy and a bad one more expensive, because the clauses above are things a competent team already does and a marginal one has to build.

It also makes the in-house case stronger in one specific situation. If your NBFC is Base Layer and growing fast, and nobody internal can judge a vendor's answers to the questions above, the direction's own logic says you need that judgement in the building first. Hire the one person who can hold a vendor to paragraph 74, and then decide whether to bring in a team. We said the same in our guide to choosing a DevOps company for a fintech, and the direction has not changed our view.

The short version

If you hold an NBFC licence and a DevOps vendor runs your AWS account, pull the contract out this week and check it against paragraph 74. Add the audit right, the RBI inspection right, data-in-India, subcontractor consent, an incident time in hours, named personnel and a real exit plan. Move your keys under your own control. Then ask the seven questions, and expect the vendor, us included, to answer every one in writing.

The deadline was April. The addendum takes an afternoon.

This is engineering guidance, not legal advice. Regulations and their annexures are amended over time; read the current text and take your compliance position from counsel.