The Reserve Bank of India's draft guidance on model risk management proposes a far tighter compliance architecture that could significantly impact costs across banks, NBFCs and fintech firms. According to Business Standard, AI governance could become finance's next cost centre, with implementation costs expected to be high, especially in the early years. Shams Tabrej, co-founder and CEO of Ezeepay, told Business Standard that compliance costs will be high during the initial setup phase, covering governance, documentation, monitoring of models, audit trails, and expertise for compliance management. Large banks may integrate AI oversight more easily due to their existing mature governance systems, while NBFCs and fintech firms may require additional investment in technology, human resources, and independent oversight frameworks. The framework requires institutions to maintain board-approved model risk frameworks, independent validation, stress testing, stronger cybersecurity controls and customer disclosure mechanisms.
The draft guidance introduces enhanced requirements for AI and ML systems, including assessment of risks arising from hallucinations, bias, discriminatory outcomes, data drift and adversarial attacks. According to Reuters, regulated entities must test models under stressed scenarios and implement appropriate safeguards and controls. The framework prescribes a three-lines-of-defence approach where model owners form the first line of defence, independent model risk management and validation functions the second line, and internal audit the third line. For the first time, the RBI has placed AI and model governance squarely at the board level, with every regulated entity required to have a board-approved Model Risk Management Framework covering all models, whether developed in-house, obtained from vendors or built through a combination of both. All models will need to be classified according to their risk profile based on materiality, complexity and other supervisory considerations. As reported by Mint, the norms emphasize case-by-case use over broad-based deployment of models and focus on risk mitigation, impact on business processes, customer safeguards and controlling the reach of such models through human intervention and oversight.
The RBI has mandated that regulated entities maintain a comprehensive inventory of all active, inactive and decommissioned models with details of model owners, developers, validators, approvers, risk tiers and key observations from validation exercises. As reported by Reuters, no model can be used unless it is included in this inventory. The central bank has made it clear that regulated entities remain accountable for outcomes arising from third-party models, with banks and NBFCs required to independently validate such models irrespective of any certification provided by external vendors. High-risk models will require approval from the RMCB, while lower-risk models may follow delegated approval mechanisms. The risk tier of a model must be reviewed at least once a year, with high-risk models requiring approval from the Risk Management Committee of the Board before deployment rather than being cleared only by the technology or risk team. According to Business Standard, Jitendra Tanwar, managing director and CEO at Namdev Finvest Limited, said the requirements would create meaningful upfront investments including board-level oversight, continuous model monitoring, validation processes, documentation standards, and robust auditability of AI-driven decisions.
Under the proposed framework, boards will be required to periodically review the Model Risk Management Framework (MRMF), approve the entity's risk appetite and tolerance for model risk, and ensure these assessments are backed by scenario analysis and stress testing. As reported by Banking Standard, boards will also have to approve policies governing model risk management and model-risk classification. Ajay Sirikonda, partner and leader (Financial Services Risk Management) at EY India, said the draft guidelines provide Indian banks with a clear playbook for managing model and AI risks, although implementation will be the bigger challenge. "Banks that treat AI governance as core infrastructure, he said, will emerge as leaders." According to Banking Standard, the guidelines have a channelling effect on AI use cases and introduce additional governance and explainability requirements, but primarily for high-stakes areas such as credit, pricing and autonomous decision-making. For most use cases, that will accelerate adoption rather than constrain it, as they provide clarity on what is permissible and remove regulatory uncertainty that has held back AI adoption. As reported by Business Standard, Sushantam Mohan, chief data officer at Vivriti Next, said global regulators have already moved in this direction, with establishing advanced corroboration, validation and continuous monitoring systems representing operational and financial costs that benefit end users in the long run.
The RBI has proposed measures to address risks arising from the use of third-party AI models, requiring regulated entities to assess behavioural risks associated with such models and test their performance under atypical and stressed scenarios. As reported by Banking Standard, the draft framework requires institutions to evaluate models against edge cases, abnormal inputs, manipulation attempts and adversarial conditions to identify vulnerabilities that may not emerge under normal operating conditions. For customer-facing AI systems, including generative AI applications, the RBI has proposed additional cybersecurity safeguards, including protection against prompt injection attacks and adversarial inputs, limits on session and context persistence, and mechanisms to detect anomalous usage patterns. Rajesh Chhabra, general manager (APAC and Large Markets) at Acronis, said the framework comes as AI becomes increasingly embedded in financial services and is no longer a peripheral tool in banking operations. "As AI adoption deepens in the country, this well-defined governance framework is a necessary step to mitigate the associated risks, particularly in the highly interconnected credit ecosystem where banks, NBFCs and fintechs are increasingly relying on algorithm-led financial decisions," he said. According to Business Standard, Srividhya Sridhar, group general counsel at Vivriti Next, said institutions adopting governance standards early could improve credibility with lenders and partners, with adoption of automated decisioning models being much higher in new age NBFCs and fintechs compared to legacy banks.
