RBI proposes stricter data governance framework for banks, NBFCs; seeks feedback by Aug 17

New Delhi, [India] July 16 (ANI): The Reserve Bank of India (RBI) has proposed a comprehensive data governance framework requiring banks, non-banking financial companies (NBFCs) and other regulated entities to strengthen data risk management as part of their overall risk management systems.
It says "Data has increasingly emerged as a critical organisational asset for Regulated Entities (REs), underpinning business operations, customer service, financial reporting, regulatory compliance, risk management, and strategic decision-making."
According to the RBI's draft guidelines, the proposed framework lays down regulatory expectations on data governance, including governance structures, roles and responsibilities, data architecture, metadata and lineage, data quality, and third-party data-sharing arrangements. The central bank has invited public comments on the draft till August 17.
The draft framework will apply to commercial banks, small finance banks, payments banks, cooperative banks, regional rural banks, NBFCs, all-India financial institutions, asset reconstruction companies (ARCs) and credit information companies.
The RBI said that with the increasing volume, variety and velocity of data, robust governance has become critical to ensure that data remains accurate, consistent, secure and fit for purpose across business functions and systems.
The central bank noted that weaknesses in data governance and its management could expose regulated entities to financial, operational, compliance and reputational risks.
Under the proposal, regulated entities will be required to establish a data governance framework covering the entire data lifecycle.
RBI's draft proposal noted, "An RE should put in place a Data Governance Framework (DGF) applicable to all data and align it with its risk management framework."
The RBI has also proposed that the board oversee the framework, with each regulated entity either constituting a dedicated board-level data governance committee or assigning the responsibility to an existing board committee.
"An RE should establish a Board-level Data Governance Committee (DGC) or assign the responsibility to an existing Committee of the Board," noted RBI's draft proposal.
The designated committee would be responsible for approving data governance policies, overseeing implementation, reviewing material breaches and reporting key issues to the board.
The RBI has further proposed that every regulated entity maintain a "single source of truth" for each data element to ensure that downstream systems, models and business processes rely on one authoritative source. (ANI)