Outsourcing Software Development for NBFCs: Keep Control
Last reviewed: November 2026
Outsourcing software development for NBFCs means engaging an external technology partner to design, build, test or maintain the NBFC's applications while the NBFC keeps full regulatory responsibility for them. Done well, it adds speed and skills without giving away control of code, data or decisions.
This guide is for CTOs and CEOs at NBFCs and HFCs choosing or reviewing a technology partner. It covers the current RBI outsourcing and technology rules, the contract clauses that matter and how to run the partnership without losing control.
Key Takeaways
- RBI's NBFC Managing Risks in Outsourcing Directions, 2025 (28 November 2025) replaced earlier IT outsourcing instructions; existing contracts had to comply by 10 April 2026 or renewal, whichever was earlier.
- RBI's NBFC Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (31 July 2026) add source code or escrow for critical applications and vendor security certificates for Middle Layer and above.
- Outsourcing never transfers responsibility: the NBFC keeps ultimate control, and loan sanction decisions cannot be outsourced.
- A strong contract needs audit and RBI access, sub-contractor consent, data in India and a tested exit plan.
Why Is Outsourcing Software a Leadership Risk?
Outsourcing software is a leadership risk because the NBFC stays answerable for systems it does not fully build or run. RBI's 2025 outsourcing directions say outsourcing does not diminish the obligations of the NBFC, its Board or senior management.
Weak arrangements fail in predictable ways. The vendor holds the code, a key developer leaves, a sub-contractor touches customer data, or the vendor cannot support an urgent regulatory change.
Each of those turns a cost saving into an operational or regulatory incident. The Board is accountable either way.
Which RBI Rules Apply to Outsourcing Software Development for NBFCs?
Two current instruments apply to outsourcing software development for NBFCs: the Managing Risks in Outsourcing Directions, 2025 and the Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026. Which chapters apply depends on your layer under scale-based regulation for NBFCs and your size.
| NBFC Segment | Outsourcing Directions, 2025 | Technology Directions, 2026 |
|---|---|---|
| Base Layer, assets below ₹500 crore | General outsourcing rules; IT chapter (Chapter IV) does not apply | Chapter III baseline IT requirements |
| Base Layer, ₹500 crore and above | General outsourcing rules; IT chapter does not apply | Chapter IV, including IT outsourcing and software development provisions |
| Middle Layer and above | Full rules, including Chapter IV on IT outsourcing | Chapter V, including vendor risk, source code and VAPT |
The April 2023 Master Direction on Outsourcing of IT Services was repealed in the November 2025 consolidation and replaced by the 2025 outsourcing directions. The 2026 technology directions apply in addition to, not instead of, those outsourcing rules.
How Do NBFCs Outsource Development Without Losing Control?
NBFCs keep control of outsourced development with five layers of governance, from vendor selection to exit. Each one maps to a specific RBI expectation.
- Materiality and due diligence: assess the risk of the arrangement and the vendor's capability.
- Contract controls: audit, access, sub-contractors, data and exit written in.
- Code and IP ownership: source code or escrow for critical applications.
- Secure delivery: design reviews, testing and vulnerability checks before go-live.
- Ongoing oversight and exit readiness: reviews, reporting and a tested exit plan.
Layer 1: Is the Arrangement Material?
For IT services, an arrangement is material if its disruption could significantly affect operations or if unauthorised access to customer data could materially affect customers. Core lending, collections and customer apps usually qualify.
Due diligence should cover financial soundness, track record, security, sub-contractors, technology stability, backup and disaster recovery, and the ability to keep your data separate.
Layer 2: Does the Contract Protect the NBFC?
The 2025 directions expect audit rights for the NBFC, access for RBI and prior consent before the vendor uses sub-contractors. IT contracts should make the vendor liable for its sub-contractors and require data storage in India where regulations demand it.
Confidentiality must survive termination. Concentration risk also matters if one vendor builds most of your stack.
If the vendor hosts anything on the cloud, the 2025 directions expect a cloud adoption policy covering the full data lifecycle and multi-factor authentication for access to cloud applications. Offshore development adds country risk, so the contract should state the governing law and keep original records in India.
Layer 3: Who Owns the Code?
For Middle Layer and above, the 2026 technology directions require source code for all critical applications or, where that is not possible, a source code escrow covering updates and fixes. Write ownership of custom code into the contract from day one.
Layer 4: Is Delivery Secure?
The 2026 directions expect a written certificate from the vendor that the application is free of known vulnerabilities, malware and covert channels, renewed after material code changes. Vulnerability assessment and penetration testing should run before and after go-live, as covered in VAPT for NBFCs.
Personal data in test environments needs the same care as production. Our guide to DPDP Act compliance for lenders covers the privacy side.
Layer 5: Can You Exit Cleanly?
The IT outsourcing policy must contain a clear exit strategy for business continuity during and after exit. Contracts should cover safe data return or destruction and require the vendor to cooperate with a new provider.
Test the exit plan, not just the clause. Ask a second team to build and deploy one critical application from the escrowed code and runbooks, and fix whatever is missing.
Oversight should be regular too. The 2025 directions treat due diligence as ongoing, so review the vendor's financial and operational condition periodically, not only at renewal.
If your main software vendor stopped work tomorrow, could your team keep the lending platform running?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how our custom software development team builds secure applications with a dedicated development team model.
How Does Outsourcing Software Development Work on a Real Project?
On a real project, the controls cost little compared with the value they protect. This illustrative scenario uses assumed numbers for a Middle Layer NBFC outsourcing a collections application.
The build costs ₹1.2 crore over six months, and annual maintenance is assumed at 20% of build cost, or ₹24 lakh a year. Three-year total cost is ₹1.2 crore plus ₹72 lakh, or ₹1.92 crore.
| Control | Assumed Cost | What It Protects |
|---|---|---|
| Source code escrow for 3 years | ₹2 lakh a year, ₹6 lakh total | ₹1.2 crore build if the vendor fails |
| Pre-go-live VAPT | Part of testing budget | Customer data and regulatory standing |
| Exit and data-return clause | Legal drafting time | Continuity of collections operations |
The escrow costs ₹6 lakh, or 5% of the build cost. Without it, a vendor failure in year two could mean rebuilding a critical application while collections run on spreadsheets.
The lesson for leadership: the expensive part of outsourcing is not the controls. It is discovering, during a crisis, that you never had them.
Which Outsourcing Model Fits Your NBFC?
The right outsourcing model depends on your in-house capability, the criticality of the system and how often it changes. Critical, fast-changing systems need closer control than one-off builds.
| Situation | Recommended Approach |
|---|---|
| Small in-house team, critical lending system | Dedicated external team under your product and architecture leads |
| One-off build of a non-critical tool | Fixed-scope project with clear acceptance criteria |
| Strong in-house team, skills gap | Augment with external specialists, such as AI or mobile |
| Standard capability like an LMS | Evaluate a platform before custom build; compare digital lending platform development cost |
What Should Never Be Outsourced?
Core management functions stay in-house. RBI's outsourcing directions list decisions such as loan sanction among functions that cannot be outsourced.
Vendors can build the loan management system for NBFCs or decision software, but credit policy and approval authority remain yours. Keep product ownership and architecture decisions inside the NBFC as well.
Where Does Digiqt's Software Development Service Fit?
Digiqt's software development service fits as an external build partner working under the NBFC's governance. Its page describes custom software development across UI/UX design, web development, app development and quality assurance.
The custom software development company page lists two engagement models: a dedicated development team and problem statement analysis. It covers AI, backend, frontend, database, DevOps and data engineering, and states ISO 9001:2015 certification.
For AI-heavy builds, Digiqt's AI software development company service is the closer fit. For lending products, the Digiqt Lending Platform offers onboarding, disbursement and repayment APIs.
Which Metrics Show the Outsourcing Arrangement Is Healthy?
Five metrics show whether an outsourcing arrangement is healthy: delivery predictability, defect escape rate, vulnerability closure time, key-person dependency and exit readiness. Review them quarterly with the vendor.
| Metric | Formula | What a Weak Number Signals |
|---|---|---|
| Delivery predictability | Releases on planned date ÷ planned releases | Scope or capacity problems |
| Defect escape rate | Production defects ÷ total defects found | Weak testing |
| Vulnerability closure time | Days from finding to fix, by severity | Security not prioritised |
| Key-person dependency | Critical modules known by one person ÷ critical modules | Concentration in individuals |
| Exit readiness | Critical apps with code or escrow and runbooks ÷ critical apps | You cannot leave safely |
Which Mistakes Cost NBFCs Control of Their Technology?
Four mistakes cost NBFCs control of their technology, and each is visible in the contract before signing.
- No code ownership or escrow. The vendor effectively owns your platform.
- Silent sub-contracting. Customer data reaches firms you never vetted.
- No exit plan. Leaving becomes impossible, so the vendor sets the terms.
- Outsourcing decisions, not just delivery. Credit and architecture decisions must stay inside the NBFC.
What Is Changing Next?
RBI's November 2025 and July 2026 instruments have reset the NBFC technology rulebook, and earlier IT outsourcing and IT governance instructions have been repealed. Inspection teams will now test arrangements against these consolidated texts.
Expect more scrutiny of vendor security, source code arrangements and concentration risk. For context on the governance side, see our guide to RBI IT governance directions for NBFCs, and check it against the 2026 technology directions.
Is your current tech partner contract ready for an RBI inspection under the 2025 and 2026 directions?
Talk to Our Lending Technology Specialists
Visit Digiqt to see how our custom software development team builds and maintains applications for financial services.
