Regulatory directionIndia

RBI Master Direction — IT Governance, Risk, Controls and Assurance Practices, 2023 (RBI IT Governance MD)

Consolidated requirements for IT governance, risk, controls and IS assurance in regulated entities.

Request an Assessment

Classification

Regulatory direction

Issuing authority

Reserve Bank of India (RBI)

Jurisdiction

India · Sector: Financial services

Status / edition

In force

Key dates

Issued 7 November 2023; effective 1 April 2024

Mandatory or voluntary

Mandatory (sector-specific)

Who it applies to

Scheduled commercial banks, small finance banks, payments banks, NBFCs, credit information companies and All India Financial Institutions (with stated exemptions).

Purpose

Consolidated requirements for IT governance, risk, controls and IS assurance in regulated entities.

Major requirements / obligations

  • Board and IT Strategy Committee oversight
  • IT and information security risk management
  • Business continuity and DR
  • Risk-based IS audit

Control domains

GovernanceRisk assessmentBusiness continuityAudit evidence

Official reference

https://rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=12562 ↗

Last reviewed

2026-10-18 (source verification date)

This library provides general information for orientation only. It is not legal advice, a determination of applicability, or a substitute for formal certification or professional counsel. Verify current legal status, editions and dates against the official source before relying on any entry. Inclusion of a jurisdiction or instrument here is informational and does not imply that Srida IT provides regulated services, holds local authorisation, or has a presence in that jurisdiction.