Why BFSI transport is different
A BFSI mobility programme is not just a cost line. It's an operational-risk control that shows up in three different audits — the internal-audit report to the ACB, the vendor-due-diligence review under RBI's outsourcing framework and the annual POSH committee submission. Get any of those wrong and the fix is far more expensive than the programme.
This guide walks through what actually sits in a 2026-grade BFSI transport MSA in India, section by section — the regulatory anchors, the SLA lines, the data-protection posture and the questions procurement teams should be putting to any vendor at RFP stage.
The regulatory perimeter
Five instruments do most of the work. First, the RBI Master Direction on Outsourcing of IT Services (2023) and the broader RBI outsourcing framework — they define material outsourcing, mandate documented vendor due-diligence, right-to-audit, SLA and exit strategy, and expect the board to have visibility on any concentration risk. Employee transport for treasury and custody teams usually clears the materiality bar because a disruption directly hits an SLA-tied operation.
Second, the IRDAI Guidelines on Outsourcing of Activities by Insurers (2017, updated). Insurers must classify the contract, hold performance MIS, run periodic reviews and keep an escalation matrix. Third, SEBI's system-audit expectations for brokers and AMCs — where staff-transport records feed the annual operational-risk audit and typically need a 24-month log retention.
Fourth, the POSH Act of 2013. Employer liability follows the employee into any place she visits in the course of employment, including employer-arranged transport. Fifth, the state Shops & Establishments Acts in Karnataka, Maharashtra, Telangana, Tamil Nadu and Haryana — each mandates safe drop for women employees after specified hours (typically 19:00–20:00). Together those five make the women-safety SOP the single most audited part of a BFSI transport programme.
Wrapping all of it is the Digital Personal Data Protection Act, 2023. Pickup addresses, phone numbers and geo-traces are personal data; the bank or insurer is the Data Fiduciary and the transport vendor is the Data Processor. A Data Processing Agreement, India-hosted logs, a defined retention window and a breach-notification clock now belong inside the MSA, not in a side letter.
What belongs in the MSA
- Right-to-audit clause allowing quarterly on-site vendor audits and immediate access to trip and driver records.
- Documented women-safety SOP: mandatory escort post-22:00, geo-fenced routes, in-cab camera, one-tap SOS with a named response SLA (≤ 8 seconds is achievable), post-drop OTP.
- Driver KYC cadence: police verification, PSV badge validity, refresher training log — refreshed at defined intervals per driver.
- Vehicle documentation liveness: RC, fitness, PUC, commercial insurance and permit validity tracked in the vendor MIS.
- Data protection: signed DPA under the DPDP Act, India-hosted infrastructure, defined retention, deletion on exit, breach-notification clock.
- Business continuity: backup-fleet %, alternate-vendor plan, incident communication tree with named SPOCs.
- Reporting cadence: monthly MIS with cost-centre split, exception log, SLA dashboard and women-safety compliance line.
- Commercials: rate card by vehicle class, dead-mileage rules, cancellation and no-show policy, GST/e-invoice format.
- Exit clause: data handover, driver-list transition and a transitional-services window.
The SLA lines large BFSI buyers use
| Metric | Band |
|---|---|
| Pickup on-time (branch commute) | ≥ 98% on 30-day rolling window |
| Night-shift escort dispatch (female employees, post-22:00) | 100% — non-negotiable |
| SOS acknowledgement to control tower | ≤ 8 seconds |
| Audit-log export turnaround | ≤ 30 minutes |
| Monthly MIS delivery | T+3 working days |
| Invoice / GST reconciliation | T+5 working days |
Scope: what a BFSI transport programme is — and isn't
A modern BFSI programme covers night-shift home drops, branch and regional-office commute, internal-audit and risk-team travel, leadership and board chauffeur, airport transfers for visiting regulators and Big-4 auditor teams, and event/offsite fleet for investor days and town halls. It does not cover cash-in-transit, ATM cash escort, armed security or valuables movement — those sit with specialised secure-logistics licensees and belong in a separate contract, separate audit trail and separate insurance stack.
Frequently asked questions
Is employee transport a 'material outsourcing' arrangement under RBI rules?+
Increasingly, yes. Under RBI's Master Direction on Outsourcing of IT Services (2023) and the broader outsourcing framework, any activity that could materially affect operations, staff safety or regulatory reporting needs vendor due-diligence, an SLA, a right-to-audit clause and an exit strategy. Night-shift women-employee transport for treasury, custody and captive-BPO teams typically clears that bar and is treated as material by most large banks.
What does the POSH Act say about employer-provided transport?+
The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 extends the employer's liability to any place the employee visits arising out of employment — including employer-provided transport. An incident inside a company-arranged cab is on the employer, not just the vendor. That's why women-safety SOPs (escort post-22:00, geo-fenced routes, in-cab camera, SOS, OTP drop) belong in the transport MSA, not in a side note.
Which state Shops & Establishments Acts affect BFSI transport programmes?+
Karnataka, Maharashtra, Telangana, Tamil Nadu and Haryana each mandate safe drop for women employees after specified hours (typically between 19:00 and 20:00). These become route eligibility rules — female employees on a shift ending after the cutoff can only be dispatched on a transport plan that includes escort and documented drop confirmation.
How does the DPDP Act, 2023 change transport-vendor contracting?+
Pickup addresses, phone numbers and geo-traces are personal data of the employee (the Data Principal). The bank/insurer is Data Fiduciary; the transport vendor is Data Processor. A Data Processing Agreement, India-hosted logs, defined retention, deletion on exit and a breach-notification clock are all now table-stakes MSA lines.
What are the standard SLA lines that should sit in a BFSI transport MSA?+
Pickup on-time ≥ 98%, night-shift escort dispatch 100%, SOS acknowledgement ≤ 8 seconds, audit-log export ≤ 30 minutes, monthly MIS by T+3, invoice reconciliation by T+5, plus a defined backup-fleet % and an incident-communication tree with named SPOCs.