NBFC Functions
The Reserve Bank of India (RBI) released the latest notification on 9/11/2017 in which RBI prohibited non-banking financial companies from outsourcing key NBFC functions such as internal audit, investment portfolio management, loan sanction, and strategic and compliance functions for know your customer (KYC) norms.
In a recent notification, RBI issued fresh directions to NBFCs on managing risks and code of conduct in outsourcing financial services. RBI stated that “Access to customer information by the staff of the service provider shall be on ‘need to know’ basis i.e. limited to those areas where the information is required in order to perform the outsourced function.”
In RBI notification it is said that “The failure of a service provider in providing a specified service, a breach in security/confidentiality, or non-compliance with legal and regulatory requirements by the service provider can lead to financial losses or loss of reputation for the NBFC and could also lead to systemic risks,” adding that NBFCs outsourcing their activities should ensure sound and responsive risk-management practices.
RBI said that to protect the confidentiality of the information, NBFCs have to ensure that service providers are able to isolate and clearly identify the NBFC’s customer information, documents, records, and assets. In case of leakage of confidential customer related information should be reported to the RBI immediately adding that NBFCs would be liable to its customers for any damages.
Code of Conduct approved by the board in NBFCs for direct sales and recovery agents should also be put in place. RBI said that “The NBFC and their agents shall not resort to intimidation or harassment of any kind, either verbal or physical, against any person in their debt collection efforts, including acts intended to humiliate publicly or intrude the privacy of the debtors’ family members, referees and friends, making threatening and anonymous calls or making false and misleading representations.”
There should be a clear demarcation of resources like premises and personnel in case NBFCs are sharing back-office, service arrangements with other group entities. RBI also said that “Moreover the customers shall be informed specifically about the company which is actually offering the product/ service, wherever there are multiple group entities involved or any cross-selling observed.”
There are ten types of risks listed by RBI arising out of outsourcing which need to be mitigated by NBFCs such as strategic risk, reputation risk, compliance risk, operational risk, legal risk, exit strategy risk, counter-party risk, country risk, contractual risk, access risk, concentration and systemic risk. RBI also mentioned that in performing the services, service providers need to maintain the same high standards of care as is expected to be employed by NBFCs.
RBI notification also stated that NBFCs need to ensure that in carrying out its supervisory functions and objectives, service providers do not interfere with the ability of NBFCs to effectively manage their activities or impede the RBI. NBFCs board are expected to lay down administrative frameworks for outsourcing.
In case of unexpected termination of an outsourcing agreement, RBI also asked NBFCs to put in place a business continuity plan. RBI notification stated that “In establishing a viable contingency plan, NBFCs shall consider the availability of alternative service providers or the possibility of bringing the outsourced activity back in-house in an emergency and the costs, time and resources that would be involved”. The notification also added that NBFCs shall retain an appropriate level of control over their outsourcing and the right to intervene with appropriate measures so that business is not interrupted. It will also be required to conduct an audit at least once a year for the service providers to assess their financial and operational condition. Within two months lenders are expected to comply with the directions.
RBI stated that “It shall be clearly indicated that NBFCs’ grievance redressal machinery will also deal with the issue relating to services provided by the outsourced agency.” RBI also asked NBFCs to constitute a grievance redressal machinery with the name and contact details of the redressal officer displayed prominently at their branches.
For activities carried out by the service providers, NBFCs would also be responsible for making currency transaction reports and suspicious transactions reports to the financial intelligence unit.
