RBI continuity rules put Indian bank suppliers on the hook for resilience testing

Indian banks must now push business continuity and disaster recovery checks deeper into their vendor networks under RBI directions issued in July 2026. Singahi’s new guide maps the questions software, cloud and IT suppliers should expect, and the evidence banks will ask for.

Why it matters: - Indian banks are being pressed to prove that critical vendors can recover fast enough to protect bank services during outages. - The new RBI framework reaches software, cloud and IT suppliers through bank questionnaires, contract terms and audit rights. - Supplier failures can now trigger bank-level regulatory and operational consequences, not just service disruption.

What happened: - Singahi released a guide titled “Selling to banks: the business continuity questions you will be asked.” - The guide is aimed at software, cloud and IT companies that sell to Indian banks. - The guide responds to Reserve Bank of India directions issued on 31 July 2026. - Those directions require banks to extend business continuity and disaster recovery planning to critical systems run by vendors and partners. - Banks must also show readiness through coordinated resilience testing that meets the bank’s recovery time objective. - Singahi said the guide links each question to the relevant ISO 22301 clause and compares Indian requirements with rules in the EU, UK, Australia and the US.

The details: - RBI’s continuity framework tells banks to base policy on best practices such as ISO 22301, the international business continuity standard. - RBI’s version for NBFCs includes the same continuity and recovery provisions. - Separate RBI outsourcing directions issued in November 2025 already required banks to ensure service providers document, maintain and test business continuity and recovery procedures. - Existing IT outsourcing agreements had to comply at renewal or by 10 April 2026, whichever came first. - RBI said on 19 July 2024 that a faulty CrowdStrike update caused minor disruptions at 10 banks and NBFCs. - Twelve days later, NPCI disconnected C-Edge Technologies from retail payment systems after a suspected ransomware attack. - C-Edge provides technology to co-operative and regional rural banks, and customers of those banks could not use the payment systems until reconnection. - The new rules bind the bank, not the supplier. - Banks push those obligations downstream through due-diligence questionnaires, contract clauses and audit rights, often late in a deal. - RBI outsourcing directions require a bank to ensure its provider reports cyber incidents without undue delay so the bank can report to RBI within six hours of the provider detecting the incident. - A supplier procedure that promises notice “within 24 hours” would not meet that requirement. - Singahi’s guide covers 13 questions on a supplier’s plan, recovery targets, testing, incident handling, audit and exit. - Each question is mapped to the ISO 22301 clause that addresses it. - The guide sets Indian requirements alongside DORA, the UK PRA’s SS2/21, Australia’s CPS 230 and US interagency guidance on third-party relationships. - Under DORA, a technology provider supporting a critical or important function must take part in the bank’s threat-led penetration testing. - RBI does not require a supplier to be certified to ISO 22301. - RBI can let a bank rely on globally recognised third-party certifications held by a provider instead of the bank’s own independent audits, depending on the bank’s risk assessment. - The guide says the six most common evidence items are a management-approved continuity policy, the business impact analysis behind recovery targets, the recovery plan, the latest exercise report, a list of critical suppliers and their own arrangements, and the latest internal audit and management review reports. - The guide links to Singahi’s ISO 22301 toolkit, which explains all 26 clauses of the standard in plain language and includes a free Control Pack of templates.

Between the lines: - The timing matters because supplier scrutiny often arrives when a deal is nearly done, which raises the odds that continuity gaps become commercial blockers. - The incident-reporting deadline is especially tight and makes vendor response times a regulatory issue, not just a service-level issue. - The comparison with foreign regimes signals that Indian banks are converging with global third-party resilience standards. - Rahul Verma, Cybersecurity Sales Specialist at Singahi, said banks want concrete answers on recovery time, testing history and risky sub-vendors before a questionnaire lands.

What's next: - Bank vendors should expect more detailed continuity questionnaires in active and upcoming deals. - Suppliers will likely need evidence ready before procurement reaches final stages. - More banks may lean on third-party certifications and audit reports when assessing lower-risk providers. - Singahi said the guide is meant to help suppliers prepare the evidence banks are already asking for.

The bottom line: - RBI has turned vendor continuity into a bank compliance issue, and suppliers that cannot prove fast recovery and tested resilience may struggle to close or keep banking business.