Compliance tool · Updated 24 October 2026
AI voice vendor due-diligence questionnaire
For vendor-risk teams at Indian banks, NBFCs, insurers and brokers assessing an AI voice vendor. The 67 questions are grouped into 12 areas, and each comes with a model answer and the rule it maps to.
Governance and materiality
GOV-01Describe exactly which activities you will perform for us, on which calls, and what you will never do (for example, approve a loan or change account details).
Why it matters: The lender has to judge whether this is outsourcing and whether it is material, and it may not outsource core decisions such as loan sanction or KYC determination.
A good answer: A written scope listing each call type, the systems touched and the decisions the agent cannot take, with credit, KYC and compliance decisions clearly left with the client.
Evidence: Statement of work or service description; call-flow diagrams for each use case.
RBI outsourcing directions 2025 (banks) para 6(1) · RBI outsourcing directions 2025 (banks) para 15 · RBI outsourcing directions 2025 (NBFCs) para 15
GOV-02If your service stopped for a day, or our customer data on your platform leaked, what would the impact be on our customers and operations?
Why it matters: This is the materiality test. A material arrangement brings the full set of board, contract and monitoring duties.
A good answer: An honest impact assessment that names the data held, the call volumes, the customer harm from a leak and the fallback, and accepts that the arrangement is likely material.
Evidence: Vendor's own business impact analysis; data inventory for the service.
RBI outsourcing directions 2025 (banks) para 14 · RBI outsourcing directions 2025 (banks) para 53(2) · RBI outsourcing directions 2025 (NBFCs) para 58(2)
GOV-03Who in your company is accountable for security, privacy and regulatory compliance for our account, and how do they report to your board?
Why it matters: A bank's IT function must monitor the outsourced service and report concerns to senior management, and SEBI entities must monitor their vendors' compliance with CSCRF. That needs a named counterpart with authority.
A good answer: A named CISO or equivalent and a named account compliance lead, with a regular board or leadership review of security and compliance risk.
Evidence: Org chart; board or risk committee terms of reference; last two review minutes (redacted).
RBI outsourcing directions 2025 (banks) para 59(3) · SEBI CSCRF 2024 GV.SC.S4 guideline 3
GOV-04What is your financial position, and how many other regulated financial institutions use the same platform?
Why it matters: Due diligence must cover the vendor's financial soundness and concentration risk, and SEBI asks entities (other than small and self-certification ones) to manage concentration where many firms depend on one vendor.
A good answer: Audited accounts, funding runway and a client list by sector, with an honest view of how the vendor would handle a failure that affects many clients at once.
Evidence: Latest audited financial statements; reference clients in BFSI.
RBI outsourcing directions 2025 (banks) para 30(ii), 30(iv) · SEBI CSCRF 2024 GV.SC.S7
GOV-05Have you had any regulatory action, litigation or significant customer complaints about your service in the last three years?
Why it matters: RBI's due diligence factors include the vendor's reputation, complaint history and pending litigation.
A good answer: A full disclosure, including matters that were resolved, and a commitment to tell the client promptly about new ones.
Evidence: Signed declaration; summary of complaints and outcomes.
Data location and residency
DATA-01List every place, by country and provider, where call audio, transcripts, customer data and logs are processed or stored, including backups and disaster recovery.
Why it matters: RBI IT contracts must cover storage of data in India where the rules require it and the details of data the vendor captures and stores. SEBI's cloud framework requires data held in the cloud, including logs, to stay in India (CSCRF's general data-localisation standard is on hold). DPDP lets the government restrict transfers abroad by notification.
A good answer: A data-flow map that names each region and provider for audio, speech-to-text, AI processing, storage, backups and logs, with all customer data in India unless the client has agreed otherwise in writing.
Evidence: Data-flow diagram; cloud region configuration; list of data centres.
RBI outsourcing directions 2025 (banks) para 69(vi), 69(vii) · SEBI cloud framework 2023 Principle 3 (data localisation) · DPDP Act 2023 s.16
DATA-02Is any audio or text sent to an AI model, speech or voice service hosted outside India? If so, which ones and what is retained there?
Why it matters: Sending audio or transcripts to a foreign model is, on our reading, an offshore transfer of customer data. That brings in RBI's conditions for offshore service providers and, for SEBI entities using cloud services, the cloud framework's rule that data stay in India.
A good answer: Either all inference runs in India, or each foreign service is named with what it receives, how long it keeps it, and whether it can train on it, with no training on client data.
Evidence: Sub-processor list with regions; model provider data-retention terms.
RBI outsourcing directions 2025 (banks) paras 88-89 · SEBI cloud framework 2023 Principle 3 (data localisation)
DATA-03Can you keep our data logically separate from your other clients' data and remove it completely on request?
Why it matters: RBI requires the vendor to be able to isolate the lender's information so it can be removed, deleted or made unusable on termination.
A good answer: Tenant-level separation with per-client keys or storage, and a tested process to export and delete one client's data without affecting others.
Evidence: Architecture note on tenancy; a deletion certificate from a past client exit.
RBI outsourcing directions 2025 (banks) paras 26-27 · RBI outsourcing directions 2025 (banks) para 42 · RBI outsourcing directions 2025 (NBFCs) paras 26-27
DATA-04Who holds the encryption keys for our data, and can we hold them ourselves?
Why it matters: For cloud services RBI expects encryption keys and hardware security modules to be under the lender's control, and SEBI says the entity keeps ownership of its data, logs and keys.
A good answer: Customer-managed keys supported, or a clear explanation of key custody with separation of duties and key-access logging.
Evidence: Key management design; KMS configuration screenshot.
RBI outsourcing directions 2025 (banks) para 92(vii)(b) · SEBI cloud framework 2023 Principle 3 (data ownership)
DATA-05If you use a public cloud, which provider and region do you use, and is it on MeitY's empanelled list?
Why it matters: SEBI's cloud framework allows only MeitY-empanelled cloud providers and data centres for regulated entities, including for SaaS built on top of them.
A good answer: Named provider and Indian region, proof of MeitY empanelment and a current STQC or equivalent audit status for the data centre.
Evidence: Empanelment letter or listing; data centre audit status.
SEBI cloud framework 2023 Principle 2 (selection of CSPs) · RBI outsourcing directions 2025 (banks) para 92(vi)
Security controls
SEC-01Which security certifications and independent audits cover the exact service and environment we will use?
Why it matters: Lenders must assess the vendor's security and internal controls, and SEBI market infrastructure institutions and Qualified REs must get cyber audit certifications from vendors that run their systems.
A good answer: Current ISO 27001 or SOC 2 Type II whose scope includes the voice platform and its hosting, plus a recent audit by a CERT-In empanelled auditor.
Evidence: Certificates with scope statements; latest audit report and management letter.
RBI outsourcing directions 2025 (banks) para 30(vii) · SEBI CSCRF 2024 GV.SC.S4 guideline 1
SEC-02How is our data encrypted in transit, at rest and, where possible, in use?
Why it matters: From 13 May 2027 the DPDP Rules name encryption, masking and virtual tokens among the minimum safeguards, and CSCRF requires strong encryption for data in motion and at rest.
A good answer: TLS 1.2 or higher on every hop including telephony media where supported, AES-256 at rest, and masking of account numbers and other identifiers in transcripts.
Evidence: Encryption standard; configuration evidence; sample masked transcript.
DPDP Rules 2025 rule 6(1)(a) · SEBI CSCRF 2024 PR.DS guideline 1(a)
SEC-03When did you last run vulnerability assessment and penetration testing on the platform, and how fast do you fix what is found?
Why it matters: SEBI requires market infrastructure institutions and Qualified REs to set vulnerability-closure timelines in vendor SLAs, and hosted service providers must make VAPT report summaries available to the entity and to SEBI on demand.
A good answer: VAPT at least yearly and after major changes, by an independent CERT-In empanelled firm, with fix timelines by severity written into the SLA.
Evidence: Latest VAPT summary and closure report; vulnerability SLA.
SEBI CSCRF 2024 PR.DS.S6 guideline 2 · SEBI CSCRF 2024 definition of hosted service, condition 3
SEC-04Can you provide a software bill of materials (SBOM) for the platform?
Why it matters: CSCRF requires SEBI entities to obtain an SBOM for new critical systems software and SaaS applications at procurement.
A good answer: A current SBOM in a standard format listing components, versions, suppliers and licences, refreshed with each major release.
Evidence: SBOM file (SPDX or CycloneDX).
SEC-05How do you prevent call recordings and transcripts from leaking, for example through exports, shared links or staff downloads?
Why it matters: Recordings contain personal and financial data. A bank must notify RBI immediately of a leak of confidential customer information and is liable to its customers for any damage, and CSCRF requires data-leak prevention.
A good answer: Data-loss prevention controls, expiring signed links, no bulk export without approval, and alerts on unusual download volumes.
Evidence: DLP policy; export approval workflow; sample alert.
RBI outsourcing directions 2025 (banks) para 28 · SEBI CSCRF 2024 PR.DS guideline 1(b)
SEC-06Is there any feature that would let you remotely switch off our service, and how are changes to the platform controlled?
Why it matters: CSCRF says hosted service providers must not have a kill switch and that change management must be part of vendor agreements.
A good answer: No remote kill switch outside agreed termination steps, and a documented change process with client notice for changes that affect call behaviour.
Evidence: Change management policy; release notes process.
SEBI CSCRF 2024 definition of hosted service, condition 5 · SEBI CSCRF 2024 PR.IP.S3 guideline 1
Access and identity
IAM-01Which of your staff can access our recordings, transcripts and customer data, and why?
Why it matters: RBI limits vendor access to customer information to what the outsourced function needs, and from 13 May 2027 the DPDP Rules require access controls on computer resources.
A good answer: Access only for named roles with a business need, approved per request, time-limited and reviewed at least quarterly.
Evidence: Access control policy; current access list for the client environment.
RBI outsourcing directions 2025 (banks) para 24 · DPDP Rules 2025 rule 6(1)(b)
IAM-02Is multi-factor authentication enforced for every admin, support and client user?
Why it matters: RBI's cloud rules require multi-factor authentication and least privilege for access to cloud applications.
A good answer: MFA enforced for all console and support access, with SSO for client users and no shared accounts.
Evidence: Identity provider settings; MFA enforcement report.
RBI outsourcing directions 2025 (banks) para 92(viii)(c)-(d) · RBI outsourcing directions 2025 (NBFCs) para 97(viii)(d)
IAM-03Do you run background checks on staff and contractors who can access client data?
Why it matters: Due diligence covers the vendor's checks on its own staff, and CSCRF requires background checks for third-party service providers.
A good answer: Background verification for all staff with data access before access is granted, renewed periodically, with the same rule for contractors.
Evidence: HR screening policy; attestation of coverage.
RBI outsourcing directions 2025 (banks) para 30(vi) · SEBI CSCRF 2024 GV.SC.S4 guideline 4
IAM-04How quickly do you remove access when a staff member leaves or changes role?
Why it matters: Stale access is a common cause of leaks. CSCRF expects employment termination procedures to be followed for staff.
A good answer: Access revoked automatically on the last working day through the identity provider, with a monthly reconciliation.
Evidence: Joiner-mover-leaver procedure; last reconciliation report.
IAM-05Will our security team be able to see who accessed our data and when?
Why it matters: From 13 May 2027 the DPDP Rules require visibility of access through logs, monitoring and review, and RBI's cloud rules call for the provider's logs and events to be integrated into the lender's security operations centre.
A good answer: Access logs available to the client on request or by feed into the client's SIEM, covering staff, API and admin access.
Evidence: Sample access log; SIEM integration guide.
DPDP Rules 2025 rule 6(1)(c) · RBI outsourcing directions 2025 (banks) para 92(xi)
Logging and incident reporting
LOG-01How quickly will you tell us about a cyber incident or data breach affecting our data, and through which channel?
Why it matters: Lenders must report cyber incidents to RBI within six hours of detection by the vendor, and SEBI entities must report incidents covered by CERT-In's directions to SEBI and CERT-In within six hours (brokers also to the exchanges).
A good answer: A contractual commitment to notify within a fixed window well under six hours from detection, by phone and email to named contacts, with updates as facts emerge.
Evidence: Incident response plan; contract clause; last incident notification sent to a client (redacted).
RBI outsourcing directions 2025 (banks) para 56 · RBI outsourcing directions 2025 (NBFCs) para 61 · SEBI CSCRF 2024 RS.CO guideline 1
LOG-02Do you report incidents to CERT-In yourself, and have you designated a point of contact with CERT-In?
Why it matters: CERT-In requires every service provider and body corporate to report listed incidents within six hours of noticing them and to name a point of contact.
A good answer: Yes to both, with a process that coordinates the vendor's CERT-In report with the client's own reporting.
Evidence: CERT-In point-of-contact registration; incident reporting SOP.
CERT-In directions, 28 Apr 2022 direction (ii) · CERT-In directions, 28 Apr 2022 direction (iii)
LOG-03Do you keep logs of all ICT systems for a rolling 180 days, and where?
Why it matters: CERT-In requires logs of all ICT systems to be kept securely for a rolling 180 days within Indian jurisdiction and produced on request. Its FAQ adds that logs may also be stored abroad if they can be produced in reasonable time.
A good answer: 180 days or more of system, application, access and network logs, held in India or retrievable in India within a reasonable time on request.
Evidence: Log retention policy; storage configuration.
CERT-In directions, 28 Apr 2022 direction (iv) · CERT-In FAQs, May 2022 Q35
LOG-04Will you keep processing logs for our customers' personal data for at least one year?
Why it matters: From 13 May 2027 the DPDP Rules require logs needed to investigate unauthorised access to be kept for one year, by the fiduciary and its processors.
A good answer: One-year retention for access and processing logs on client data, then deletion unless another law needs longer.
Evidence: Retention schedule showing log classes and periods.
LOG-05Are your system clocks synchronised to NIC or NPL time servers?
Why it matters: CERT-In requires clocks synchronised to NIC or NPL, so call times, recordings and logs line up in an investigation or dispute.
A good answer: All servers synced to NIC, NPL or a traceable source, with call timestamps recorded in a single stated time zone.
Evidence: NTP configuration.
LOG-06If a breach affects our customers, what will you give us to notify them and the Data Protection Board?
Why it matters: From 13 May 2027 the fiduciary must tell each affected person and the Board without delay, and send the Board a detailed report within 72 hours.
A good answer: A commitment to provide nature, scope, timing, affected records, likely consequences and mitigations quickly enough for the 72-hour Board report.
Evidence: Breach notification template; contract clause.
LOG-07Which events, besides security incidents, will you report to us, such as outages, call failures or wrong information given to customers?
Why it matters: RBI IT contracts must list reportable material adverse events, and a voice agent can cause harm without any breach.
A good answer: A defined list of reportable events with timelines, including prolonged outages, calls placed outside allowed hours and agent errors affecting customers.
Evidence: SLA schedule of reportable events.
RBI outsourcing directions 2025 (banks) para 69(iii) · RBI outsourcing directions 2025 (NBFCs) para 74(iii)
Call recording and retention
REC-01Can you record every call in full, including inbound calls to the numbers you operate for us?
Why it matters: From 1 January 2027 RBI requires lenders to record recovery calls, including calls the borrower makes to the number the lender gave them. SEBI requires brokers to record orders taken by phone.
A good answer: Full two-way recording of every outbound and inbound call by default, with no gaps for transfers to human agents.
Evidence: Recording configuration; sample recording from a transferred call.
RBI recovery directions 2026 (NBFC; banks use paras 454A-454AB) para 100P · SEBI Master Circular for Stock Brokers, 17 Jun 2025 para 35.4
REC-02Can you set retention per campaign, such as six months for recovery calls and three years for broker order calls?
Why it matters: From 1 January 2027 RBI requires recovery recordings to be kept six months from the call date, and SEBI requires broker order records to be kept for the period arbitration accepts complaints, currently three years.
A good answer: Configurable retention per campaign or call type, with automatic deletion at the end and a legal hold that overrides it.
Evidence: Retention settings screen; deletion job logs.
RBI recovery directions 2026 (NBFC; banks use paras 454A-454AB) para 100P · SEBI Master Circular for Stock Brokers, 17 Jun 2025 para 35.5
REC-03How do you place a recording on legal hold when a dispute, complaint or court case arises?
Why it matters: From 1 January 2027 RBI requires recordings in sub judice cases to be kept until disposal, and SEBI requires disputed-trade records to be kept until final resolution, or until SEBI says otherwise where it asks for records to be preserved.
A good answer: A legal hold that can be applied by account, phone number or case, blocks deletion, and is logged.
Evidence: Legal hold procedure; audit log of a hold being applied.
RBI recovery directions 2026 (NBFC; banks use paras 454A-454AB) para 100P · SEBI Master Circular for Stock Brokers, 17 Jun 2025 paras 35.5-35.6
REC-04Can each recording be tied to the customer, the number called, the time and the outcome, in a form that would stand up as evidence?
Why it matters: Brokers must produce order records for disputed trades, and SEBI's March 2026 informal guidance says they must be retrievable and legally verifiable. From 1 January 2027 lenders must also document the time and number of recovery calls.
A good answer: Each recording stored with call metadata, a hash for integrity, and an export that includes a certificate suitable for electronic evidence.
Evidence: Sample call record export with metadata and hash.
SEBI Master Circular for Stock Brokers, 17 Jun 2025 paras 35.2-35.3 · SEBI informal guidance letter, 20 Mar 2026 records retrievable and legally verifiable · RBI recovery directions 2026 (NBFC; banks use paras 454A-454AB) para 100P
REC-05Do you keep or reuse our call recordings and transcripts for any purpose of your own, such as improving your models?
Why it matters: Under DPDP a processor works on the client's behalf under a valid contract, and from 13 May 2027 the client must make its processor erase data when consent is withdrawn or the purpose ends.
A good answer: No use for the vendor's own purposes without explicit written opt-in, and deletion of all copies when the client's retention period ends.
Evidence: Data processing agreement; model training policy.
REC-06Will you preserve all our documents and data for as long as our own legal duties require, even if the contract ends?
Why it matters: RBI contracts must require the vendor to preserve documents and data in line with the lender's legal and regulatory obligations.
A good answer: A preservation clause tied to the client's retention schedule, with handover before any deletion at exit.
Evidence: Contract clause; exit data handover procedure.
Consent, disclosure and calling rules
CALL-01Have the numbers and CLI ranges you will use for automated calls been declared to the originating operator and recorded on DLT?
Why it matters: TRAI's 2026 amendment defines an A2P call as one initiated by software or an automated platform without a person dialling, including pre-recorded or artificial voice, so an AI agent that places calls is an A2P caller. From 27 November 2026 (60 days after the amendment's publication in the Gazette on 28 September 2026), an A2P call without prior declaration is treated as unsolicited commercial communication.
A good answer: Yes, with the declaration done in the client's name as Sender, and a list of declared CLI ranges kept current.
Evidence: Operator declaration confirmation; DLT entity and CLI records.
TRAI TCCCPR Third Amendment 2026 reg. 4 (substituted) · TRAI TCCCPR Third Amendment 2026 reg. 2(ea)
CALL-02Will service and transaction calls go out on 1600-series numbers, and promotional calls only on 140-series numbers?
Why it matters: TRAI requires banks, NBFCs and other RBI-regulated lenders, insurers, mutual funds, qualified stock brokers and pension bodies to make service and transactional calls only from 1600 numbers, on deadlines that passed between 1 January and 15 March 2026. Promotional calls from any sector must use 140.
A good answer: Number series assigned per campaign type, with a block on placing promotional calls from 1600 numbers or service calls from ordinary 10-digit numbers.
Evidence: Number inventory by series; campaign configuration.
TRAI 1600 direction, 19 Nov 2025 press release 135/2025 · TRAI 1600 direction for IRDAI entities, 16 Dec 2025 press release 151/2025
CALL-03How do you check consent before a call, and can you prove when and how it was given?
Why it matters: TRAI's explicit consent must be verifiable and registered, and from 13 May 2027 DPDP consent must be free, specific, informed, unconditional and unambiguous, and come with a notice.
A good answer: A pre-dial check against the client's consent records and the DND registry, with consent source, time and purpose logged per call.
Evidence: Pre-dial check design; sample consent audit trail.
TRAI TCCCPR Third Amendment 2026 reg. 2(y) Explicit Consent · DPDP Act 2023 ss.5(1), 6(1)
CALL-04Can you enforce calling windows per campaign, such as 08:00 to 19:00 for recovery calls, in the customer's time zone?
Why it matters: RBI already bars recovery calls before 8 am and after 7 pm (NBFC RBC Directions para 100; para 445 for commercial banks), and from 1 January 2027 limits recovery contact to 08:00 to 19:00 unless the borrower asked for another time.
A good answer: Hard calling windows per campaign enforced at dial time, with logged exceptions only where the borrower asked to be called outside them.
Evidence: Campaign schedule settings; exception log.
RBI recovery directions 2026 (NBFC; banks use paras 454A-454AB) para 100Y(4)
CALL-05Can you cap attempts per customer and stop calling after a refusal or an opt-out?
Why it matters: From 1 January 2027 RBI lists excessive calling as a harsh recovery practice, and TRAI bars a sender from asking an opted-out customer for consent again within 90 days of the opt-out.
A good answer: Daily and weekly attempt caps per person, immediate suppression on opt-out, and opt-outs shared back to the client's systems.
Evidence: Retry policy; suppression list process.
RBI recovery directions 2026 (NBFC; banks use paras 454A-454AB) para 100Z(4) · TRAI TCCCPR Second Amendment 2025 press release 11/2025, item ii(d)
CALL-06What does the agent say at the start of each call about who is calling, that the call is recorded, and that it is an AI?
Why it matters: From 1 January 2027 RBI asks lenders to take reasonable precautions such as telling borrowers that recovery calls are recorded. RBI's FREE-AI committee report says customers must be told whenever they are interacting with AI; it is a report, not a binding direction.
A good answer: A fixed opening the client approves, naming the lender, stating the call is recorded and that the caller is an automated assistant, which the AI cannot skip or rephrase.
Evidence: Approved opening scripts per language; recordings showing them.
RBI recovery directions 2026 (NBFC; banks use paras 454A-454AB) para 100P · RBI FREE-AI committee report 2025 (not binding) para 4.4.54
CALL-07Will the agent ever discuss a debt with anyone other than the borrower or guarantor?
Why it matters: From 1 January 2027 RBI allows dues to be discussed only with the borrower or guarantor, and treats harassing their relatives, referees, friends or co-workers as a harsh practice.
A good answer: Identity confirmation before any account detail, and a scripted exit if the person answering is not the borrower or guarantor.
Evidence: Identity-check flow; test results for wrong-party calls.
RBI recovery directions 2026 (NBFC; banks use paras 454A-454AB) para 100Y(1) · RBI recovery directions 2026 (NBFC; banks use paras 454A-454AB) para 100Z(6)
AI model risk
AI-01Which AI models do you use for speech recognition, reasoning and voice, and will you tell us before you change any of them?
Why it matters: A model swap can change what the agent says. The FREE-AI committee recommends model governance over the whole lifecycle, and RBI IT contracts must give the lender the right to information about third parties in the vendor's supply chain.
A good answer: A named list of model providers and versions per component, advance notice of changes with a test report, and the right for the client to delay a change.
Evidence: Model inventory for the service; change notification policy.
RBI FREE-AI committee report 2025 (not binding) Recommendation 16 · RBI outsourcing directions 2025 (banks) para 69(xi)
AI-02Who can change the agent's prompt, script or knowledge base, and how are changes approved and recorded?
Why it matters: A prompt change is a change to what is said to customers. It needs the same control as a change to a scripted call.
A good answer: Versioned prompts and scripts, changes approved by the client, each call tagged with the version used, and rollback in minutes.
Evidence: Change log for one agent; approval workflow.
RBI FREE-AI committee report 2025 (not binding) Recommendation 16 · SEBI CSCRF 2024 PR.IP.S3 guideline 1
AI-03How do you stop the agent from inventing amounts, dates, offers or policy terms?
Why it matters: An agent that misstates a loan amount or a due date can mislead a customer, and the lender is liable for its vendors' conduct.
A good answer: Figures come only from the client's systems through tools, never from the model's own text; anything the agent cannot confirm it says it will check, and wrong-figure tests run before release.
Evidence: Test suite results; examples of tool-grounded responses.
RBI outsourcing directions 2025 (banks) para 17 · RBI FREE-AI committee report 2025 (not binding) Recommendation 20 (red teaming)
AI-04Can a customer reach a human at any point in the call, and how quickly?
Why it matters: The FREE-AI committee report says customers should always have the option to switch to a human, and responsibility for complaints about outsourced calls stays with the lender.
A good answer: Transfer to a human on request or on defined triggers such as distress, dispute or vulnerability, with a fallback callback if no agent is free.
Evidence: Escalation rules; transfer rate and wait-time report.
RBI FREE-AI committee report 2025 (not binding) para 4.4.54 · RBI outsourcing directions 2025 (banks) para 51
AI-05How do you test the agent before launch and monitor it after, including for bias across languages and customer groups?
Why it matters: The FREE-AI committee recommends monitoring for drift and degradation, risk-based red teaming, and bringing AI products into product approval with checks for fairness and bias.
A good answer: Pre-launch test sets per language, ongoing sampling of live calls reviewed by people, and dashboards for errors, escalations and complaints.
Evidence: Test plan; last monthly quality report.
RBI FREE-AI committee report 2025 (not binding) Recommendations 16, 20 · RBI FREE-AI committee report 2025 (not binding) Recommendation 17
AI-06What happens if a customer tries to make the agent say something harmful or reveal another customer's data?
Why it matters: Prompt injection and data leakage are AI-specific security risks that the FREE-AI committee asks regulated entities to identify and address.
A good answer: The agent only sees the current customer's data, refuses out-of-scope requests, and adversarial testing covers injection and data-extraction attempts.
Evidence: Red-team report; data-scoping design.
RBI FREE-AI committee report 2025 (not binding) Recommendation 19 · DPDP Rules 2025 rule 6(1)(b)
AI-07Will you tell us about AI incidents, such as the agent giving wrong information to many customers?
Why it matters: The FREE-AI committee recommends that regulators set up an AI incident reporting framework for regulated entities, and a systematic error can harm many customers before anyone notices.
A good answer: A definition of AI incidents, notification within an agreed time, and a list of affected calls so the client can contact customers.
Evidence: AI incident policy; example incident report.
RBI FREE-AI committee report 2025 (not binding) Recommendation 22 · RBI outsourcing directions 2025 (banks) para 69(iii)
Subcontractors and sub-processors
SUB-01List every subcontractor that touches our data or calls, including telephony carriers, cloud hosts and AI model providers.
Why it matters: RBI requires the lender's prior approval or consent before a vendor uses subcontractors, and, for IT services, the right to information about third parties in the supply chain.
A good answer: A complete sub-processor list with role, data received and location, kept current on a public or client-accessible page.
Evidence: Sub-processor register.
RBI outsourcing directions 2025 (banks) para 34(iv) · RBI outsourcing directions 2025 (banks) para 69(xi) · RBI outsourcing directions 2025 (NBFCs) para 34(iv)
SUB-02Will you get our approval before adding or replacing a subcontractor?
Why it matters: Prior approval or consent of the lender for subcontractors is a required contract clause for banks and NBFCs, and the lender must review the subcontracting before it agrees.
A good answer: No new or replacement subcontractor without the client's prior written approval, with enough notice and detail for the client to review it first.
Evidence: Contract clause; notice from a past change.
RBI outsourcing directions 2025 (banks) para 4(2) · RBI outsourcing directions 2025 (banks) para 34(iv) · RBI outsourcing directions 2025 (NBFCs) para 34(iv)
SUB-03Do your contracts with subcontractors carry the same security, confidentiality, audit and regulator-access terms as ours?
Why it matters: RBI's audit and inspection rights extend to subcontractors, and CSCRF says third-party service providers must be required to follow similar information security standards.
A good answer: Flow-down clauses covering security, confidentiality, breach notice, audit and regulator access in every subcontract that touches client data.
Evidence: Template subcontract; flow-down clause excerpt.
RBI outsourcing directions 2025 (banks) para 69(i), 69(xii) · SEBI CSCRF 2024 GV.SC standard 8
SUB-04Do you accept full liability for your subcontractors' performance and failures?
Why it matters: RBI requires the vendor to be contractually liable for its subcontractors.
A good answer: Yes, without carve-outs for model providers or carriers, backed by adequate insurance.
Evidence: Contract clause; insurance certificate.
RBI outsourcing directions 2025 (banks) para 69(xiii) · RBI outsourcing directions 2025 (NBFCs) para 74(xiii)
SUB-05Is our relationship with you governed by a written data processing contract that covers security safeguards?
Why it matters: Under DPDP a fiduciary may use a processor only under a valid contract, and from 13 May 2027 the Rules require that contract to cover reasonable security safeguards.
A good answer: A data processing agreement naming the client as fiduciary, limiting processing to its instructions, and setting out security, breach notice and erasure duties.
Evidence: Signed DPA.
Business continuity and exit
BCP-01What is your business continuity and disaster recovery plan for the voice service, and when was it last tested?
Why it matters: RBI requires the lender to make the vendor set up, document and periodically test business continuity and recovery plans, and suggests occasional joint tests.
A good answer: A documented plan with recovery time and recovery point targets, tested at least yearly, and the client invited to joint tests.
Evidence: BCP and DR plan; last test report.
RBI outsourcing directions 2025 (banks) para 40 · RBI outsourcing directions 2025 (banks) para 78
BCP-02If your AI model provider or telephony carrier fails, what happens to calls already in progress and to scheduled campaigns?
Why it matters: A voice service depends on several outside providers. Lenders must plan for failure of the vendor and its key dependencies.
A good answer: Named fallback providers for speech, AI and telephony, safe handling of live calls, and automatic pause of campaigns rather than broken calls.
Evidence: Dependency map; failover test results.
RBI outsourcing directions 2025 (banks) para 41 · RBI outsourcing directions 2025 (banks) para 77
BCP-03On termination, how will you return our data, in what format, and how will you prove deletion?
Why it matters: RBI requires clauses on safe removal or destruction of data, and a cloud exit plan that ends in a secure purge.
A good answer: Full export of recordings, transcripts, call logs and configuration in open formats, then deletion with a signed certificate, including backups and sub-processors.
Evidence: Exit procedure; sample deletion certificate.
RBI outsourcing directions 2025 (banks) para 82 · RBI outsourcing directions 2025 (banks) para 92(xvi)
BCP-04Will you keep providing the service and avoid changing or deleting any data during a handover to a new vendor?
Why it matters: RBI bars the vendor from erasing or altering data during transition and requires it to cooperate with the replacement provider.
A good answer: A defined transition period at agreed rates, a data freeze, and a duty to cooperate with the client's new vendor.
Evidence: Transition assistance clause.
RBI outsourcing directions 2025 (banks) para 82 · RBI outsourcing directions 2025 (banks) para 83
BCP-05Can we or a new vendor recreate our agents from what you hand back, such as scripts, prompts, flows and voice settings?
Why it matters: Lenders must identify alternatives and be able to bring a service in-house or move it without prohibitive cost or disruption.
A good answer: All client-specific configuration exportable and documented, with no lock-in to proprietary formats that only this vendor can read.
Evidence: Export of one agent's configuration.
RBI outsourcing directions 2025 (banks) para 43 · RBI outsourcing directions 2025 (banks) para 81
Audit and regulator access
AUD-01Will you let our internal and external auditors audit you, including on-site?
Why it matters: The lender's right to audit the vendor is a required contract clause.
A good answer: Unconditional audit rights for the client and its auditors, on reasonable notice, covering the vendor and relevant subcontractors.
Evidence: Contract clause; record of past client audits.
RBI outsourcing directions 2025 (banks) para 34(vii) · RBI outsourcing directions 2025 (NBFCs) para 34(vii)
AUD-02Will you give RBI, SEBI or IRDAI, and anyone they authorise, access to our data, your records and your premises?
Why it matters: RBI must be able to access records and inspect the vendor, and SEBI may access data held by an entity's third-party service providers.
A good answer: A clause granting regulator access and inspection rights, extending to subcontractors, with no extra charge to the client.
Evidence: Contract clause.
RBI outsourcing directions 2025 (banks) para 34(viii)-(ix) · RBI outsourcing directions 2025 (banks) para 76 · SEBI CSCRF 2024 GV.OC.S2 guideline 3
AUD-03Can you share audit reports, penetration test results and certifications every year without us asking?
Why it matters: Lenders must review each vendor's financial and operational condition at least yearly, and SEBI may ask for the reports of audits the entity runs.
A good answer: An annual assurance pack sent proactively, with findings and remediation status.
Evidence: Last year's assurance pack.
RBI outsourcing directions 2025 (banks) para 38 · SEBI CSCRF 2024 GV.OC.S2 guideline 5
AUD-04Will you comply with directions from our regulators that apply to the outsourced service?
Why it matters: RBI requires the contract to oblige the vendor to comply with RBI directions relevant to the service.
A good answer: A clause accepting relevant regulatory directions and a process to implement new ones within agreed timelines.
Evidence: Contract clause; regulatory change log.
RBI outsourcing directions 2025 (banks) para 69(xiv) · RBI outsourcing directions 2025 (NBFCs) para 74(xiv)
Grievances and customer rights
GRV-01How will you pass customer complaints about calls to us, and how fast?
Why it matters: Responsibility for complaints about outsourced services stays with the lender. Its response time, at most 30 days, must be on its website, and a customer with no reply or a rejection can then go to the RBI Ombudsman.
A good answer: Complaints raised on a call are logged and sent to the client the same day, with the call recording attached.
Evidence: Complaint routing workflow; sample complaint record.
RBI outsourcing directions 2025 (banks) paras 51-52 · RBI outsourcing directions 2025 (NBFCs) paras 56-57
GRV-02Can the agent give the customer our grievance officer's contact details when asked, or in every recovery call?
Why it matters: From 1 January 2027 RBI requires every recovery communication to give the grievance officer's name, email, phone number and address, and its digital lending rules already require named nodal grievance officers.
A good answer: Grievance details held as approved script content and given on request or by default in recovery campaigns.
Evidence: Script excerpt; recording showing it.
RBI NBFC Credit Facilities Directions 2025 (digital lending) para 12(1)-(2) · RBI recovery directions 2026 (NBFC; banks use paras 454A-454AB) para 100AA
GRV-03How will you help us respond when a customer asks to access, correct or erase their data, including recordings?
Why it matters: From 13 May 2027 people can ask to access, correct or erase their data under DPDP, and grievances must be answered within 90 days.
A good answer: Search by phone number or customer ID, export or delete within days, with legal holds and regulatory retention respected.
Evidence: Data subject request procedure; turnaround report.
GRV-04When a customer withdraws consent, will you stop processing and erase their data within an agreed time?
Why it matters: From 13 May 2027 the fiduciary must erase data on withdrawal of consent and make its processor do the same, unless another law requires retention.
A good answer: Withdrawal flags honoured at the next dial attempt, data erased within an agreed period except where the client marks a legal retention duty.
Evidence: Erasure workflow; contract clause.
GRV-05For insurance calls, how do you support our responsibility for the conduct of sales and service calls?
Why it matters: IRDAI holds insurers and their distribution channels responsible for the solicitation process and expects action against unhealthy practices.
A good answer: Approved scripts, no mis-selling incentives in the agent's design, recordings available for every sales call, and reporting of complaints by campaign.
Evidence: Sales call scripts; complaint report by campaign.
IRDAI Master Circular on Protection of Policyholders' Interests 2024 para 7
Background: RBI outsourcing rules for AI voice vendors, how long to keep call recordings and SEBI's rules for brokers.
This page summarises public rules and is not legal advice. Where an official source is online, the entry links to it; check the source before you rely on it. More tools and guides are in Resources.