Indian banks step up continuity checks on suppliers

Singahi has published a guide to the business continuity questions Indian banks are likely to ask software, cloud and IT suppliers. It focuses on supplier scrutiny under Reserve Bank of India rules.

The guide sets out 13 questions banks may ask vendors about continuity planning, recovery targets, testing, incident handling, audit and exit arrangements. It also maps each question to the relevant clause in ISO 22301, the international standard for business continuity, and identifies the evidence suppliers can use in response.

The publication comes as banks in India face tighter obligations on operational resilience and third-party risk. Reserve Bank of India directions require banks to extend business continuity and disaster recovery arrangements to critical systems operated by vendors and partners, and to show readiness through coordinated resilience testing that meets the bank's recovery time objective.

Those requirements apply directly to banks rather than suppliers, but they are likely to flow into vendor assessments, contract terms and audit rights. For software and IT providers, that means more detailed due diligence during procurement and renewal discussions, especially where a service supports critical banking functions.

Separate Reserve Bank of India outsourcing rules already require banks to ensure service providers document, maintain and test their business continuity and recovery procedures. Existing IT outsourcing agreements also had to comply at renewal or by an earlier regulatory deadline, increasing pressure on suppliers to align their internal processes with bank expectations.

Supplier exposure

Incident reporting is a key issue. Under the outsourcing framework, banks must ensure providers report cyber incidents without undue delay so the bank can notify the Reserve Bank of India within six hours of the provider detecting the incident. That creates a practical problem for suppliers whose own procedures allow much longer reporting windows.

Pressure for closer oversight has grown after incidents exposed vulnerabilities in the financial sector's supplier chain. The Reserve Bank of India said a faulty CrowdStrike update caused minor disruptions at 10 banks and non-bank financial companies. Soon after, NPCI disconnected C-Edge Technologies from retail payment systems following a suspected ransomware attack, affecting customers of co-operative and regional rural banks that relied on its technology.

These episodes have sharpened scrutiny of whether third-party providers can restore services quickly, test recovery plans under realistic conditions, and avoid making their own subcontractors single points of failure. For banks, such questions are now part of broader operational resilience requirements rather than optional procurement checks.

Rahul Verma, Cybersecurity Sales Specialist at Singahi, said the timing of these questions can create friction in negotiations.

"By the time the continuity questions arrive, the deal is usually close, and nobody wants to slow it down," Verma said. "Banks want specifics. What is your recovery time for the service they are buying? When did you last test it? Which of your own vendors could take you down? A supplier can answer most of that before the questionnaire shows up. The guide takes each question in turn and shows the evidence that answers it."

Global comparison

Singahi also places the Indian requirements alongside comparable rules in other markets, including the European Union's Digital Operational Resilience Act, the UK Prudential Regulation Authority's supervisory statement SS2/21, Australia's CPS 230 and US interagency guidance on third-party relationships. The comparison underlines that supplier scrutiny is not confined to India and is becoming more formal across regulated financial services markets.

Under DORA, for example, a technology provider supporting a critical or important function must take part in a bank's threat-led penetration testing. By drawing those parallels, the guide suggests suppliers serving multiple financial markets may be able to use a common evidence base, even if individual banks frame their due diligence differently.

One point the document highlights is that none of these frameworks requires a supplier to hold ISO 22301 certification. Even so, recognised third-party certifications can still matter. Reserve Bank of India rules allow a bank, depending on its risk assessment, to rely on globally recognised certifications held by a provider instead of conducting its own independent audits.

Evidence base

The guide concludes that most bank questionnaires return to six core pieces of evidence: a management-approved continuity policy, the business impact analysis supporting recovery targets, the continuity plan itself, the latest exercise report, a list of critical suppliers and their arrangements, and reports from the most recent internal audit and management review.

That emphasis reflects a wider shift in bank supplier management from broad policy assurances to documented proof. Vendors are increasingly expected not only to say they can recover from disruption, but also to show when they last tested those plans, how quickly services can be restored, and how dependencies on other providers are monitored.

For technology suppliers selling into Indian banking, the practical message is that continuity documentation is becoming as much a commercial issue as a compliance one. Banks are asking more detailed questions earlier and using regulatory obligations to press for evidence that a provider's recovery arrangements can withstand the kind of disruption that has already affected parts of the sector.