RBI announces new IT regime for regulated entities 

As per the new guidelines which will come into effect from April 1 next year, the regulated entities are required to put in place a strong IT governance framework.

Image Source: PTI

Regulated Entities (REs) like banks, non-bank financial companies, credit information companies and other financial entities have been obligated by the Reserve Bank of India (RBI) to establish a strong IT governance system. Final guidelines on information technology (IT) governance for regulated entities (REs) have been announced by the RBI.

The new guidelines will come into effect from April 1 next year.

According to the new guidelines, the REs will have to set up a board-level IT strategy committee (ITSC), which will be headed by an independent director and will have three directors as members. The ITSC chairman will be an independent director with substantial IT expertise in managing/guiding IT initiatives.

The IT strategy committee (ITSC) will ensure the RE has set up an effective IT strategic planning process. It will guide RE in the development of an IT strategy. The committee will also ensure that the IT strategy aligns with the RE’s overall strategy for achieving its business goals.

Under the new rules, the REs are required to establish an IT steering committee with representation at the senior management level from IT and business functions. The IT steering committee shall assist the ITSC in strategic IT planning, oversight of IT performance and aligning IT activities with business needs. It will supervise the processes implemented for disaster recovery and business continuity. Additionally, the committee will ensure the implementation of a robust IT architecture meeting statutory and regulatory requirements.

The guidelines stated, “As a first line of defence, the head of IT function shall ensure effective assessment, evaluation and management of IT controls and IT risk, including the implementation of robust internal controls, to secure the RE’s information assets and comply with extant internal policies, regulatory and legal requirements on IT related aspects.”