The RBI's outsourcing guidelines require that every NBFC maintain a comprehensive register of all LSP relationships — including the function outsourced, the nature of data shared, the contract terms, and the due diligence status. This register must be available for inspection at any time and must be presented to the Board annually. The LSP Governance AI maintains this register as a live document — updated when any LSP relationship changes, when a due diligence is completed, or when a contract is renewed — so that the register is accurate at the moment of inspection, not at the moment of the last manual update.
What the vendor register must contain — and the risks of a stale register
An outdated vendor register is not just an administrative inconvenience — it is an active regulatory risk. A register that shows a vendor as active who was terminated three months ago will be noticed by an RBI inspector reviewing the register against the institution's accounts payable and operational records. A register that omits a new technology vendor who was onboarded without a due diligence review will generate questions about the institution's governance process for LSP onboarding. A register that shows a due diligence as current when it is 14 months old — beyond the annual review cycle — is evidence of a compliance gap.
The LSP Governance AI updates the register automatically when any of these events occur: a new LSP is onboarded (triggered by the contract being uploaded to the governance system), a due diligence cycle is completed (the scorecard and date are logged), a contract is renewed or amended (new terms recorded), or an LSP is terminated (status updated to inactive, termination date recorded, data return confirmation logged). The register is never more than a few hours out of date.
The live vendor register: five active LSP relationships
The triggers that update the register automatically
Contract upload triggers automatic register entry creation
When a new LSP contract is uploaded to the governance system, the LSP Governance AI creates the register entry automatically — extracting the LSP name, function, territory, data shared, and contract terms. It also sets the due diligence schedule (first DD within 30 days of onboarding; annually thereafter) and the contract renewal alert (90 days before expiry).
→ Register updated within 1 hour of contract upload · DD schedule set · Renewal alert configuredDD scorecard logged and register DD status updated to current
When an annual due diligence cycle completes, the scorecard date, score, and key findings are logged in the register. The register's "DD status" field updates from "Due" or "Overdue" to "Current — [date]." The next DD cycle is automatically scheduled for 12 months from completion.
→ Register updated on DD completion · Prior scores retained for trend analysis · Next DD auto-scheduled90-day and 30-day alerts before contract renewal date
The register tracks every contract's renewal date. At 90 days before renewal, the legal and compliance teams are alerted. At 30 days, the alert escalates. At the renewal date, if the contract has not been renewed, the register flags the LSP as "operating without current contract" — a regulatory exposure that requires immediate resolution.
→ Aarya Recovery: contract overdue since Nov 4, 2025 · Escalation active · Resolution deadline: Dec 31Termination recorded with data return and system access revocation confirmation
On LSP termination, the register records the termination date, the reason, and the completion of orderly wind-down obligations: data return confirmation (date received), system access revocation (date confirmed), and any outstanding payments or disputes. The terminated LSP remains in the register as inactive for 5 years — the regulatory record of the relationship must be available for that period.
→ Sapphire Credit Bureau: terminated Sep 30 · Data returned Oct 14 · Access revoked Sep 30 · ArchivedThe vendor register that cannot be presented to an inspector within 30 minutes is a governance failure
An RBI inspection request for the LSP register does not come with two weeks' notice to prepare it. It comes with a request to see the current, complete register — now. An institution that maintains its vendor register as a live document, updated continuously from the operational governance system, can produce it immediately and confidently. An institution that maintains it as a periodic compilation exercise can produce it after a scramble — and the scramble is visible to the inspector in the data quality, the inconsistencies, and the out-of-date entries that were not caught before the inspection. The LSP Governance AI ensures that the register is the same document that the compliance team uses every day — because when it is, it is always ready to be shown.