RBI Warns Financial Institutions: Over-Reliance on Third-Party Vendors Could Spell Trouble

The Reserve Bank of India (RBI) has raised concerns about the growing reliance on third-party vendors by financial institutions. At a convention hosted by the International Association of Deposit Insurers, RBI Deputy Governor J Swaminathan warned banks to be cautious when working with these vendors to avoid potential risks. He also suggested that deposit insurers should consider linking insurance premiums to the level of risk each financial institution presents.

Technical and Operational Dependencies

Swaminathan pointed out that as banking becomes more digital, many different third-party companies are now involved in delivering a single product or service. This has created a complex network of technical and operational dependencies. He noted that if any part of this chain fails, the consequences could be severe, as seen in a recent global IT services outage. Swaminathan emphasized that third-party vendors could also be vulnerable to cyber threats like ransomware.

Third-Party IT

Last month, C-Edge Technologies, a third-party IT vendor co-owned by Tata Consultancy Services and the State Bank of India, was hit by a ransomware attack from the RansomEXX group. This attack primarily affected Brontoo Technology Solutions, a key partner of C-Edge, leading to several cooperative and regional rural banks losing connection to the retail payments network.

Swaminathan stressed that financial institutions must take primary responsibility for protecting the confidentiality, integrity, and availability of their data.

Rise of Fintech Companies

He also mentioned that the rise of fintech companies and other entities operating outside traditional regulatory frameworks has introduced new risks to the financial sector. These companies, which may not be subject to the same regulations as traditional banks, can exploit regulatory gaps. This situation, according to Swaminathan, creates an uneven playing field and increases the risk of problems that could spread across the entire financial system.

Addressing the deposit insurers, Swaminathan urged them to stay vigilant as the risk landscape evolves. He also recommended considering the implementation of risk-based premiums for deposit insurance. By linking premiums to the level of risk posed by each institution, deposit insurers could encourage banks to adopt better risk management practices. This would not only strengthen the stability of the financial system but also ensure that riskier institutions contribute more to the insurance fund.