Blog & news
Insights on governing AI you can trust
Research notes, product news and practical guidance on AI safety, governance and compliance for financial services.
Research · Agentic AI Risk
Banks Are Blind to 88% of Their Agentic AI Risk Surface
We catalogued 167 AI risks across 21 governance domains for banking and financial services. Sixty-eight are genuinely new, none appear in SR 11-7 or any traditional model risk framework.
Read the research →
Research
Banks are blind to 88% of their agentic AI risk surface
167 risks, 21 domains, 68 genuinely new failure modes, and none of them in SR 11-7.
Read more →Governance
AI agent audit trails: what the logs don't tell you
A trace shows what happened. A governance record shows whether it was permitted. Most banks only have the first.
Read more →Technical
Why a 0.5% false-positive rate decides whether AI ships in banking
A guardrail that blocks real customers is worse than no guardrail. Here's the math behind production-safe FPR.
Read more →Compliance
The EU AI Act for BFSI: a readiness checklist
What high-risk classification means for banks, and the eight controls to put in place before enforcement.
Read more →Research
Aval v1.5: outperforming larger models at 44x fewer parameters
How a 184M-parameter classifier beats billion-parameter guards on financial adversarial prompts.
Read more →CIC · Credit Bureau
India Credit Bureau AI Governance: CIBIL, Experian, CRIF under RBI MRMF 2026
Credit information companies are explicitly named in MRMF scope. Credit score models, alternate AA-powered scoring, and inquiry fraud AI now require full model documentation, independent validation, INDIC-BIAS testing, and explainability for reason codes.
Read more →SFB · Financial Inclusion
Small Finance Bank AI Governance India: RBI MRMF 2026 Obligations for All 12 SFBs
All 12 SFBs — AU, Equitas, Ujjivan, Jana, ESAF and more — face the same MRMF obligations as commercial banks, with no proportionality exemption. JLG scoring, microfinance repayment AI, and digital onboarding carry the highest INDIC-BIAS risk in Indian banking.
Read more →LLM · Governance
India Banking LLM Governance 2026: Enterprise Deployment Under MRMF and FREE-AI
Five LLM deployment patterns active in India banking, RAG pipeline governance under RBI data localization, hallucination risk measurement, and what MRMF actually requires in the model inventory for every LLM in production.
Read more →RBI · Cooperative
RBI Urban Cooperative Bank AI Governance 2026: Tier-by-Tier MRMF Obligations
India's 1,514 UCBs came under direct RBI supervision in 2020. MRMF June 2026 applies to all RBI-regulated entities — including cooperative banks. This analysis maps AI governance obligations for Tier 1 through Tier 4 UCBs, with a focus on the CBS-embedded AI governance gap most UCBs have not yet addressed.
Read more →SEBI · Depository
SEBI Depository Participant AI Governance 2026: NSDL, CDSL, and DP Obligations
India holds 17+ crore demat accounts. AI governs fraud detection, pledge management, and beneficial ownership tracing across 900+ DPs. SEBI CSCRF and the 2024 cybersecurity circular map to the DP context here.
Read more →Incident Response
India BFSI AI Incident Response: Multi-Regulator Reporting Playbook 2026
A single AI incident in India BFSI can trigger simultaneous reporting to CERT-In (6 hours), RBI (2 hours), SEBI, IRDAI, and potentially India AISI. Most banks manage these as separate silos. This article maps all obligations into one triage decision tree.
Read more →RBI · Payments
RBI Payment System Provider AI Governance: PSP, PPI, and PA Obligations Mapped
India's payment ecosystem processes 14 billion+ UPI transactions monthly. Every fraud detection model, risk engine, and dispute resolution AI is subject to RBI governance — but PSP, PPI, and PA obligations differ from bank obligations in ways no analysis has mapped.
Read more →MeitY · IndiaAI
India AI Safety Institute 2026: What Banks Must Prepare For
India's IndiaAI Mission (MeitY) is building a national AI safety framework above RBI and SEBI. Here is what is known, what is likely, and what banks should build now.
Read more →RBI · MSME Credit
RBI MSME AI Credit Scoring Governance: Alternative Data and MRMF Obligations
India's 63 million MSMEs face a ₹25 lakh crore credit gap. AI credit scoring using GST, TReDS, and Account Aggregator data is the solution — and RBI MRMF governs every model in the chain.
Read more →IRDAI · InsurTech
India InsurTech AI Governance 2026: IRDAI Sandbox Obligations Mapped
IRDAI's 2026 AI governance instruments apply differently to sandbox entities versus licensed insurers — a two-track compliance challenge that no analysis has yet mapped.
Read more →Agentic AI · OWASP
OWASP Agentic AI Top 10: India BFSI Mapping to MRMF and FREE-AI
First India BFSI crosswalk: OWASP's new Agentic Top 10 mapped to RBI MRMF, FREE-AI, CERT-In Blueprint, and DPDP Act simultaneously.
Read more →RBI · CBDC
RBI CBDC AI Governance 2026: e-Rupee Under FREE-AI and MRMF
e-Rupee is expanding under Utkarsh 3.0. AI in CBDC fraud detection, programmable money, and wallet KYC is in FREE-AI and MRMF scope — and no bank has fully mapped the obligations yet.
Read more →SEBI · AIF
SEBI AIF AI Governance 2026: Quant Model Risk in the Regulatory White Space
Category III AIFs deploying quant models face a governance gap SEBI's Master Circular (June 2026) doesn't fill. First dedicated analysis of AI governance for India's AIF sector.
Read more →AI Vendor Risk · India
India BFSI AI vendor risk: third-party governance under RBI FREE-AI and MRMF
Outsourcing AI does not outsource accountability. DSCI/BCG flags shared vendor concentration as India BFSI's #1 AI attack surface. Six controls banks must build now.
Read more →RBI · Cyber Threats
RBI AI Cyber Threats Advisory 2026: Five Controls Banks Must Build
RBI's AI-ACT&RS advisory (April 2026) and NBPSO extension (June 2026) name AI-driven cyberattacks the #1 financial stability threat. MRMF and CERT-In Blueprint intersection explained.
Read more →BCBS · Basel
BCBS September 2026: Basel Committee's first AI discussion and what it means for India
The first on-record BCBS AI work programme entry signals where global bank regulation is heading. India's RBI MRMF positions Indian banks ahead of the curve — except on agentic AI.
Read more →FATF · AML
FATF AI and Deepfakes Horizon Scan 2026: What India Banks Must Do Under PMLA and FIU-IND
FATF's January 2026 Horizon Scan names deepfake KYC bypass, AI synthetic identities, and autonomous AI-orchestrated layering as primary 2026 financial crime risks. India PMLA and FIU-IND compliance obligations explained.
Read more →RBI · SupTech
RBI DAKSH: What Banks Must Do to Prepare for AI-Powered Supervisory Monitoring
DAKSH (October 2022) is live and processing compliance data in near real-time. The Supervisory Data Quality Index (SDQI, 2025) now scores every bank's data submission — poor SDQI scores trigger escalated supervisory attention. Banks whose AI pipelines degrade data quality face a direct supervisory risk.
Read more →FSB · G20 · Financial Stability
FSB Frontier AI G20 Letter August 2026: Financial Stability Risks and What India Banks Must Do
FSB Chair Andrew Bailey's August 31 letter identified hyperscaler concentration, AI-linked leverage, and cyber resilience as frontier AI financial stability risks. BCBS met October 1, 2026. RBI will act.
Read more →DPDP · Banking
DPDP Rules 2025: AI Compliance for Banks as Significant Data Fiduciaries
DPDP Rules 2025 (notified November 13, 2025; enforceable May 13, 2027) require SDFs to conduct DPIAs for AI systems. India's large banks, NBFCs, and insurers face consent architecture redesign, model unlearning obligations, and AA revocation chain implementation — none of which can be built in a sprint.
Read more →IRDAI · Insurance AI
IRDAI AI Governance 2026: Cybersecurity Guidelines Binding Now, WG-AI Two-Track Compliance
Two IRDAI instruments are reshaping AI governance for Indian insurers in FY2026-27: the Revised Information and Cybersecurity Guidelines (April 2026, binding now) and the Working Group on Artificial Intelligence (June 2026, recommendations due September). Insurers that wait for WG-AI before acting will face two rounds of remediation. Gap analysis versus RBI MRMF and SEBI.
Read more →SEBI · Mutual Funds
SEBI AI/ML Circular 2026: Quarterly Reporting Obligations for Mutual Funds and AMCs
SEBI Circular HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 (May 5, 2026) requires fund houses to submit quarterly AI/ML inventories to AMFI within 15 days of quarter end. No materiality threshold — any AI in investor-facing products or compliance triggers the obligation. Vendor AI liability stays with the fund house. Five-step readiness program for compliance teams.
Read more →IFSCA · GIFT City
IFSCA AI Cybersecurity Circular 2026: What GIFT City Regulated Entities Must Do Now
Circular IFSCA-CSD/MSC/3/2026-DCS (June 4, 2026) mandates an 11-point AI-integrated cybersecurity framework — SBOM, FIDO2 MFA, board-level frontier AI risk, AI-specific pen testing, regulatory reporting — for all GIFT IFSC entities. 65% already deploying GenAI. Non-compliance risks registration suspension.
Read more →NPCI · Agentic AI
NPCI Unified Agent Protocol 2026: Governing AI Agents on UPI
NPCI's UAP (Global Fintech Fest, September 2026) is the first formal AI agent integration into India's real-time payment infrastructure. PSPs and banks face new governance obligations: authorization scope beyond the ₹15,000 cap, audit trail design for NPCI disputes, DPDP consent for agent data processing, MRMF kill switch for UAP agents. First dedicated analysis.
Read more →SEBI · Advisers
SEBI AI Disclosure for Investment Advisers: Deadline Passed, Non-Compliance Active
The compliance deadline has passed. IAs and RAs using AI without updated client agreements are in current non-compliance. SEBI's January 2025 circular + February 2026 Master Circular create a compliance matrix across client agreements, research reports, and DPDP Act consent. Four liability streams when AI-generated advice goes wrong.
Read more →New · MCP Security · RBI MRMF
MCP Security in India BFSI: What RBI MRMF and FREE-AI Require When LLMs Connect to Core Banking Systems
Model Context Protocol servers bridge LLMs to CBS, loan APIs, and treasury platforms — creating tool description poisoning, rug-pull, and cross-MCP privilege escalation attacks with zero India BFSI coverage from any global vendor. RBI MRMF model component risk, FREE-AI third-party assurance, CERT-In 6-hour reporting, DPDP Act obligations. Pre-deployment checklist included.
Read more →New · Voice AI · VKYC · IRDAI
Voice AI Deepfake Attacks in India BFSI: VKYC Security, IRDAI AI Working Group, and DPDP Biometric Obligations
Sub-second TTS deepfakes defeat VKYC liveness detection. IRDAI AI WG June 2026 requirements for voice claim bots and IVR underwriting. DPDP Act biometric data consent and breach notification. NPCI UAP voice payment governance. India's linguistic diversity as a security asymmetry. No global AI security vendor covers this intersection.
Read more →New · Shadow AI · RBI FREE-AI
Shadow AI in Indian BFSI: Detecting Unauthorized LLM Use Under RBI FREE-AI and DPDP Act
Employees using ChatGPT, Gemini, and Copilot in banking workflows create AI inventory gaps under RBI FREE-AI and DPDP Act breach liability. Detection techniques, the mobile hotspot evasion gap, approved AI program design, and FREE-AI inventory documentation for India BFSI compliance teams.
Read more →New · AI Red Teaming · RBI India
AI Red Teaming for Indian Banks: Technical Playbook for RBI's 2026 Adversarial Testing Mandate
RBI's June 2026 FSR named AI-enabled attacks as India's #1 financial systemic risk. Technical playbook: adversarial testing for KYC chatbots, loan decisioning models, UPI payment agents, and fraud detection AI. Vernacular injection coverage, evidence format RBI inspectors expect, RAIDAR for SEBI entities.
Read more →New · RBI FREE-AI · India BFSI
RBI FREE-AI Framework: Complete Implementation Guide — 7 Sutras, 6 Strategic Pillars, 26 Recommendations
RBI's Framework for Responsible and Ethical Enablement of AI (August 2025) is the master India AI governance document. 7 Sutras, 26 recommendations mapped to bank and NBFC compliance obligations. Third-party AI vendor accountability, board AI policy requirements, innovation sandbox governance. No competitor has built this.
Read more →New · RBI Auth Directions · AI Fraud · Payments
RBI Authentication Directions 2025: AI Risk-Based Authentication and Fraud Scoring for India Digital Payments
RBI Authentication Directions (September 2025, effective April 2026) explicitly permit AI/ML risk scoring as an additional authentication factor — India's first regulatory permission for adaptive AI-driven payments authentication. MRMF validation requirements for authentication AI, behavioral biometrics DPDP compliance, cross-border CNP extension.
Read more →New · CERT-In · Frontier AI · RBI Directive
CERT-In Frontier AI Cybersecurity Advisory India BFSI: MeitY Threat Report 2025-26 and RBI June 2026 Directive
RBI's June 2026 directive required every regulated entity to complete a frontier AI risk assessment by a specific deadline. CERT-In's April 2026 advisory defines the threat landscape. MeitY-CSIRT-Fin Threat Report 2025-26: six of seven AI threat predictions already realized in India BFSI. No global vendor has covered any of this.
Read more →New · SEBI AI/ML · Algo Trading · Securities
SEBI AI/ML Guidelines for Indian Securities Markets: Complete Compliance Guide for Brokers and Algo Providers (2025–2026)
April 2026 compliance deadline passed. Pre-exchange approval required for all AI algo strategies. Non-delegable liability — broker accountable for third-party AI tools. Seven governance pillars including senior management accountability, fairness testing, DPDP alignment. SEBI inspection documentation requirements. No global AI governance vendor has covered this.
Read more →New · IRDAI WG-AI · Insurance · Health · Motor
IRDAI WG-AI 2026: What India's Insurance Companies Must Prepare Before the AI Governance Framework Lands
IRDAI constituted Working Group on AI on June 17, 2026 — chaired by IIIT Hyderabad, CERT-In member on committee. Recommendations due September 2026. Seven mandate areas including ethical AI for claims and underwriting, DPDP health data governance, deepfake defense, AI audit framework. Prepare before guidelines land.
Read more →New · NPCI · Sovereign AI · UPI Fraud · DPDP
NPCI Sovereign AI and UPI Fraud Model Governance: What India's Banks and Fintechs Must Do Now
NPCI-NVIDIA sovereign AI for India payments (Feb 2026). Federated FRM shares scores not data — DPDP compliant. PSS Act creates legal basis for NPCI AI mandates. RBI MRMF applies to NPCI-integrated AI at member banks. Who owns model risk when NPCI's fraud score is wrong? Zero global coverage.
Read more →New · SEBI · Portfolio Management · PMS · AI Governance · India
SEBI Portfolio Management Services AI Governance: PMS Regulations 2020 Discretionary Portfolio AI Sole Accountability, Suitability AI Explainability and Form BRA Attribution India
SEBI PMS Regulations 2020 and February 2025 AI/ML Accountability Circular — Rs 30 lakh crore AUM, sole accountability for AI-generated portfolio decisions, suitability AI explainability, Form BRA AI attribution, robo-PMS regulatory gap. No safe harbour for vendor AI.
Read more →New · IRDAI · Health Insurance · Cashless AI · 1-Hour SLA · India
IRDAI Health Insurance Master Circular 2024 AI Governance: Cashless Pre-Authorization AI 1-Hour SLA, Clinical Necessity AI Audit Trail and Claim Denial Explainability India
IRDAI Health Insurance Master Circular 2024 cashless AI 1-hour SLA mandate — clinical necessity AI audit trail void, claim denial explainability, 100% cashless direction, DPDP health data AI. Star Health, Niva Bupa, HDFC Ergo, ICICI Lombard.
Read more →New · SEBI · Portfolio Managers · PMS · AI Disclosure · Quantitative Strategies
SEBI Portfolio Managers Master Circular 2025 AI Governance: Mandatory AI Disclosure in PMS Disclosure Document, Sole Liability for AI Portfolio Decisions and SEBI Reporting for 400+ PMS Providers
SEBI/HO/IMD/IMD-POD-1/P/CIR/2025/104 (Jul 16, 2025) — mandatory AI/ML disclosure in PMS Disclosure Document, sole non-delegable liability for AI-driven investment decisions, SEBI reporting for all AI/ML systems. 400+ PMs managing ₹30L crore. Three-layer compliance stack. Zero global coverage.
Read more →New · IRDAI · Regulatory Sandbox · InsurTech · AI Pre-Approval
IRDAI Regulatory Sandbox Regulations 2025 AI Governance: Mandatory Pre-Deployment IRDAI Approval for AI Insurance Tools, Policyholder Protection and Sole Liability for InsurTech AI India
IRDAI Regulatory Sandbox 2025 (notified Jan 3, 2025) — mandatory IRDAI pre-deployment sanction for all AI/ML tools in insurance. AI underwriting, telematics, wearables, chatbot claims. Policyholder protection ongoing obligation. AI model immutability post-sanction. Sole entity liability. Zero global coverage.
Read more →New · RBI · IT Outsourcing · AI Vendors · Material IT Service · Banks · NBFCs
RBI IT Outsourcing Master Direction 2023: Data Analytics and Machine Learning as Material IT Service, Board Accountability for AI Vendors and Cloud AI Data Localization for Banks and NBFCs India
RBI/2023-24/102 (April 10, 2023, effective Oct 1, 2023) — AI/ML classified as Material IT Service; board accountability; pre-deployment due diligence; contractual audit rights; data localization for cloud AI. 700+ REs. Zero global coverage.
Read more →New · SEBI · CSCRF · Cybersecurity · SOC · Principle of Equivalence · All 10,000+ REs
SEBI CSCRF 2024 AI Governance: Five-Tier Cybersecurity Framework, SOC AI Mandate for Category 1–3 Entities and Principle of Equivalence for Dual-Regulated Banks India
SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 (Aug 20, 2024) + Dec 2024 clarification — five-tier AI cybersecurity; SOC AI/ML mandate; Principle of Equivalence for dual-regulated banks; parent framework for SEBI AI VA Advisory 2026. All 10,000+ REs. Zero global coverage.
Read more →New · SEBI · Stock Brokers · AI Audit · Annual System Audit · DMA · 13,000 Trading Members
SEBI Master Circular Stock Brokers 2025: Artificial Intelligence Added to Annual System Audit Scope, Digital Technology Monitoring and AI DMA Liability for 13,000 Trading Members India
SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/90 (Jun 17, 2025) — AI in annual system audit scope; digital monitoring platform; three-cycle auditor independence; algo AI half-yearly audit; DMA AI liability. 13,000 trading members. Zero global coverage.
Read more →New · RBI · Data Governance · DGF · Banks · NBFCs · BCBS 239 · AI Data Quality
RBI Data Governance Framework Draft Guidance 2026: Board-Level DGF, Data Quality for AI/ML Models, Single Source of Truth and BCBS 239 for All Banks and NBFCs India
RBI Draft PR 2026-2027/677 (Jul 15, 2026) — board DGF, quarterly data quality metrics for AI inputs, metadata and lineage for AI auditability, SSoT principle, third-party AI vendor accountability, BCBS 239 alignment. All 11 RBI entity categories. Upstream data layer for every AI model. Zero global coverage.
Read more →New · SEBI · MII · NSE · BSE · NSDL · CDSL · CTO CISO Independence · Technology Oversight
SEBI MII Governance Circular December 2025: CTO and CISO Functional Independence, Technology Audit Under CRiO and AI Oversight Architecture for NSE, BSE, NSDL, CDSL India
SEBI HO/47/12/11(5)2025 (Dec 12, 2025) — CTO/CISO functional independence from business units, technology audits under CRiO, two ED positions separating technology from compliance. AI oversight governance architecture for 8 MIIs. Prof. Phatak AI roadmap foundation. Zero global coverage.
Read more →New · SEBI · RTA · CAMS · KFin · Registrar · Transfer Agent · Chapter III-A · Investor Data
SEBI RTA Master Circular 2026 AI Governance: Chapter III-A Sole Liability, AI/ML Reporting and Investor Data Protection for CAMS, KFin and 200 RTAs Servicing 15 Crore Investor Accounts India
SEBI HO/38/13/(4)2026-MIRSD-POD/I/4298/2026 (Feb 6, 2026) — Chapter III-A AI obligations for all 200 RTAs; sole non-delegable liability for AI outputs and 15+ crore investor records; AI/ML reporting; KYC matching, SIP processing, fraud detection AI governance; DPDP Act compliance. Zero global coverage.
Read more →New · SEBI · CSCRF · Cybersecurity AI · SBOM · M-SOC · Vulnerability Detection
SEBI AI Vulnerability Detection Advisory 2026 CSCRF: AI-Based VA Tools Standard of Care, SBOM Mandate, M-SOC Onboarding and Cyber-Suraksha.ai Task Force for All 10,000+ SEBI Regulated Entities
SEBI HO/13/19/12(1)2026-ITD-1 (May 5, 2026) — AI-based VA tools as expected standard under CSCRF, mandatory SBOM for all critical applications, M-SOC onboarding, authorized AI cybersecurity tool governance, cyber-suraksha.ai task force. Distinct from SEBI AI/ML Responsible Usage Framework. Zero global coverage.
Read more →New · IFSCA · GIFT City · Frontier AI · Cybersecurity · SBOM · Agentic AI
IFSCA Frontier AI Cybersecurity Advisory 2026: SBOM Mandate, Agentic AI Security Planning and Frontier AI Risk Obligations for All GIFT City Regulated Entities India
IFSCA-CSD/MSC/3/2026-DCS (Jun 4, 2026) — binding SBOM mandate, frontier AI risk posture reassessment, authorized AI tool governance, agentic AI security planning for IBUs, FMEs, and all GIFT City entities. Distinct from RBI AI-ACT&RS. Zero global coverage.
Read more →New · IFSCA · GIFT City · TechFin · AI Licensing · Fit and Proper
IFSCA TechFin Ancillary Services Regulations 2025: First AI/ML Licensing Regime for GIFT IFSC — Mandatory Registration for AI Vendors, Fit and Proper Criteria and IFSCA Enforcement Jurisdiction
IFSCA/GN/2025/005 (Jul 8, 2025) — mandatory IFSCA registration for AI/ML, RegTech, Big Data Analytics vendors in GIFT City. Fit and proper criteria applied to AI key personnel. Code of Conduct. Transition deadline Jul 10, 2026. Zero global coverage.
Read more →New · SEBI · Chapter III-A · Intermediaries · Sole Liability · Gazette
SEBI Intermediaries AI Amendment Regulations 2025 Chapter III-A: Gazette-Notified Binding AI Obligations — Non-Delegable Sole Liability for AI Outputs and Scale-Independent Governance for All 10,000+ SEBI Intermediaries India
Gazette-notified Feb 6, 2025 (eff. Feb 10) — Chapter III-A inserts binding AI obligations into SEBI Intermediaries Regulations 2008. Sole non-delegable liability for AI outputs and investor data for all 10,000+ SEBI intermediaries. Scale-independent. Distinct from SEBI AI/ML Responsible Usage Framework. Zero global coverage.
Read more →New · RBI · AI-ACT&RS · GenAI · Cyber Threats · Banks · PSOs
RBI AI-ACT&RS Advisory 2026: Board AI Risk Gap Assessment, India's First Generative AI Banking Regulation and AI-Driven Deepfake Safeguards for All Banks and Payment System Operators
RBI AI-Accelerated Cyber Threats and Related Safeguards Advisory (Apr 2026 banks; Jun 2026 PSOs) — India's first RBI document naming Generative AI as a banking governance subject. Board-approved AI risk gap assessment by June 30, 2026. AI deepfake, voice-cloning, and synthetic identity supplementary controls. All commercial banks + non-bank PSOs. Zero global coverage.
Read more →New · IRDAI · Insurance Fraud · AI Detection · IIB Platform
IRDAI Insurance Fraud Monitoring Framework 2025 AI Technology: Mandatory IIB Platform Participation, Dynamic AI Red Flag Indicators and Board-Approved Anti-Fraud Policy for 55+ Insurers India
IRDAI/IID/GDL/MISC/112/10/2025 (Oct 2025, eff. Apr 1, 2026) — mandatory IIB centralized Fraud Monitoring Technology Framework enrollment for all 55+ insurers. Dynamic AI-assisted red flag indicators, Fraud Monitoring Committee technology mandate, board-approved Anti-Fraud Policy, annual FMR-1 returns. IIB platform unique to India. Zero global coverage.
Read more →New · SEBI · Investment Advisers · AI Disclosure · Regulation 18
SEBI Investment Advisers Second Amendment 2024 AI Disclosure: Mandatory Pre-Contract AI Tool Disclosure, Sole IA Liability and Regulation 18 Amendment for 1,300+ Registered Investment Advisers India
SEBI/LAD-NRO/GN/2024/219 (Dec 2024) — Regulation 18 structurally amended to mandate AI tool disclosure at advisory agreement stage. Which tools, which advisory stages, known limitations. IA sole liability for AI output accuracy and client data confidentiality. Retroactive disclosure to existing clients by April 30, 2025. 1,300+ IAs. Zero global coverage.
Read more →New · IRDAI · Motor Insurance · AI Telematics · PAYD · PHYD
IRDAI Motor Insurance AI Telematics Governance 2024: Mandatory PAYD/PHYD AI Pricing, Board-Approved AI Claim Settlement Policies and DPDP Telematics Data Obligations for 33 General Insurers India
IRDAI Master Circular General Insurance June 2024 + Policyholders Regulations 2024 — mandatory PAYD/PHYD AI telematics offering, board-approved AI claim assessment, AI app claims below ₹50,000 replacing mandatory surveyor. DPDP Act consent for continuous telematics data. 33 general insurers, 33+ crore registered vehicles. Zero global coverage.
Read more →New · SEBI · Algo Trading · AI Classification · Broker Liability
SEBI Retail Algo Trading AI Governance 2025: White-Box vs Black-Box AI Classification, Research Analyst Registration for Black-Box AI Algos and Broker Principal Liability for 1,500+ Stockbrokers India
SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013 (Feb 2025, eff. Apr 2026) — India's first AI model transparency classification. Black-box AI algos require SEBI Research Analyst registration; white-box algos fast-track. Broker principal liability for all AI algo outputs. Exchange kill-switch for AI algo IDs. 1,500+ stockbrokers. Zero global coverage.
Read more →New · SEBI · AMC · Mutual Funds · Market Abuse · AI Surveillance
SEBI AMC Institutional Mechanism 2024 AI Governance: AI Market Abuse Surveillance, Real-Time Front-Running Detection and Board-Approved AI Alert SOPs for 45 Mutual Fund Houses India
SEBI/HO/IMD/IMD-PoD-1/P/CIR/2024/107 (Aug 2024) — mandatory AI-powered market abuse surveillance for all 45 AMCs managing ₹67 lakh crore AUM. AI real-time monitoring of fund manager personal trades vs portfolio trades for front-running detection. Board-approved AI alert SOPs. CEO/MD and CCO non-delegable accountability. AMFI prescribes uniform AI standards. Zero global coverage.
Read more →New · RBI · IT Governance · Banks · NBFCs · AI Vendor Audit
RBI IT Governance Directions 2023 AI Governance: AI Model Inventory, Training Data Lineage, AI Vendor Due Diligence and Annual CERT-In Assurance Audit for 260+ Banks and NBFCs India
DoS.CO.CSITEG/SEC.7/31.01.015/2023-24 (effective April 2024) — foundational AI compliance layer for all Indian banks and NBFCs. Board-approved AI model inventory, AI vendor contractual audit rights, algorithmic change management for model updates, annual CERT-In audit of AI systems. ~260 entities, near-100% of banking assets. Zero global coverage.
Read more →New · RBI · Digital Lending · NBFCs · LSP AI · Feature Consent
RBI Digital Lending Directions 2025 AI Governance: Feature-Level Consent Audit Trail, LSP AI Non-Delegable Liability, DLA CIMS Registry and CCO Certification for 10,000+ NBFCs India
RBI/2025-26/36 (May 2025) supersedes 2022 Guidelines — new AI obligations: field-level consent audit trail linking each AI credit scoring feature to individual borrower consent, non-delegable RE liability for all LSP AI actions, anti-dark-pattern rules for AI multi-lender matching, mandatory DLA registration, CCO certification. 10,000+ NBFCs. Zero global coverage.
Read more →New · RBI · Payment Aggregators · Fraud AI · ML Monitoring · PMLA
RBI Payment Aggregators Directions 2025 AI Governance: Board AI Fraud Policy, Continuous ML Transaction Monitoring, FIU-IND PMLA AML AI and CERT-In Audit for 400+ Non-Bank PAs India
RBI/DPSS/2025-26/141 (September 2025) — first comprehensive PA framework. Board-approved IS policy covering AI fraud scoring, mandatory continuous ML merchant monitoring, FIU-IND PMLA registration creating AML AI obligations for non-bank PAs, annual CERT-In AI audit. ~400 non-bank PAs. Distinct from NPCI UPI coverage. Zero global coverage.
Read more →New · SEBI · Depository Participants · NSDL · CDSL · AI Disclosure
SEBI Master Circular for Depositories 2024 Section 2.9 AI Governance: Mandatory Quarterly AI/ML Disclosure via e-PASS, NSDL CDSL AI Model Inventory and Demat Account AI Reporting India
SEBI/HO/MRD/MRD-PoD-1/P/CIR/2024/168 Section 2.9 — mandatory quarterly AI/ML disclosure for all depository participants via SEBI e-PASS portal. NIL returns mandatory even with no AI deployed. 1,000+ registered DPs. Zero global coverage.
Read more →New · PFRDA · NPS · Pension Funds · CRA · AI Risk Management
PFRDA Information and Cybersecurity Policy Guidelines 2024 AI Governance: AI Risk Register, CISO-Led Board Accountability and Periodic AI Audit Obligations for NPS Pension Funds and CRAs India
PFRDA/2024/14/ICS/01 — first AI governance for India's pension sector. AI explicitly listed alongside cloud and APIs in ICSRM framework. CISO-led committee, board AI reporting, periodic AI audits for Protean CRA, KFin CRA, SBI/LIC/HDFC Pension Funds. 60M NPS subscribers. Zero global coverage.
Read more →New · RBI · Fraud Risk Management · AI EWS · Bias Testing · India
RBI Master Directions on Fraud Risk Management 2024 AI Governance: Mandatory AI/ML Early Warning Signal Framework, Explicit Model Bias Testing Obligation and Board-Approved AI Fraud Detection for Banks India
RBI Master Directions Fraud Risk Management July 2024 — mandatory AI/ML EWS deployment, explicit bias testing obligation (one of India's rarest algorithmic fairness requirements), board approval for AI fraud framework, independent AI audit. All banks, NBFCs, credit card issuers, payment aggregators. Zero global coverage.
Read more →New · RBI · Urban Cooperative Banks · UCB · MRMF · India
RBI Urban Cooperative Banks Governance Directions 2025 AI Model Risk: Board AI Accountability, MRMF Extension and Vendor Concentration Risk for 1,500 UCBs India
RBI UCB Governance Directions 2025 (November 2025) + MRMF 2026 extension to co-operative banks — board AI oversight, CBS vendor AI disclosure obligation, third-party validation, concentration risk governance. 1,500 UCBs, 8 crore depositors. Zero global coverage.
Read more →New · SEBI · Stockbrokers · AI Surveillance · Market Abuse · India
SEBI Stockbrokers Institutional Mechanism 2024 AI Market Surveillance Governance: Mandatory AI Fraud Detection, Compliance Officer Accountability and NSE Penal Action India
SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2024/96 (July 2024) — mandatory AI trading surveillance for ALL stockbrokers. Compliance officer AI accountability, mandatory whistle-blower escalation, NSE penal action. April 2026 deadline even for smallest brokers. 1,200+ stockbrokers.
Read more →New · SEBI · AI/ML Framework · Kill-Switch · All Intermediaries · India
SEBI AI ML Responsible Usage Framework 2025 AI Governance: Kill-Switch Mandate, Human Oversight and Senior Management Accountability for All Securities Intermediaries India
SEBI Guidelines for Responsible Usage of AI/ML in Securities Markets (June 2025 consultation, August 2026 final) — first comprehensive cross-market AI governance for ALL SEBI intermediaries. Kill-switch mandate, human oversight, non-delegable accountability. NSE half-yearly AI/ML reporting.
Read more →New · SEBI · Research Analysts · AI Research · Trading Calls · India
SEBI Research Analysts Third Amendment 2024 AI Governance: Mandatory AI Research Disclosure, AI Trading Call Accountability and Audit Trail India
SEBI RA Third Amendment 2024 and Circular Jan 2025 — first binding AI-generated financial research accountability obligation. Mandatory AI tool disclosure, full RA accountability for AI trading calls, audit trail for AI inputs and outputs. 1,500+ RAs.
Read more →New · SEBI · Investment Advisers · Robo-Advisory · AI Disclosure · India
SEBI Investment Advisers Second Amendment 2024 AI Governance: Mandatory AI Disclosure, Robo-Advisory Sole Accountability and MITC AI Disclosure India
SEBI IA Second Amendment 2024 (December 2024) — India's first sector-specific AI disclosure obligation for investment advisers. Sole accountability for AI-generated advice, MITC AI disclosure for robo-advisors, no vendor safe harbour. 1,400+ SEBI IAs.
Read more →New · RBI · Digital Lending · Algorithmic Underwriting · LSP · India
RBI Digital Lending Guidelines 2022 AI Governance: Algorithmic Underwriting Accountability, LSP AI Liability and Credit Scoring Explainability India
RBI/2022-23/111 September 2022 — credit algorithms must be auditable and trained on non-discriminatory data. RE bears full accountability for LSP fintech AI decisions. KFS explainability for AI-dynamic pricing, borrower profiling consent under DPDP Act. 1,000+ NBFCs.
Read more →New · RBI · FREE-AI · Responsible AI · 7 Sutras · India
RBI FREE-AI Framework 2025: 7 Sutras, 26 Recommendations and Governance Blueprint for Responsible Ethical AI in India's Financial Sector
RBI FREE-AI Committee Report August 2025 — 7 Sutras guiding principles, 26 actionable recommendations, board-approved AI policy mandate, AI-specific vendor contract clauses, India-trained model bias assessment, AI audit mechanisms distinct from IT audits.
Read more →New · SEBI · Intermediaries · AI Liability · Securities Market · India
SEBI Intermediaries Amendment Regulations 2025 AI Liability Governance: Sole Accountability for AI Tool Outputs and India's First AI Liability Rule for Securities Market
SEBI Intermediaries Amendment 2025 — India's first direct AI liability rule for securities market, sole accountability for AI outputs, no third-party vendor safe harbour, AI audit trail obligation for 9,000+ SEBI entities. Brokers, AMCs, depositories, exchanges.
Read more →New · RBI · MRMF · Model Risk Management · Killswitch · India
RBI Model Risk Management Framework 2026 AI Governance: Board-Approved MRMF, Killswitch Mandate, Bias Testing and Explainability for AI/ML India
RBI Draft MRMF 2026 — first enterprise-wide AI/ML governance mandate for Indian banks and NBFCs: board-approved MRMF, killswitch capability, bias testing across demographic and credit segments, explainability, independent validation, third-party AI vendor obligations.
Read more →New · IRDAI · Insurance Fraud · Behavioural Analytics · Deepfake · India
IRDAI Insurance Fraud Monitoring Framework Guidelines 2025 AI Governance: Behavioural Analytics Mandate, FMR-1 Annual Return and Deepfake Defense India
IRDAI Fraud Monitoring Framework 2025 — India's first explicit AI capability mandate (behavioural analytics), Fraud Monitoring Cell AI governance, FMR-1 return AI data, deepfake defense for V-CIP and claims, IIB cross-insurer fraud AI pipeline.
Read more →New · RBI · Payment Aggregator · Fraud AI · India
RBI Payment Aggregator Master Direction 2025 AI Governance: Fraud Detection AI, Merchant Onboarding AI and Transaction Monitoring India
RBI PA Master Direction 2025 AI governance — fraud detection AI explainability for merchant adverse action, transaction monitoring audit trail, merchant onboarding AI PMLA intersection, PA-Cross Border AI, killswitch void. PhonePe, Razorpay, PayU.
Read more →New · IFSCA · TechFin · GIFT City · AI Governance
IFSCA TechFin Ancillary Services Regulations 2025 AI Governance: GIFT City IFSC TechFin AI Model Risk Void and Conduct Code Gap India
IFSCA TechFin Regulations 2025 AI governance — TechFin AI model risk void, no explainability or model validation standard, IFSCA 2026 AI Survey governance maturity gap. GIFT City IFSC fintech AI compliance. Zero global coverage.
Read more →New · SEBI · Mutual Fund · AMC · AI/ML Reporting
SEBI Mutual Fund AI ML Reporting Circular 2019 Governance Gap: AMC Quarterly Inventory, Portfolio AI Explainability Void and SEBI 2025 Consultation Paper India
SEBI Circular SEBI/HO/IMD/DF5/CIR/P/2019/63 AI governance — quarterly AI/ML inventory for all AMCs, explainability void for investor-facing fund AI, no model validation standard, SEBI June 2025 consultation paper escalation.
Read more →New · SEBI · Clearing Corporation · CCIL · AI Governance
SEBI Clearing Corporation AI Governance: CCIL NSE Clearing VaR AI, Default Prediction AI and Settlement Guarantee Fund India 2026
SEBI SE&CC Regulations 2018 AI governance — AI VaR model SGF adequacy, counterparty default prediction AI suspension protocol, trade compression settlement finality, cross-CCP information barrier for AI surveillance, BCP AI failover.
Read more →New · RBI · HFC · PMAY · AI Governance · India
RBI Housing Finance Company HFC AI Governance: Automated Valuation Model LTV, PMAY Credit AI and Disbursement Fraud Detection India 2026
RBI HFC Master Directions 2021 AI governance — AVM LTV compliance, PMAY-CLSS credit AI adverse action, disbursement fraud AI explainability, EMI reset audit trail, co-lending concentration limits. LIC Housing Finance, PNB Housing.
Read more →New · IRDAI · Life Insurance · Products Regulations 2024 · AI
IRDAI Life Insurance Products Regulations 2024 AI Governance: Appointed Actuary AI Model, Claim Settlement Automation and Surrender Value India
IRDAI Life Products Regulations 2024 AI governance — Appointed Actuary AI mortality model sign-off gap, learned exclusion vs product filing lock, claim settlement AI 15/30-day SLA audit trail, surrender value GMSV regression testing.
Read more →New · DPDP Act · SDF · AI Governance · India
DPDP Act 2023 Significant Data Fiduciary AI Governance for India BFSI: DPIA, Purpose Limitation, Model Unlearning and Cross-Border Vendor Risk 2026
DPDP Act Section 16 SDF obligations for BFSI AI — mandatory DPIA before ML model deployment, purpose limitation vs emergent ML feature discovery, right to erasure vs model unlearning, cross-border AI vendor restrictions, legacy consent adequacy for ML training data.
Read more →New · SEBI · Commodity Derivatives · MCX · NCDEX
SEBI Commodity Derivatives AI Governance: MCX NCDEX Algo Trading AI Classification, Surveillance Model Drift and Agricultural Price Discovery AI India 2026
SEBI CDMRD AI governance for commodity exchanges — AI algo classification gap (satellite/weather data strategies), real-time surveillance AI model drift liability, position limit AI false-negative, agri AI under Essential Commodities Act, cloud AI vendor MII governance.
Read more →New · RBI · NBFC · Scale Based Regulation · Upper Layer
RBI Scale Based Regulation NBFC AI Governance: Upper Layer NBFC Credit AI, ICAAP Model Validation Gap and PCA Trigger Risk India 2026
SBR Master Direction 2023 AI governance for Upper Layer NBFCs — Board AI oversight Clause 73, ICAAP credit model validation gap, liquidity AI stress testing, PCA threshold sensitivity from ML underwriting. Bajaj Finance, Shriram Finance, L&T Finance.
Read more →New · RBI · Acquiring Bank · MRMF · Card Payments
RBI Merchant Acquiring Bank AI Governance: MRMF, Chargeback Prediction AI, CoFT Tokenisation Transition and White-Label Acquiring India 2026
Card Master Direction 2022 + MRMF acquiring AI governance — merchant onboarding AI MRMF+PMLA intersection, CoFT tokenisation AI retraining obligation, chargeback prediction AI NPCI evidentiary standard, white-label acquiring AI model ownership gap. Distinct from non-bank PA governance.
Read more →New · IRDAI · Motor Insurance · Telematics · UBI
IRDAI Motor Insurance Telematics AI Governance: MISP Distribution Chain, UBI Driving Score Explainability, IIB FAB Score and DPDP Act India 2026
IRDAI motor telematics AI governance — MISP chain AI accountability, WG-AI 2026 driving score explainability obligation, telematics AI product filing re-trigger, IIB FAB score third-party AI governance gap, DPDP consent withdrawal mid-policy. Zero global coverage.
Read more →New · SEBI · Stockbroker · Smart Order Routing · Clause 26
SEBI Stockbroker AI Governance: Smart Order Routing AI Ownership, Clause 26 System Audit Gap, DMA Client AI Liability and Kill-Switch Restart Obligations India 2026
SEBI broker Clause 26 audit covers AI OMS but with no AI methodology. SOR AI model ownership fragmented across exchanges. DMA broker bears SEBI liability for client-side AI. Kill-switch restart governance is a regulatory void. Quarterly AI monitoring absent for brokers.
Read more →New · NPCI NACH · Mandate AI · Batch Payments
NPCI NACH AI Governance: Mandate Fraud Detection, Batch Payment AI and RBI MRMF Obligations India BFSI 2026
NACH mandate fraud AI under MRMF Clause 4.2. DMS return-code AI audit trail obligation. FIU-IND AML for high-value recurring mandates — distinct from UPI surveillance. RBI PSO audit false-positive rate documentation. MRMF change management triggered by NPCI limit revision circulars.
Read more →New · RBI IOS 2021 · Grievance AI · MRMF
RBI Integrated Ombudsman Scheme 2021 AI Governance: Complaint Response AI Legal Liability, Triage Model MRMF Obligations and DPDP Training Restrictions
LLM-generated reasoned written reply carries adverse inference risk in ombudsman adjudication. Complaint triage AI misclassification breaches 30-day IOS clock. AI decision logs discoverable in award proceedings. DPDP Act restricts training on complaint corpus. IOS 2021 covers NBFCs and PSOs.
Read more →New · SEBI FPI · Surveillance AI · FUTP
SEBI FPI AI Governance: Foreign Portfolio Investor Circular Trading Surveillance, Beneficial Ownership AI and FUTP Enforcement Evidence Standards India 2026
Custodian circular trading AI must meet FUTP evidentiary standard — deterministic, version-controlled, reproducible. Look-through BO AI must be SEBI-inspection-explainable. Concentration limit AI faces dual MRMF+SEBI system audit governance. SEBI adjudication orders since 2022 cite AI findings as enforcement evidence.
Read more →New · IRDAI · Bima Sugam · Insurance AI
IRDAI Bima Sugam Insurance Distribution AI Governance: Marketplace Algorithm, Chatbot Suitability and AI Premium Pricing 2026
Bima Sugam Regulation 10: non-conflicting AI product ranking. Chatbot as licensed intermediary — suitability AI governance. AI premium pricing actuarial certification of model outputs. India Stack DPDP+IRDAI dual KYC compliance. IRDAI WG-AI adversarial testing for distribution AI.
Read more →New · RBI PPI · Wallet AI · Fraud Scoring
RBI PPI Master Directions 2021 AI Governance: Wallet Fraud Scoring, Velocity Check AI and Full-KYC Upgrade Obligations
Full-KYC V-CIP AI liability falls on PPI issuer. Velocity check AI is MRMF material decision model. 2024 amendment: AI model ownership delineation in co-branding agreements. DPIP signal integration explainability obligation. DPDP data minimisation for behavioral profiling.
Read more →New · RBI IRRBB · ALM · Treasury AI
RBI IRRBB AI Model Governance: Interest Rate Risk Banking Book, ALM Behavioural Models and MRMF Obligations India 2026
IRRBB behavioural deposit/prepayment AI models are MRMF-classified quantitative models. Dual IRRBB+MRMF validation records required. AI scenario generation outside RBI shock bounds requires board approval. Capital understatement from AI error is Pillar 2 breach. November 2025 RRB extension.
Read more →New · RBI KYC · V-CIP · Deepfake · e-KYC
RBI KYC Master Direction V-CIP AI Governance: Deepfake Detection Obligations and Aadhaar e-KYC Model Performance Standards
RBI KYC MD explicitly mandates AI for V-CIP: "face liveness/spoof detection at high degree of accuracy" — a model performance obligation under MRMF. Deepfake bypass of DigiLocker/e-KYC documented. CKYC upload AI governance. Third-party V-CIP vendor full liability on RE. INDIC-BIAS for liveness false rejection rates.
Read more →New · SEBI · Robo-Advisory · IA Regulations · Suitability
SEBI Investment Advisers Regulations 2013: Robo-Advisory AI Governance, Suitability Obligations and Mis-Selling Liability
SEBI IA Regulations apply technology-neutrally to AI robo-advisors — confirmed since 2016. Per-client suitability documentation obligation at scale. Conflict-of-interest embedded in commission-era training data. SEBI algorithm inspection authority. 2024 AI finfluencer enforcement precedent. Consumer Protection Act 2019 mis-selling liability.
Read more →New · RBI P2P · NBFC-P2P · Credit Matching · MRMF
RBI NBFC-P2P Lending AI Governance: Non-Discriminatory Credit Matching Algorithm and August 2024 Amendment Obligations
August 2024 amendment requires board-approved non-discriminatory lender-borrower matching algorithm — unique globally. MRMF applies to P2P credit assessment AI. Closed-user-group prohibition creates AI origination-channel independence obligation. T+1 disbursement AI SLA governance. Guaranteed-return prohibition for AI-marketed products.
Read more →New · Co-Lending · MRMF · NBFC-Bank
RBI Co-Lending Arrangements Directions 2025 AI Governance: Joint Credit Model Accountability Under MRMF
Co-Lending Directions 2025 (eff. January 2026) create dual-board AI model ownership ambiguity. MRMF Section 7 applies when bank relies on NBFC's AI credit model. NPA cascade from one RE's AI model forces partner's book. Which RE validates the blended-rate model? No guidance exists anywhere.
Read more →New · Account Aggregator · FIU · DPDP · MRMF
Account Aggregator AI Governance India: FIU Credit Model Obligations, Consent-Scope Drift, DPDP–MRMF Intersection
AA framework crossed 100M consents. FIUs using AA data in AI credit models face three unaddressed gaps: consent-scope drift in AI retraining (DPDP Section 6 violation risk), model drift when training data is consent-revocable, and FIU AI obligations under NBFC-AA Directions 2025.
Read more →New · MSME · PSB 59 Minutes · TReDS · CGTMSE
India MSME Credit AI Governance: PSB 59 Minutes Portal, TReDS Invoice Fraud AI, CGTMSE Guarantee Stack
Rs 52,300 crore under digital CAM April–December 2025. MRMF Section 7 applies to PSBs using 59 Minutes portal AI — SIDBI model accountability unresolved. TReDS AI governance absent from RBI 2014 Guidelines. CGTMSE has no model audit rights. Multi-ministry data governance (CBDT, GSTN, MCA21).
Read more →New · RBI DL Guidelines · LSP · DLA
RBI Digital Lending Guidelines 2022 AI Governance: LSP Algorithmic Audit, DLA Data Restrictions, Credit Scoring Disclosure
2,000+ RBI-regulated digital lenders must comply. Para 8: RE retains AI credit decision accountability even when LSP model decides. Para 10: DLA data collection restrictions for AI features. Para 15: algorithmic credit scoring disclosure. MRMF validation required for LSP AI models.
Read more →New · PMJDY · Jan Dhan · DBT · PSU Banks
PMJDY Financial Inclusion AI Governance: Jan Dhan Overdraft Scoring, DBT Fraud Detection, PMJJBY Claim AI at PSU Banks
530+ million Jan Dhan accounts. AI governs BSBDA overdraft scoring, DBT fraud detection, dormancy prediction, and PMJJBY automated claim processing at PSU banks. RBI MRMF applies. False positives deny vulnerable beneficiaries access to the financial inclusion safety net.
Read more →New · RBI Sandbox · RBIH · Fintech Cohort
RBI Regulatory Sandbox AI Governance: Fintech Cohort AI Model Compliance and RBIH Innovation Framework
The RBI sandbox does not exempt participants from AI governance. MRMF Sections 2 and 3 apply inside the sandbox. Cohort 6 MSME lending AI documentation requirements. Cohort 7 preparation with agentic AI governance emphasis. Exit governance package requires production-scale validation.
Read more →New · AML · PMLA · FIU-IND
AI AML Transaction Monitoring India BFSI: PMLA Section 12, FIU-IND STR Obligations, and False-Positive Governance
Every scheduled commercial bank runs AI-driven transaction monitoring for PMLA compliance. AI-generated STRs must be explainable to FIU-IND. RBI de-risking risk guidance creates a false-positive governance imperative. No global AI governance vendor has mapped this India-specific framework.
Read more →New · Model Drift · RBI MRMF · PSI/CSI
AI Model Drift Detection India Banking: RBI MRMF Section 6, PSI/CSI, and Champion-Challenger Testing
RBI MRMF Section 6 requires ongoing performance monitoring — not just deployment validation. PSI and CSI are the metrics Indian banks and CIBIL use to measure population shift. COVID moratorium, rate cycle, and UPI penetration cause structural drift that destroys model validity faster than in stable markets.
Read more →New · Chatbot Governance · RBI · IRDAI
Conversational AI Chatbot Governance India Banking: RBI No-Credit-Commitment Rule, IRDAI Digital Distribution, and Consumer Protection Act
India bank chatbots face three regulatory layers simultaneously: RBI prohibits AI committing to credit terms, IRDAI Digital Distribution Regulations 2024 mandate insurance AI disclosures, and Consumer Protection Act 2019 creates civil liability. RBI Ombudsman now adjudicates AI chatbot complaints.
Read more →New · RAG Security · India BFSI
RAG Corpus Poisoning India BFSI: Indirect Prompt Injection via CKYC, Regulatory Libraries, and CBS Documentation
Indian banks index RBI Master Directions, CKYC records, and CBS vendor manuals into RAG systems — precisely the document types adversaries target for persistent indirect prompt injection. RBI MRMF Section 5 data management obligations, DPDP Act cross-tenant retrieval exposure, and corpus integrity controls for India BFSI.
Read more →New · XAI · RBI MRMF · Credit AI
Explainable AI for Credit Decisions: Meeting RBI MRMF Section 4 Obligations with SHAP and LIME
"The model decided" is not acceptable to RBI. MRMF Section 4 requires instance-level explainability for every material credit decision, generated at inference time and logged as part of the decision audit trail. SHAP format, adverse action notice generation, and the interpretability threshold for high-consequence decisions.
Read more →New · AI Supply Chain · RBI MRMF
AI Supply Chain Attacks India BFSI: Model Weight Poisoning and RBI MRMF Third-Party Accountability
Over 100 malicious ML models catalogued on model hubs in 2026. Indian banks using open-source foundation models face pre-training data poisoning, backdoor artifacts, and third-party API dependency risk — all in scope of RBI MRMF's independent validation and concentration risk obligations.
Read more →DPDP Act · AI Security
DPDP Act 2023 and LLM Data Exfiltration: AI Security Obligations India BFSI Cannot Ignore
KV Cache cross-tenant leakage, RAG retrieval exposure, and training data memorization — each triggers DPDP Act breach notification, storage limitation, and consent obligations. No global competitor covers this intersection. Includes compliance checklist across lawful basis, security safeguards, breach detection, and data residency.
Read more →Agentic AI Security · India BFSI
Agentic AI Security India BFSI 2026: Prompt Injection in UPI Fraud Detection and Credit Decisioning Agents
Tool-call hijacking in UPI payment agents, prompt injection via transaction metadata, CIBIL agent memory poisoning, multi-agent privilege escalation. India-specific amplifiers: vernacular injection evasion, Aadhaar eKYC exposure, UPI volume scale. First dedicated India BFSI agentic AI security analysis. RBI FREE-AI + NPCI UAP controls mapped.
Read more →AI Security · OWASP LLM
OWASP LLM Top 10 for BFSI India 2026: Banking-Specific Risk and Control Guide
OWASP LLM Top 10 mapped to India BFSI: prompt injection in banking chatbots, PII exfiltration, KV Cache cross-tenant leakage, excessive agency in agentic payments. Each vulnerability cross-referenced to RBI MRMF, FREE-AI, SEBI, DPDP Act, and NPCI UAP obligations. Priority matrix for India deployments included.
Read more →SEBI · Capital Markets
SEBI AI Kill-Switch 2026: Technical and Governance Implementation Guide for India's Capital Markets
SEBI's kill-switch mandate is not an on/off switch. This guide covers the 4-layer architecture (halt, isolation, rollback, fallback), trigger taxonomy for trading/advisory/surveillance AI, RAIDAR readiness, and the test evidence SEBI inspectors will demand. Includes SEBI vs RBI MRMF dual-regulator comparison.
Read more →SEBI · Algo Trading
SEBI Algo Trading 2026: When AI Triggers the Kill Switch
SEBI mandates kill switches. The unsolved governance question: when the trigger logic is AI-driven, that trigger AI is itself a high-stakes model requiring documentation, independent validation, historical backtesting, explainability, and its own kill switch. Regulation 16C makes the broker solely accountable. First dedicated analysis.
Read more →RBI · IT Governance
RBI IT Governance Master Direction 2023: AI Oversight, Vendor Disclosure, and the Three-Layer Matrix
India's third AI governance framework for banking — and the least analyzed. IT Direction November 2023 (effective April 2024) contains explicit AI provisions predating MRMF and FREE-AI. Mapped together: three layers, three functions, one compliance program to build. First dedicated analysis.
Read more →NABARD · Rural Credit
NABARD AI Governance 2026: Rural Credit Scoring, RRB Obligations, and Fairness for 700M Borrowers
KCC Directions January 2027 enable AI credit scoring for agricultural loans — MRMF simultaneously requires governance of those AI models. 43 RRBs, 700M rural borrowers, highest SC/ST concentrations in India. The fairness challenge is the largest unaddressed AI governance problem in Indian banking. First dedicated NABARD AI governance analysis.
Read more →Cross-Border · MRMF
Foreign Banks in India: RBI MRMF Plus Home-Country AI Governance Conflicts
The cross-border dual compliance challenge: one AI governance program must satisfy both RBI MRMF (India examination) and the home-country AI regulator (EU AI Act, OCC, MAS). Where they conflict — India fairness, data localization, explainability standards — the higher bar governs. First dedicated analysis.
Read more →RBI · Account Aggregator
RBI Account Aggregator AI Governance: DEPA, MRMF Obligations, and DPDP Purpose Limits
India's AA framework enables consent-based financial data for AI credit scoring. But who governs the AI? MRMF binds the FIU (bank/NBFC), DPDP limits purpose, consent artefact machine-readability is a new system requirement. First dedicated AA AI governance analysis.
Read more →RBI · Co-Lending
RBI FLDG AI Governance: The Co-Lending Model Accountability Gap
India's most structurally unresolved AI governance gap: the bank owns the FLDG exposure and the regulatory accountability; the fintech owns the AI credit model. MRMF examination will ask for validation documentation for a model the bank does not own and cannot audit. Build governance now before examination exposes the gap.
Read more →RBI · Data Localization
RBI Payment Data Localization and AI Model Training: Six Scenarios for Indian Banks
No RBI circular says model weights trained on payment data are exempt from the 2018 localization requirement. Indian banks training AI on global infrastructure face unresolved legal exposure. Six-scenario analysis: which pipelines are compliant, which are ambiguous, which are likely violations.
Read more →IFSCA · GIFT City
IFSCA AI Governance GIFT City 2026: Three Instruments Already in Force
IFSCA's three AI governance instruments are already in force. A comprehensive framework — model governance, fairness, explainability — is forthcoming. GIFT City entities that build compliance now against the June 2026 circular and MRMF will present a program, not a gap list, when the full framework issues.
Read more →RBI MRMF · GenAI
RBI MRMF 2026 GenAI: Six Explicit Provisions, Zero Agentic AI Coverage
MRMF June 2026 names hallucination, prompt injection, red-teaming explicitly — most specific GenAI governance framework in India banking. But agentic AI governance is entirely absent. Indian banks deploying autonomous agents must extend MRMF's GenAI framework or face examination with no governance documentation.
Read more →RBI · Payment Aggregators
RBI Payment Aggregator AI Governance: The Unaddressed Compliance Gap
India's most underanalyzed AI governance gap: PAs deploy fraud detection, merchant scoring, and AML AI without a binding governance framework. PA Directions say "adequate fraud systems" — MRMF may not apply. First dedicated analysis.
Read more →SEBI · AI Guidelines
SEBI AI/ML Guidelines 2026: Kill Switch, Human Oversight, and Tiered Risk Rules
SEBI's first comprehensive AI/ML governance framework is taking shape: Regulation 16C already binding, algo Algo-ID mandatory, kill switch and tiered rules announced. Full four-year regulatory stack decoded. Zero competitor coverage.
Read more →IRDAI · Insurance AI
IRDAI AI Working Group June 2026: India's First Insurance AI Framework
IRDAI formed India's first dedicated AI governance working group June 2026. ReBIT and CERT-In membership signals alignment with banking frameworks. Three-month mandate: AI adoption assessment, ethical AI, cybersecurity, stress testing, audit framework for all five insurance AI use case categories.
Read more →AI Fairness · India
India AI Fairness in Banking: Proxy Discrimination and the INDIC-BIAS Challenge
INDIC-BIAS (AI4Bharat / IIT Madras / IISc, ACL 2025): 85 identity groups, 1,800+ socio-cultural topics, 20,000 scenario templates — all 14 LLMs evaluated showed strong negative biases against marginalized Indian identities. Five proxy discrimination channels for banking AI: pincode (caste proxy), language (community proxy), counterparty names (religious proxy), device tier (socioeconomic/caste), occupational category (jati). International fairness benchmarks (BBQ, WinoBias, EU AI Act) cannot detect India's proxy discrimination. RBI FREE-AI Fairness and Equity Sutra requires India-specific testing with India-specific demographic data.
Read more →RBI · Cooperative Banks
AI Governance for Urban Cooperative Banks: MRMF Scope and Tier Proportionality
RBI FREE-AI explicitly acknowledges limited AI penetration in UCBs. MRMF 2026 applies to Urban and Rural Co-operative Banks — vendor AI in CBS and fintech integrations is in scope. RBI 2026-27 supervisory agenda: Supervisory Data Quality Index for Tier 3–4, risk-based supervision migration, enhanced IT examination coverage. Four tiers from ₹100 crore to ₹10,000+ crore deposits. Cooperative governance: dual RBI + Registrar jurisdiction, member demographic fairness, PMLA AML AI, UCB Governance Directions 2025.
Read more →MeitY · India AI
MeitY India AI Governance Guidelines 2025: Seven Sutras and What Banks Must Do
MeitY published India's national AI Governance Guidelines November 5, 2025 under IndiaAI Mission, explicitly adapting RBI FREE-AI's Seven Sutras (August 2025). Two complementary frameworks now: RBI FREE-AI (7 sutras, 26 recommendations, 6 pillars — BFSI-specific, mandatory-adjacent) and MeitY Guidelines (November 2025, cross-sectoral, voluntary). Three new institutions: AIGG (AI Governance Group), TPEC (Third Party Evaluation Committee), India AI Safety Institute. Banks satisfying RBI FREE-AI are automatically aligned with MeitY national framework — identical conceptual DNA.
Read more →Climate Risk AI · India Banking · RBI Mandatory FY2026 · CRIS · ESG AI MRMF
Climate Risk AI in India Banking: RBI Mandatory Disclosure and ESG MRMF Scope
RBI mandatory climate disclosure FY2026: governance, strategy, risk management (metrics/targets from FY2028). India CRIS live 2025. Six ESG AI use cases all in MRMF scope: climate stress testing, green credit risk scoring, CRIS physical risk, financed emissions, green taxonomy classification, portfolio alignment AI. India GSS+ debt USD 55.9B (+186%). Agricultural credit AI climate risk. RBI SEBI BRSR dual-jurisdiction ESG AI governance.
Read more →Agentic AI · India BFSI · RBI MRMF · Know Your Agent · HDFC Kotak SBI
Agentic AI Governance India BFSI: Know Your Agent and the MRMF Vacuum
Indian banks deploying agentic AI at pace: HDFC 5 use cases live + 14 in development, Kotak 20-25 standalone agents. RBI MRMF applies — no SR 26-2-style exclusion. SBI Chairman's Know Your Agent (KYA) framework: identity, authentication, consent, transaction limits, revocation. DPDP Act consent for agentic data access. Authorization boundary monitoring. Multi-step audit trail. Kill switch. India's agentic AI governance gap explained.
Read more →CERT-In · AI Cybersecurity Blueprint · May 2026 · 12-Hour Mandate · xBOM · Adversarial Testing
CERT-In AI cybersecurity blueprint 2026: 12-hour patch mandate, AI-assisted vulnerability governance, xBOM AIBOM supply chain, adversarial AI testing mandate, and RBI MRMF convergence for Indian banks
CERT-In Blueprint May 25, 2026: India's first guidance treating AI as both attacker tool and attack surface. 12-hour containment for internet-facing AI vulnerabilities; 9 core defensive principles including xBOM (AIBOM), adversarial testing mandate, assume-breach, zero trust, formal AI governance as security control. 2.9M cyberattacks FY2026 (double FY2022). CERT-In Blueprint + RBI MRMF convergence: same AIBOM satisfies both, same adversarial testing satisfies MRMF validation, same kill switch satisfies both isolation requirements.
Read more →RBI · Payments Vision 2028 · DPIP · NPCI FiMI · UPI Fraud AI
RBI Payments Vision 2028 AI governance: Digital Payment Intelligence Platform, UPI fraud AI, NPCI FiMI, shared responsibility framework and responsible payments AI deployment India
RBI Payments Vision 2028 (March 27, 2026): "AI-led, data-driven" payments roadmap. Digital Payment Intelligence Platform: RBI-operated AI/ML fraud detection announced at FIBAC 2026 — makes RBI an AI operator. NPCI FiMI finance AI model serving 1M+ users. ₹805 crore UPI fraud FY2026. Shared responsibility framework creates fraud AI liability stakes. Kill Switch AI override obligations. RBI MRMF applies to DPIP integration, fraud AI, AML AI, cross-border payments AI.
Read more →US Treasury · FS AI RMF · 230 Controls · AI Lexicon · NIST Aligned
US Treasury financial services AI risk management framework 2026: 230 control objectives, AI Lexicon, NIST AI RMF alignment, SR 26-2 interaction, India BFSI global alignment
US Treasury published FS AI RMF February 19, 2026: 230 AI control objectives across Govern, Map, Measure, Manage; AI Lexicon standardizing 100+ definitions; shaped by 108 financial institutions; NIST AI RMF aligned; soft law with examiner weight. SR 26-2 interaction: Treasury FS AI RMF fills agentic AI gap SR 26-2 explicitly excludes. India BFSI crosswalk: RBI MRMF and Treasury FS AI RMF both NIST-structured; US banks in India, India banks in US dual-jurisdiction governance.
Read more →NBFC-MFI · India Microfinance · RBI MRMF · Grameen Credit Score · JLG SHG AI
AI governance NBFC MFI microfinance India 2026: RBI MRMF scope, Grameen Credit Score AI, JLG SHG group lending fairness, alternative credit scoring governance for 80 million borrowers
RBI MRMF explicitly includes NBFC-MFIs. India microfinance sector: 80M borrowers, ₹4 lakh crore GLP, 82 NBFC-MFIs. Grameen Credit Score (Budget 2025-26): JLG/SHG alternative credit AI governance, group vs individual fairness, proxy discrimination testing. Collections AI: distress detection, fair practices compliance. DPDP Act microfinance borrower data governance. CreditAccess Grameen, Bandhan Bank, Ujjivan SFB MRMF compliance timelines.
Read more →FSB · 12 Sound Practices · AI June 2026 · Agentic AI Safeguards
FSB sound practices AI financial institutions 2026: 12 practices responsible AI adoption, AI concentration risk, agentic AI safeguards, third-party AI supply chain
FSB June 10, 2026 consultation: 12 sound practices for responsible AI adoption. Domain 1: organization-wide AI governance (board oversight, accountability, ERM integration, adaptability). Domain 2: AI lifecycle (materiality, model selection, data governance, explainability, performance, human oversight). Domain 3: AI cyber, ICT, third-party supply chain concentration. Agentic AI safeguards; 88% LLM API spend in 3 providers concentration risk; final report October 2026.
Read more →SEBI · India Securities · Algo AI · Robo-Advisory · 2026
SEBI AI governance securities India 2026: responsible AI guidelines, algorithmic trading AI, NSE BSE AI surveillance, and robo-advisory compliance
SEBI chair announced responsible AI guidelines for Indian securities market 2026. Retail algo trading AI April 2026 framework. NSE BSE AI pre-approval for all algo strategies. Robo-advisory SEBI IA regulations suitability AI governance. DPDP Act investor data AI. SEBI-IOSCO-FSB alignment. NSE world's largest derivatives exchange; 140 million demat accounts; India fintech AI (Zerodha, Groww, Angel One).
Read more →SR 26-2 · Federal Reserve · OCC · FDIC · Model Risk 2026
SR 26-2 AI model risk banking 2026: Federal Reserve OCC FDIC joint guidance supersedes SR 11-7, agentic AI governance gap, CSBS September 2026
SR 26-2 April 2026 supersedes SR 11-7 after 15 years. Generative and agentic AI explicitly outside scope — "novel and rapidly evolving." What changed: broader model definition, strengthened third-party AI governance, ongoing monitoring for AI drift. CSBS September 2026 doesn't exempt agentic AI. Applying SR 26-2 to agentic AI today: inventory architecture, authorization boundary validation, multi-step monitoring, LLM vendor governance.
Read more →MAS · Singapore · FEAT Principles · AI Risk Management 2026
MAS AI governance banking Singapore 2026: AI Risk Management Guidelines, FEAT principles upgraded to supervisory expectations, AI Operationalisation Handbook
MAS AI Risk Management Guidelines consultation November 2025; Toolkit and Operationalisation Handbook March 2026. FEAT principles (Fairness Ethics Accountability Transparency) upgraded from aspirational to supervisory-ready. Six governance components: board accountability, materiality classification, model lifecycle, explainability, third-party vendor, incident management. India-Singapore banking (SBI Singapore, Indian fintech MAS-licensed, DBS India cross-border AI governance).
Read more →FCA · Mills Review · Consumer Duty AI · UK Banking
FCA AI governance banking 2026: Mills Review, Consumer Duty AI obligations, SM&CR accountability, and UK financial services AI compliance
FCA Mills Review July 2026: no dedicated AI Act, Consumer Duty governs all AI with consumer implications. Four Consumer Duty AI outcomes (Products, Price, Understanding, Support); SM&CR personal accountability for AI systems; FCA vs EU AI Act comparison; operational resilience AI scenarios; FCA Innovation Sandbox; India banks UK dual-jurisdiction — HDFC UK, ICICI Bank UK, SBI UK RBI MRMF plus FCA Consumer Duty AI governance.
Read more →IRDAI · Insurance AI · India · Working Group 2026
IRDAI AI governance insurance India 2026: working group, underwriting AI, claims AI governance, and policyholder protection framework
IRDAI AI Working Group formed June 19, 2026 — 7 members (IIIT Hyderabad chair, ReBIT, CERT-In, SBI Life, Star Health, ICICI Lombard). India's first insurance AI governance framework expected Q4 2026. Underwriting AI fairness and explainability; claims AI accuracy and fraud detection calibration; distribution AI suitability; CERT-In 6-hour AI incident reporting; IRDAI-RBI FREE-AI alignment for financial conglomerates; AI in PMJJBY/PMSBY government schemes; LIC public sector AI governance.
Read more →RBI · MRMF 2026 · Model Risk · AI Governance
RBI draft model risk management framework 2026: MRMF AI governance requirements for banks, NBFCs, and all RBI-regulated entities
RBI MRMF June 24, 2026 (Press Release 2026–2027/528): board-approved MRMF mandatory; comprehensive AI model inventory; independent model validation (vendor models not exempt); explainability for credit and fraud AI; human oversight on consequential decisions; third-party vendor accountability; 11 entity categories in scope; FREE-AI vs. MRMF comparison; 6 common compliance gaps; PSB, private bank, NBFC, co-op bank, CIC implications.
Read more →Treasury · ALM · IRRBB · Liquidity Risk
AI governance treasury ALM banking: interest rate risk AI, liquidity forecasting AI, IRRBB governance, and FTP model risk
IRRBB AI governance (Basel BCBS 368, RBI 2024 IRRBB guidelines, NMD behavioral models, EVE/NII scenario consistency, ALCO reportability); LCR/NSFR AI forecasting (HQLA eligibility, intraday UPI/RTGS liquidity); FTP AI governance (curve construction, MCLR consistency, optionality pricing); G-Sec HTM/AFS AI; India PSB treasury AI and government ownership complexity; RBI SLR investment portfolio governance.
Read more →Trade Finance · TBML · Letter of Credit · SCF
AI governance trade finance banking: letter of credit AI, supply chain finance AI, TBML detection, and digital trade document governance
LC examination AI (UCP 600, ISBP 745 compliance, discrepancy classification, eUCP v2.0); TBML detection AI (FATF typologies, commodity price validation, counterparty network analysis, FIU-India STR requirements); supply chain finance AI (invoice authentication, duplicate financing detection, TReDS); sanctions screening in trade AI (OFAC, PMLA, commodity sanctions); India DGFT and RBI FREE-AI for trade finance.
Read more →IOSCO · Securities · Robo-Advisory · Algo Trading
IOSCO AI governance securities: international securities regulator AI guidance, algorithmic trading, robo-advisory, and asset management AI
IOSCO 2020 AI/ML guidance for securities markets: six governance principles (governance framework, risk management, testing, monitoring, explainability, data); IOSCO 2021 AI in asset management; robo-advisory suitability and explainability; compliance surveillance AI; ESG AI greenwashing risk; SEBI IOSCO alignment; NSE/BSE AI surveillance governance; India robo-advisory DPDP Act intersection.
Read more →Basel Committee · BCBS · IRB · Credit Risk AI
Basel Committee AI governance banking: BCBS AI/ML principles, credit risk model governance, and BIS Innovation Hub
BCBS 2023 machine learning in credit risk: IRB use test for AI models; independent validation requirements; distribution shift stress testing; Basel III capital AI model risk amplification; BCBS operational resilience applied to AI; BIS Innovation Hub projects (Aurora AML AI, Raven cyber); India IRB banks FREE-AI and BCBS alignment; PSB Basel standardized approach AI governance.
Read more →FSB · G20 · Systemic Risk · AI Concentration
FSB AI governance banking: Financial Stability Board AI systemic risk, concentration risk, and G20 AI framework
FSB November 2023 AI and financial stability report: AI concentration risk (hyperscaler dependency); herding behavior from correlated AI models; opacity and interpretability systemic risk; FSB regulatory coordination recommendations; DORA CTPP framework as FSB concentration risk response; India G20 2023 AI governance legacy; RBI-FSB engagement; India banking AI concentration (PSB shared infrastructure, NPCI UPI fraud AI).
Read more →EBA · EU Banking · Internal Governance
EBA AI governance banking: European Banking Authority AI guidelines, model risk management, and EU AI Act coordination
EBA/GL/2021/05 Internal Governance Guidelines applied to AI; EBA 2024 AI policy paper on EU AI Act intersection; EBA ML for IRB credit risk models; EBA AML/CFT AI governance; EBA model risk management guidelines update 2025–2026; India banks EU supervisory college; India fintech EU market access EBA compliance.
Read more →BaFin · Germany · DORA AI · EU AI Act
BaFin AI governance banking: German financial supervisory authority AI guidance December 2025 and DORA AI anchoring
BaFin December 2025 guidance: AI systems as ICT under DORA; DORA ICT asset register for AI; AI incidents and 4-hour DORA reporting; BaFin BDAI principles (explainability, fairness, auditability); MaRisk AT 8.2 AI outsourcing; BaFin as EU AI Act sectoral authority for Germany; India banks Frankfurt operations dual-supervision compliance.
Read more →CFPB · Open Banking · Data Rights AI
CFPB Section 1033 open banking AI governance: Personal Financial Data Rights rule and AI training data compliance
CFPB Section 1033 (finalized October 2024): AI training data sourcing compliance; authorization scope tracking; data retention limits for AI training; prohibited secondary use and data monetization; India Account Aggregator framework parallel; UPI transaction data AI governance; DPDP Act purpose limitation for AI training data.
Read more →ECB · Eurozone · SSM Supervision
ECB AI governance banking: European Central Bank AI supervision for eurozone significant institutions
ECB directly supervises ~110 significant institutions — SSM AI supervisory priorities 2025; ECB 2024 report on AI in banking; model inventory and validation gaps; board AI oversight requirements (CRD IV Article 88); EU AI Act high-risk intersection; DORA third-party AI concentration; India banks EU operations GDPR/DPDP Act compliance.
Read more →OCC · US Banking · Fair Lending AI
OCC AI governance banking: Office of the Comptroller of the Currency AI risk supervision for national banks
OCC AI examination priorities 2024–2025: SR 11-7 for AI models; fair lending AI disparate impact (ECOA); CFPB Circular 2026-03 adverse action AI; UDAP/UDAAP AI compliance; OCC Bulletin 2023-17 AI vendor risk; India banks US branches (SBI NY, ICICI Bank US, HDFC Bank NY) OCC compliance implications.
Read more →HKMA · Hong Kong · Model Risk
HKMA AI model risk management banking: Supervisory Policy Manual CR-G-14 and AI governance for HK banks
HKMA CR-G-14 model risk management applied to AI/ML; HKMA AI governance circular; risk tiering, independent validation, performance monitoring requirements; APAC framework comparison (HKMA vs MAS vs APRA vs RBI); India banks in HK (SBI, ICICI, HDFC, Bank of Baroda HK) dual-jurisdiction compliance.
Read more →PRA SS1/23 · UK Banking · SMCR
PRA SS1/23 AI governance banking: UK model risk management supervisory statement for AI/ML
PRA SS1/23 (May 2023) — UK's most prescriptive AI model governance framework; SMCR Senior Manager accountability for AI model risk; SS1/23 vs SR 11-7 comparison; BoE/FCA DP4/22; India banks UK operations (HDFC UK, ICICI UK, SBI UK) dual-jurisdiction compliance; DPDP Act cross-border training data.
Read more →GenAI Guardrails · MAS · Singapore
ABS Handbook Generative AI Guardrails Banking: MAS AI Risk Toolkit and Project MindForge March 2026
ABS Handbook March 24, 2026 — MAS, DBS, HSBC, JP Morgan, OCBC, UOB and 9 other banks publish GenAI guardrail controls for banking; MAS AI Risk Toolkit Project MindForge Phase 2; guardrail selection framework; input/output/human oversight guardrails; lifecycle governance; India RBI FREE-AI parallel.
Read more →Payments · PSD3 · APP Fraud
AI governance payment systems banking: PSD3, real-time payments fraud, and APP fraud AI controls
PSR in force summer 2026 — €50 consumer APP fraud liability cap; real-time payments fraud 10x traditional; APP fraud detection AI governance; SCA risk-based exemption engine governance; PSD3 payment refusal explainability; India UPI-scale AI fraud governance, NPCI guidelines, multilingual APP fraud detection, DPDP Act payment data.
Read more →Wealth Management · Reg BI
AI governance wealth management banking: Reg BI suitability, FINRA AI warning, SEC 2026 exam priorities
FINRA 2026 explicit warning — AI-generated recommendations fall under Reg BI; SEC 2026 Examination Priorities on AI advisory governance; suitability validation for AI recommendation systems; AI-specific WSPs; investment AI explainability; conflict of interest analysis for AI; India SEBI IA Regulations, SEBI RA Regulations for AI research, HNI wealth management AI governance.
Read more →Algo Trading · SEBI · MiFID II
AI governance algorithmic trading banking: SEBI April 2026, ESMA MiFID II, and pre-trade AI controls
SEBI retail algo trading framework April 2026 — broker accountability for client AI algorithms; ESMA MiFID II supervisory briefing on AI in algo trading; pre-trade controls for non-deterministic AI; kill switch testing obligations; market manipulation surveillance for AI; India SEBI audit trail, NSE/BSE surveillance, India market-specific AI training data obligations.
Read more →Complaints · FCA · Consumer
AI governance customer complaints banking: FCA 2027, CFPB AI accountability, and FOS observations
FCA individual firm-level complaint reporting January 2027; FOS observes AI in ~35% of firm responses; CFPB AI response accuracy accountability; AI complaint response traceability to governed sources; vulnerable customer detection and escalation; India RBI Integrated Ombudsman, SEBI SCORES, multilingual AI complaint governance.
Read more →Climate Risk · ESG · EBA
AI governance for climate risk banking: EBA ESG guidelines, AI-calculated metrics, and carbon accountability
EBA ESG risk guidelines (2026) embedding climate AI in credit assessment; AI-calculated carbon metrics CSRD auditability; algorithmic bias in social-pillar ESG scoring; AI infrastructure carbon accounting; India RBI climate disclosure framework, India-specific physical risk calibration, and Carbon Credit Trading Scheme AI governance.
Read more →DORA · EU · ICT Risk
DORA AI governance banking: how the Digital Operational Resilience Act applies to AI systems
DORA applicable January 17, 2025; AI systems as ICT systems (BaFin December 2025 guidance); 19 Critical Third-Party Providers designated November 2025 (AWS, Google Cloud, Microsoft); management body AI knowledge obligations; AI in ICT asset register, risk framework, incident reporting, resilience testing; India RBI outsourcing and SEBI CSCRF parallels.
Read more →Insurance · NAIC · IRDAI
AI insurance underwriting governance: NAIC Model Bulletin, EU AI Act high-risk, and IRDAI
NAIC Model Bulletin AI inventory, named accountability, unfair discrimination testing; NAIC AI Systems Evaluation Tool pilot March 2026 across 12 states; EU AI Act Annex III high-risk classification for insurance risk assessment; IRDAI June 2026 AI working group (Prof. Sandeep K. Shukla, ReBIT, CERT-In).
Read more →Lending · ECOA · CFPB
AI governance in lending banking: ECOA adverse action, CFPB 2026 guidance, and fair lending AI
CFPB Circular 2026-03 (May 5, 2026) on AI adverse action notices; ECOA Regulation B obligations for algorithmic credit; fair lending disparate impact testing for AI credit models; GenAI-assisted underwriting data provenance; RBI Fair Practices Code adverse action; India proxy variable fairness.
Read more →AIBOM · EU AI Act
AIBOM in banking: AI Bill of Materials for EU AI Act, SR 26-2, and vendor procurement
EU AI Act Annex IV technical documentation obligations; SR 26-2 vendor conceptual soundness requirements; CycloneDX ML-BOM v1.7 and SPDX 3.0 AI Profile standards; six AIBOM components (model, dataset, dependencies, pipeline, compute, governance); India RBI FREE-AI and data localization AIBOM implications.
Read more →KYC · Identity Fraud
AI governance in KYC banking: deepfakes, perpetual KYC, and SR 26-2's scope gap
AI-generated deepfakes targeting KYC rose 900%; SR 26-2 excludes generative AI but examiners ask for governance anyway; perpetual KYC model governance; video KYC liveness detection; India Aadhaar eKYC AI governance, PMJDY fairness testing, and RBI KYC Master Direction obligations.
Read more →AML · Financial Crime
AI governance in AML banking: transaction monitoring, SAR narratives, and explainability
AI transaction monitoring model governance under SR 26-2; false positive governance and demographic fairness; generative AI SAR narrative accuracy and provenance obligations; alert disposition AI human oversight; India PMLA Principal Officer accountability for AI; FIU-India STR quality; UPI-scale transaction monitoring governance.
Read more →APRA · Australia
APRA AI governance for banks and insurers: April 2026 letter and what it requires
APRA April 30, 2026 letter found governance, risk management, assurance, and operational resilience practices lagging AI adoption; four gaps identified; CPS 230 obligations for AI vendors; Financial Accountability Regime personal accountability for AI failures; enforcement posture for entities that don't address gaps.
Read more →EU AI Act
AI watermarking in banking: EU AI Act Article 50, voice-clone fraud, and content provenance
EU AI Act Article 50 in force August 2026 (December 2026 transition deadline); machine-readable watermarks required for AI-generated content; voice-clone fraud bypassing biometric authentication; SAR narrative provenance; C2PA standard; India DPDP Act automated decision disclosure and deepfake fraud.
Read more →Shadow AI
Shadow AI in banking: detecting unauthorized models before they become regulatory findings
98% of organizations have unsanctioned AI use; $4.63M average breach cost; SR 26-2 inventory obligation creating shadow AI detection requirement; six detection layers; India RBI inventory obligation and DPDP Act processing purpose violation by shadow AI.
Read more →FINRA · Securities
FINRA AI governance for broker-dealers: 2026 supervisory priority and what it requires
FINRA elevated AI agents to active supervisory priority (highest urgency) in 2026; three specific concerns: autonomous agents with no human in loop, agent permission/access issues, AI misusing sensitive data; five compliance obligations for broker-dealers; India SEBI parallels for Indian firms with US operations.
Read more →LLM Governance
LLM validation in banking: evaluating generative AI when there is no single right answer
Five evaluation dimensions (domain accuracy, hallucination rate, safety pass rate, calibration, instruction following); why traditional MRM validation doesn't work for LLMs; JurisTech 2026 LLM hallucination benchmark; SR 26-2 scope gap; India: RBI FREE-AI LLM scope, regional language validation gap, DPDP Act data boundary validation.
Read more →India Insurance
IRDAI AI governance for insurance: India's first insurance AI framework is being written now
IRDAI June 19, 2026 working group; 3-month timeline; chaired by Prof. Sandeep Shukla (IIIT Hyderabad) with CERT-In and ReBIT; motor claims AI (same-day settlement); health fraud detection AI; life underwriting AI; DPDP Act policyholder rights; what insurers need to govern before the standard finalizes.
Read more →Explainability
AI explainability in banking: SHAP, counterfactuals, and the regulatory requirements that break post-hoc methods
SHAP for credit models; counterfactual explanations for adverse action notices; why ICML 2026 confirmed post-hoc methods fail for LLMs; RBI Fair Practices Code adverse action obligations; DPDP Act right to human review enabling explainability; PMJDY segment-level SHAP analysis.
Read more →Concentration Risk
AI concentration risk in banking: hyperscaler dependency, systemic exposure, and governance requirements
BIS 2026 financial stability warning; Bank of England FPC AI risk identification; RBI Governor's explicit warning on AI concentration; three dimensions (cloud infrastructure, foundation model, AI vendor); India data localization interaction; UPI systemic risk; concentration inventory and exit capability governance.
Read more →Operational Resilience
AI operational resilience in banking: DORA, Important Business Services, and emergency controls
Bank of England FPC June 2026 identified AI as financial stability risk; EBA confirmed AI systems fall under DORA; ESAs July 2026 joint statement; IBS classification for AI-dependent functions; emergency shutdown governance; India RBI BCP obligations for critical AI.
Read more →Human Oversight
AI human oversight in banking: meaningful review vs. automation bias
What makes oversight meaningful vs. nominal; override friction parity; override rate monitoring for automation bias detection; India DPDP Act right to human review; PMJDY heightened oversight obligation; AML Principal Officer accountability.
Read more →LLM Safety
LLM hallucination governance in banking: controls, detection, and regulatory obligations
Critical vs. high vs. medium hallucination risk by deployment type; RAG grounding as primary control; India regional language hallucination amplification; DPDP Act disclosure obligation; UPI zero-tolerance requirement.
Read more →Third-Party Risk
AI vendor due diligence in banking: what to assess before procurement
Six due diligence areas: model documentation, change management, data localization, incident response, audit rights, concentration risk. Required contractual protections. India: DPDP Act sub-processor chain, RBI outsourcing guidelines applying to AI vendors.
Read more →Board Governance
AI board reporting in banking: what the board needs to see and when
The four elements of an AI board pack, the headline metrics that signal governance health, how to present residual risk to non-technical directors, and RBI 2024 AI Circular obligations for board awareness of critical AI systems.
Read more →Model Lifecycle
AI model retirement criteria in banking: when to decommission, how to govern it
Performance, regulatory, supersession, and business triggers for model retirement; the six-step formal retirement process; DPDP Act deletion obligations; and how LLM provider data deletion confirmations are handled at retirement.
Read more →Regulation
SR 26-2 banking: what the new model risk guidance changes — and what it doesn't cover
SR 26-2 replaced SR 11-7 in April 2026. The critical carveout: generative AI and agentic AI are explicitly outside its scope. What governs the AI that SR 26-2 doesn't cover?
Read more →Model Governance
AI model change management in banking: classification, revalidation triggers, and approval gates
Major vs. minor vs. cosmetic: which changes require full revalidation, how to handle LLM provider-initiated version updates, and the approval gate structure that satisfies RBI and SR 26-2.
Read more →Model Validation
AI model performance benchmarking in banking: metrics, baselines, and regulatory evidence
Which performance metrics matter for BFSI AI, how to set defensible baselines that hold under RBI scrutiny, and what benchmark evidence satisfies SR 11-7 examination requirements across credit, fraud, AML, and LLM systems.
Read more →Incident Management
AI incident investigation in banking: root cause analysis, evidence chain, and regulatory reporting
When an AI system fails in production, incident response handles containment. Incident investigation handles the harder question: why did it fail, and what must be reported to RBI, CERT-In, and the board?
Read more →Explainability
AI explainability tools in banking: SHAP, LIME, Integrated Gradients, counterfactuals, attention weights, TCAV — regulatory adequacy for each governance obligation
Not all explainability tools satisfy banking regulatory requirements. SHAP: gold standard for tabular credit AI, feature-level attribution translatable into customer language. LIME: unstable across inputs, insufficient for individual accountability. Integrated Gradients: deep learning token attribution, baseline choice must be justified. Counterfactuals: strongest for DPDP Act explanation obligation (actionable, consumer-readable). Attention weights: mechanistically useful, causally inadequate for regulation. TCAV: proxy variable concept sensitivity, required for India caste/religion proxy analysis. Regulatory adequacy table: 6 obligations × adequate/inadequate tools. India: DPDP Act meaningful explanation, proxy variable TCAV requirement, regional language translation obligation, RBI FREE-AI documentation standard.
Scenario Testing
AI scenario testing in banking: economic stress scenarios, adversarial cases, out-of-distribution testing, and India-specific regulatory edge cases
Standard validation measures average performance on historical data. Scenario testing targets foreseeable failures before incidents reveal them. Four categories: economic stress (recession, credit cycle reversal, sectoral stress), out-of-distribution (new-to-credit, informal income, PMJDY profiles), adversarial (prompt injection, threshold probing, data poisoning simulation), regulatory edge cases (priority sector, vulnerable customers, Fair Practices Code). Test design requirements: pre-defined pass/fail thresholds, independence from development team, hash-chained evidence artifacts. India: monsoon/crop cycle stress for agricultural credit, UPI-specific fraud scenarios, PMJDY OOD testing, regional language adversarial cases, FIU-India typology coverage matrix.
AI Costs
AI cost governance in banking: LLM inference costs, per-use-case compute budgets, cost concentration risk, and board-level AI ROI reporting
AI costs are variable and usage-driven — a customer service LLM scales cost with conversation volume and prompt length. Six AI cost categories: LLM inference tokens, compute infrastructure, model retraining, RAG/vector DB, human oversight labor, guardrail infrastructure. Per-use-case budget metrics and watch/escalation thresholds for 6 AI domains. Prompt engineering as financial governance. India: RBI concentration risk obligation, INR/USD FX exposure on LLM spend, regional language inference cost premium (30–60%), PMJDY-scale economics, data localization cost premium.
Human Oversight
AI override governance in banking: authorization framework, permissible grounds, documentation requirements, and override rate thresholds that trigger model review
Override governance makes human judgment legible: detects model deterioration through override patterns, demonstrates human accountability to regulators, enables fairness disparity analysis across customer segments. Six dimensions: authorization (role-based, not individual), permissible grounds taxonomy, documentation fields, override rate monitoring thresholds, fairness disparity analysis, retrospective outcome tracking. Thresholds by domain: credit (watch 10%, review 15%), AML (watch 8%, review 12%), fraud (watch 5%, review 8%). India: Fair Practices Code accountability trail, DPDP Act explanation obligation, India proxy variable override disparity analysis, priority sector lending override reason codes.
AI Governance
AI use case registry in banking: cataloguing every AI system, shadow AI prevention, mandatory intake controls, and PMJDY-segment flagging obligations
A use case registry extends the SR 11-7 model inventory to cover LLMs, vendor-embedded AI, and third-party API-accessed AI. Five registry components: system identity, risk tier, named ownership (accountable business/technical/risk owners), lifecycle and validation status, regulatory framework and third-party flags. Shadow AI prevention: mandatory intake, annual self-attestation, procurement keyword triggers. India: RBI 2024 board evidence obligation, PMJDY-serving system flagging, DPDP Act sub-processor registry, UPI and payment AI NPCI reporting flags.
Deployment
AI deployment governance in banking: six pre-production gates, deployment freeze controls, and post-deployment first-30-days protocol
AI deployment governance validates that a model behaves safely under production conditions, not just test conditions. Six sequential gates: risk tier classification, independent validation sign-off, fairness and adversarial testing, IT security and DPDP review, business owner attestation, deployment authorization with freeze check. Table: required evidence artifact, approval authority, shelf life, common examination gap for each gate. India: RBI 2024 board awareness for critical AI, FREE-AI deployment obligations, PMJDY-segment deployment review, deployment freeze during RBI examination.
Insurance AI
AI governance for insurance: actuarial AI, claims AI fairness, underwriting AI explainability, IRDAI requirements, and India proxy variable obligations in insurance AI
Insurance AI governance differs from banking: actuarial AI at intersection of actuarial professional standards and model risk management; permitted-vs.-proxy-discrimination tension in geographic rating; claims fraud AI differential false positive rates. 6 use cases: actuarial, underwriting, claims, LLM customer service, telematics, third-party data. India: geographic rating proxy variable analysis, PMFBY agricultural insurance AI accuracy, DPDP Act health data consent obligations for underwriting AI.
Board Governance
AI risk appetite for banking: board-approved domain-level thresholds, how risk appetite translates into governance action triggers, and RBI FREE-AI expectations
Risk appetite table: 8 domains with tolerance levels, specific thresholds, governance actions, and board notification requirements. Zero-tolerance domains: fairness adverse impact, LLM financial advice boundary violation, AI security breach to customer, agentic AI authorization breach. How appetite operationalizes into deployment gates, monitoring alert routing, and incident materiality determination. India: proxy variable fairness appetite, PMJDY financial inclusion appetite dimension, RBI examination evidence requirements.
Vendor Risk
AI third-party risk in banking: vendor AI governance, due diligence for procured AI systems, RBI outsourcing framework for AI, and managing concentration risk from AI vendor dependency
Banks cannot outsource regulatory accountability for AI decisions. Third-party AI governance goes beyond IT vendor management: independent performance and fairness monitoring, change notification governance, outcome-based validation when model internals inaccessible. Six due diligence dimensions: model documentation, India fairness testing, explainability, data residency, adversarial robustness, exit assessment. India: credit bureau concentration risk, shared LLM API and DPDP Act, RBI outsourcing framework accountability retention.
AI Policy
AI governance policy for banking: what must be in the policy beyond model risk, board approval requirements, and India obligations under RBI FREE-AI and DPDP Act
8 required policy sections: scope (all AI including LLMs and agents), risk taxonomy and tiering, fairness obligations with India proxy variable registry, LLM and generative AI governance, third-party AI, board risk appetite with domain thresholds, explainability and customer rights, prohibited and restricted AI uses. Gap table: 5 areas model risk policies typically miss. India: proxy variable registry as RBI examination requirement, DPDP Act automated decision governance, board evidence obligation under 2024 AI Circular.
LLM Governance
AI customer service in banking: LLM chatbot scope governance, financial advice boundary enforcement, guardrails for customer-facing generative AI, and RBI expectations for AI-assisted banking
Customer-facing LLMs must not cross the financial advice boundary (SEBI investment adviser regulations, RBI customer protection guidelines). Guardrail architecture: input-layer intent classification, output-layer financial advice classifier, session-level multi-turn monitoring, escalation quality assurance. Scope table: 8 query types from factual account information (allow) to investment recommendations (block+escalate). India: regional language guardrail coverage, Fair Practices Code in AI responses, PMJDY customer accessibility requirements.
Model Risk
AI model monitoring for banking: production drift detection, performance degradation thresholds, data drift vs. concept drift in credit AI, monitoring generative AI in production, and RBI continuous monitoring requirements
6 production monitoring dimensions: performance, data drift (PSI thresholds), concept drift, fairness monitoring, output calibration, override tracking. Governance threshold table: 5 monitoring signals with 3-level escalation triggers. Distinct treatment of data drift vs. concept drift (retraining vs. model redesign). LLM monitoring metrics: policy violation rate, hallucination proxy, refusal/over-refusal rate, adversarial detection rate. India specifics: PMJDY segment monitoring, India proxy variable fairness drift, monsoon/crop cycle seasonal drift.
AML Compliance
AI alert fatigue in banking: AML false positive rates, AI-driven alert rationalization for fraud and AML systems, governance of alert thresholds, and how to reduce alert noise without increasing risk
AML systems generate 90–98% false positive rates. AI-driven rationalization — risk-stratified scoring, behavioral baselines, alert correlation — reduces noise without reducing detection effectiveness. Governance of threshold changes requires documented risk impact assessment, compliance approval, and post-change STR conversion rate monitoring. India specifics: PMJDY account false positive patterns, UPI counterparty visibility limits, FIU-India mandated typologies that cannot be rationalized regardless of conversion rate.
Model Risk
AI model documentation for banking: SR 11-7 documentation requirements for AI, model cards for BFSI, what must be documented before validation can begin, and RBI MRM documentation standards
8-section BFSI model card: identity/governance, intended use, training data (version hash, proxy variable screen), model architecture (hyperparameters, feature engineering), performance (sub-population breakdown including PMJDY), fairness (India proxy variable), limitations/failure modes, change history. 5 documentation gap patterns: training data unversioned, feature engineering undocumented, India proxy absent, LLM system prompt unversioned, RAG KB unversioned. Documentation completeness as a validation gate.
Vendor Risk
AI procurement for banks: vendor selection governance, due diligence checklist, contract requirements for AI, and what RBI expects before deploying a bought AI system
Six AI vendor due diligence categories: model governance, explainability, fairness testing (India proxy variable coverage), security, data governance (DPDP/localization), BCM and resilience. Minimum contract provisions: 30-day change notification, explainability rights, audit rights, India fairness testing, data localization, exit and data portability. India specifics: India proxy variable testing as procurement condition, BC network deployment requirements, multilingual performance thresholds.
Model Risk
AI training data governance in banking: training data quality, lineage, DPDP Act consent for training data, India-specific data source risks, and what RBI expects for training data in AI model risk management
Six training data quality dimensions: completeness, representativeness (training vs. deployment population), label quality (historical discrimination encoded in credit labels), vintage/recency, proxy variable presence, feature engineering documentation. DPDP Act consent for AI training data. India specifics: historical discrimination in training labels, PMJDY population underrepresentation, regional language training data gaps, proxy variable pre-screening before training.
RBI Compliance
AI regulatory reporting for banks: what AI data banks must report to RBI and SEBI, AI incident reporting requirements, and building an AI evidence pack for RBI examination
Five categories of AI regulatory reporting RBI expects: AI system inventory, fairness metrics, validation status, AI incident register, vendor oversight records. Seven-section AI evidence pack for examination. India-specific dimensions: India proxy variable fairness reporting, SEBI AI-in-trading disclosure, RBI 2024 AI Circular board-level oversight evidence. Why evidence assembled at examination time is always too late — and how continuous generation changes the equation.
FREE-AI Framework
AI accountability in banking: FREE-AI Pillar 5 accountability requirements, RACI frameworks for AI, ownership of AI decisions, and what happens when no one owns the AI outcome
Four FREE-AI accountability dimensions: decision ownership (named owner per use case), design accountability (training data, feature selection), vendor AI accountability (bank accountable for third-party model outcomes), board accountability (operational oversight, not nominal). RACI matrix for 5 key AI governance decisions including AI-caused harm remediation. India: DPDP Act Data Fiduciary accountability, Fair Practices Code explanation, BC network accountability chain.
Vendor Risk
AI concentration risk in banking: vendor concentration, foundational model dependency, infrastructure concentration, and RBI's over-reliance requirements for AI systems
AI concentration risk across four dimensions: vendor platform concentration (multiple use cases on one vendor), foundational model dependency (multiple use cases on one LLM regardless of vendor), cloud/GPU infrastructure concentration, and algorithmic concentration. India-specific dimensions: data localization concentration, UPI data source dependency, shared credit bureau dependency. Concentration thresholds, governance actions, and AI vendor exit planning.
Model Validation
AI stress testing for banking: distributional stress, adversarial testing, fairness under stress, and what breaks when AI faces scenarios it was not trained on
Four types of AI stress testing: distributional stress (out-of-distribution behavior when production data diverges from training), adversarial stress (deliberate manipulation — fraud model evasion, LLM prompt injection, jailbreak), fairness under stress (do protected groups fare worse when models are under distributional pressure?), and temporal decay testing. India-specific: financial inclusion population stress testing, India proxy variable fairness under stress, UPI ecosystem stress scenarios.
Model Risk
AI model validation for banking: SR 11-7 requirements for AI, fairness validation, and where most validation programs fall short
7-stage AI model validation process: conceptual soundness, performance on holdout and stress data, fairness validation (including India proxy variable testing), explainability validation, adversarial robustness. Where MRM programs fall short: vendor AI validation gaps, LLM validation methodology, agentic authorization scope testing, and what RBI's 2024 AI Circular adds beyond SR 11-7.
Read more →Model Lifecycle
AI change management for banking: what triggers re-validation, LLM version governance, and version control requirements under RBI and SR 11-7
AI model change management requires more than standard IT change control. Major/minor/patch classification framework, what triggers full vs. scoped re-validation, LLM-specific change types (provider version update, system prompt change, RAG knowledge base update, fine-tuning), and India-specific obligations: 30-day vendor notice requirement, proxy variable fairness re-testing on change, regional language testing for LLMs.
Read more →AI Ethics
AI ethics for banking: from principles to governance processes that generate RBI FREE-AI examination evidence
AI ethics is a governance process, not a values exercise. The 6 ethical AI principles that generate banking obligations (human dignity, non-maleficence, autonomy, justice, transparency, beneficence), how each maps to lifecycle governance steps, and what RBI's FREE-AI Ethics pillar examines — distinct from fairness testing, covering use case review, harm assessment, and board oversight of ethics decisions.
Read more →DPDP Act
AI data privacy for banking: DPDP Act obligations for AI systems, consent architecture, and the deletion-retention conflict
India's DPDP Act applies to every AI system that processes personal data — which means every customer-facing AI in Indian banking. Purpose-limited consent for AI training, deletion rights against AI training datasets, the architecture for resolving the DPDP deletion vs. RBI 7-year retention conflict, and data localization requirements for AI inference in cloud infrastructure.
Read more →RBI Examination
AI supervisory examination: what RBI examiners actually assess and how to prepare your evidence
RBI AI examinations follow FREE-AI's seven pillars. What examiners assess under each pillar, what evidence they request, the six most common examination findings and their root causes, and India-specific examination areas that international compliance frameworks don't cover — proxy variable fairness, vernacular language explanation, BC network AI governance.
Read more →Operational Risk
AI operational resilience for banking: fallback protocols, RBI BCM requirements, and what breaks when AI fails
AI failure is different: a model can be degraded, drifting, or compromised while infrastructure is fully operational. Six use-case fallback protocols (credit, fraud, LLM chatbot, document AI, agentic systems, AML), RBI BCM compliance requirements for AI, and India-specific resilience for BC networks and UPI dependency.
Read more →Governance Metrics
AI governance metrics for banking: 15 KPIs by domain, board vs. committee vs. examination audiences, and India-specific fairness KPIs for proxy variable monitoring
A governance program without metrics is policy without accountability. 15 KPIs across model risk (validation currency, finding remediation, inventory completeness), fairness (proxy group approval rate ratios, PMJDY gap), security (guardrail FPR, prompt injection detection), and regulatory (notification compliance, vendor contract rate, adverse action quality). Board gets 5–7 risk posture indicators. MRM committee gets operational detail. RBI examination gets evidentiary documentation. India adds 3 metrics no international framework specifies.
Read more →Bias Testing
AI bias testing for banking: 6 statistical methods, India proxy variable test design for caste/religion/language/disability, 80% rule for credit, and RBI FREE-AI Fairness examination
Bias testing in AI is a statistical problem, not a policy statement. 6 methods: disparate impact (80% rule), demographic parity, counterfactual fairness, calibration, intersectional testing, and LLM adversarial probing. India adds proxy variable testing that no international framework addresses: pincode/caste, UPI/religion, device language/language community, accessibility/disability. RBI FREE-AI Fairness Pillar examination requires quantitative evidence across all proxy dimensions in both validation and continuous production monitoring.
Read more →Model Governance
AI model inventory for banking: 9 required fields, what RBI examiners look for, and how to include LLMs and agentic systems with authorization scope
A model registry tracks versions. A model inventory tracks governance obligations — and most banks with mature MLOps tooling still have incomplete inventories missing shadow AI, vendor-embedded AI, and LLM deployments with floating model versions. 9 required fields including validation currency, proxy variable fairness coverage, DPDP Act data fiduciary classification, and agentic system authorization scope. India-specific: data residency field and proxy variable fairness testing record for every credit and fraud model.
Read more →Incident Response
AI incident response for banking: 5-stage process, RBI 6-hour notification, what counts as an AI incident, and India DPDP 72-hour breach reporting
AI incidents do not look like IT incidents — a drifting credit model generates no server errors. Banks need AI-specific incident classification: performance incidents, fairness incidents, security incidents, behavioral incidents. 5-stage response: detection, containment, regulatory notification, root cause, and return to production. RBI 6-hour notification for security, 24-hour for Critical performance/fairness. India adds DPDP Act 72-hour breach notification and proxy variable fairness incident classification.
Read more →Explainability
AI explainability requirements for banking: RBI, EU AI Act Article 86, SR 11-7 adverse action, and the gap between SHAP interpretability and regulatory explainability
Most banks implement SHAP for model interpretability and consider explainability done. Regulators have a different definition: decision-specific, plain-language explanation for individual customers. SHAP feature importance charts satisfy technical documentation but not EU AI Act Art. 86 or RBI adverse action requirements. India adds regional language explanation and proxy variable explanation conflict for caste/religion proxy features. Closing the gap requires decision-level logging at inference, a feature-to-plain-language translation layer, and consistency testing.
Read more →Model Lifecycle
AI model decommissioning for banking: what must be retained for 7 years, RBI record obligations, successor validation before switch-off, and India DPDP data deletion requirements
Decommissioning an AI model is a governance event, not an infrastructure deletion. Records must be retained for 7 years under RBI requirements — documentation, validation reports, customer decision records, audit trail, committee approvals, and fairness testing results. The successor must complete independent validation and parallel run before the predecessor is switched off. India adds DPDP Act data deletion obligations and proxy variable fairness audit at decommission.
Read more →Vendor Contracts
AI vendor contracts for banking: 8 required clauses, RBI data residency, SR 11-7 validation rights, and what international vendors resist
A bank cannot outsource its AI governance obligation to a vendor. SR 11-7 validation accountability stays with the bank. The vendor contract must secure the rights the bank needs to govern a system it does not own — validation access, 30-day model change notice, India data residency, India proxy variable fairness documentation, audit rights, termination and data return, regulatory cooperation. What international vendors resist and how to resolve the gaps.
Read more →Credit Decisioning
AI credit decisioning governance: 6 RBI requirements, adverse action explanation standards, and India financial inclusion obligations for PMJDY populations
Credit decisioning AI carries the highest governance burden in retail banking: high-risk under EU AI Act Annex III, subject to RBI adverse action requirements, and legally required to not systematically exclude PMJDY populations. 6 governance requirements: risk classification, independent validation, fairness testing, adverse action explanation, production monitoring, financial inclusion. India-specific: pincode features, UPI data governance, regional language explanations, rural/urban performance parity.
Read more →Risk Taxonomy
AI risk taxonomy banking: 7 domains with subcategories, India-specific extensions for caste/religion/language/disability proxy risk, and framework crosswalk to RBI FREE-AI, SR 11-7, OWASP LLM Top 10
Systematic AI risk classification by domain — not by model or product line — enables cross-cutting risks to be tracked at portfolio level. 7 domains: Model Accuracy, Fairness, Security, Explainability, Data Governance, Governance/Accountability, Agentic Risk. India extensions: caste/religion/language/disability proxy variable subcategories absent from all international frameworks. Framework crosswalk maps each domain to RBI FREE-AI pillar, SR 11-7 section, OWASP LLM Top 10, and NIST AI RMF function.
Read more →MRM Reporting
AI model risk reporting banking: 8-section MRM committee report structure, residual risk heat map, fairness testing results, and approval record requirements for RBI
MRM committees receive AI risk reports built for statistical models — validation status, open findings, override rates. Missing: residual risk heat map by domain, segment-level fairness testing results, India proxy variable outcomes, agentic system authorization scope. 8-section report structure covering executive summary through decisions required. India addition: proxy variable fairness section, DPDP compliance status, RBI examination readiness.
Read more →Governance Training
AI governance training banking: role-based requirements for model owners, validators, committee, board, and front-line staff — and what RBI examiners look for
Generic AI awareness training does not satisfy RBI examination. Role-differentiated training requirements covering model validators (LLM behavioral consistency testing, proxy variable fairness methods), risk committee (residual risk heat map literacy), board (AI risk appetite governance), and front-line staff (AI tool limitations, escalation). India-specific: proxy variable fairness training not covered by any international vendor library.
Read more →Change Management
AI change management banking: 4-tier change classification, AI-specific pre-production testing gates, rollback procedures, and India proxy variable re-testing requirements
Standard IT change management treats AI changes as software changes — functional testing, rollback documentation, CAB approval. AI-specific gates that standard IT change processes miss: out-of-sample performance comparison, segment-level fairness testing, India proxy variable fairness screening (caste/religion/language/disability), behavioral consistency testing for LLMs, and DPDP Act data processing impact assessment.
Read more →Model Validation
AI model revalidation banking: 8 triggers, full vs. targeted scope, LLM re-validation challenges, and India proxy variable retesting requirements
Trigger-based re-validation occurs when something changes, not on schedule. 8 triggers from SR 11-7 and RBI eMRM including performance breach, material data change, significant use change, and vendor model update. LLM re-validation: behavioral consistency testing, RAG corpus change as a new trigger, demographic-level consistency. India requirement: proxy variable re-testing on new geography or feature addition.
Read more →Regulatory Reporting
AI regulatory reporting banking: what RBI, SEBI, SR 11-7, and DPDP Act require — evidence packs, formats, and the 48-hour production test
Regulatory reporting is continuous evidence collection, not a document-assembly exercise before examination. 6 framework obligations mapped to specific evidence requirements, 7-component examination evidence pack per AI system, India proxy variable documentation requirement, and examination formats for model cards, validation reports, committee approvals, and audit trail exports.
Read more →Governance Committee
AI governance committee banking: mandate, membership, meeting cadence, escalation triggers, and what the board needs to see quarterly
A model risk committee is not an AI governance committee. 7-responsibility mandate including fairness oversight, India proxy variable testing review, and AI incident governance. 8-member committee structure with voting/non-voting roles, 4-tier meeting cadence, 8 escalation triggers with response timelines, and quarterly board reporting framework.
Read more →Governance Policy
AI governance policy for banking: 10 required sections, RBI FREE-AI and SR 11-7 mapping, India proxy variable requirements, and common gaps
An AI governance policy covers LLMs, agents, and fairness obligations that a model risk policy does not. 10 required sections including India-specific proxy variable registry (caste/religion/language/disability), decision-level explainability, third-party AI requirements, and board-approved AI risk appetite with domain-level tolerance thresholds.
Read more →Model Lifecycle
AI model lifecycle banking: 7 stages from development to decommission, governance stage gates, re-validation triggers, and what must be retained post-decommission
7-stage lifecycle with mandatory stage gates: risk pre-assessment → data governance → development/docs → independent validation → staged deployment → production monitoring → decommission. 8 re-validation triggers. Decommission retention: decision feature vectors, model card, validation reports, audit trail, Forensic Replay — 7–10 years under RBI guidelines.
Read more →Chatbot Governance
AI chatbot governance banking: RBI FREE-AI requirements, 4 prohibited use cases, 3-level hallucination controls, and required disclosures
Customer-facing AI reaches customers as fact without human review. RBI FREE-AI: all 5 pillars apply, including regional language fairness and behavioral consistency. Prohibited: SEBI investment advice, IRDAI insurance recommendations, grievance resolution. 3-level hallucination controls: RAG documentation grounding, live numerical verification, behavioral consistency monitoring.
Read more →Fraud Governance
AI fraud detection governance: why aggregate FPR hides segment failures, how a model can simultaneously over-detect and under-detect by segment, RBI FREE-AI requirements
Aggregate FPR within threshold masks rural/senior segment FPR 6× higher. Model simultaneously over-detects (blocks legitimate rural transactions) and under-detects (misses rural fraud) due to training data imbalance. RBI FREE-AI: segment-level FPR/FNR monitoring required. Explainability-confidentiality resolution: real-time general category, post-hoc via verified channel, Forensic Replay for examiners.
Read more →Third Party Risk
AI third party risk banking: what SR 11-7 requires from vendor models, why international vendor certifications don't satisfy RBI examination, and 6 due diligence steps
Banks cannot outsource AI governance to vendors — SR 11-7 validation obligation stays with bank. 6-stage vendor due diligence: risk classification, documentation review, India fairness testing, security assessment, 4 contract clauses, ongoing governance integration. India-specific: proxy variable testing, DPDP Act data processing, RBI data residency.
Read more →Data Governance
AI data governance for banking: training data quality, feature store controls, DPDP Act 2023, and the India proxy variable problem no international framework addresses
RBI FREE-AI data requirements per pillar. DPDP Act: purpose limitation, data subject rights in AI decisions, data minimization. Four India proxy variable categories: caste (pincode/surname), religion (counterparty name/geographic), language (mobile/social), disability (device usage). Feature store governance: lineage, proxy registry, version control, freshness monitoring, access audit.
Read more →Model Documentation
AI model documentation for banking: 7 required sections, model card vs validation report, and India-specific requirements no international template includes
Seven required model card sections: identity, training data, performance by demographic group, limitations/failure modes, fairness metrics, explainability, monitoring. India requirements: proxy variable testing (caste/religion/language/disability), DPDP data disclosure, FREE-AI pillar mapping, eMRM behavioral consistency.
Read more →Governance Maturity
AI governance maturity model for banking: five levels from Reactive to Governed — and the gap most Indian banks face when examination arrives
Five-level maturity model: Level 1 Reactive to Level 5 Governed. Level 4 Measured requires residual risk quantification per domain. Most Indian banks sit at Level 2 (Catalogued) — RBI examination expects Level 4. Advancement roadmap: risk atlas construction, India proxy variable fairness testing, control effectiveness scoring.
Read more →Regulations
AI explainability regulations for banking: RBI FREE-AI Pillar 3, EU AI Act Article 86, SR 11-7 — and why SHAP satisfies all three but LIME does not
Four regulatory requirements from four frameworks, four different audiences. SHAP vs LIME comparison for regulatory examination: SHAP satisfies global consistency property (individual explanations always consistent with global model behavior); LIME individual explanations can contradict global behavior — EU AI Act Art. 86 dispute risk, SR 11-7 validation finding risk.
Read more →Board Governance
AI risk appetite for banking: domain thresholds, the residual risk formula, and why a qualitative statement is not enough for RBI examination
Five components of a board AI risk appetite statement: scope, domain thresholds, escalation triggers, prohibited use cases, review cadence. Example domain appetite table with max acceptable residual risk and escalation triggers for Fairness, Security, Reliability, Explainability, Agentic, Privacy. RBI FREE-AI Ethics pillar board accountability requirements.
Read more →AI Frameworks
ISO 42001 for banking: AI management system requirements, RBI FREE-AI mapping, and where Indian banks still have gaps after certification
ISO 42001 vs RBI FREE-AI vs SR 11-7 vs EU AI Act crosswalk. What ISO 42001 provides that other frameworks don't: international certification, management system discipline, EU AI Act conformity pathway. India gaps after certification: proxy variable fairness, eMRM behavioral consistency, Forensic Replay not covered by ISO 42001.
Read more →EU AI Act
EU AI Act banking compliance 2026: credit scoring explicitly high-risk, Article 86 explanation right, €35M or 7% turnover penalty
Credit scoring listed by name in Annex III. Article 86 explanation right for every declined application. 2026 enforcement timeline. High-risk requirements: conformity assessment, technical documentation, logging, human oversight. India banks with EU operations: dual compliance RBI FREE-AI + EU AI Act.
Read more →Agentic AI
Agentic AI governance in banking: authorization scope manifest, human checkpoints for irreversible actions, and RBI eMRM requirements
Five governance failure modes unique to agents: scope creep, indirect prompt injection, authorization chain breaks, context window poisoning, tool call audit gaps. Authorization scope manifest contents. RBI eMRM four new agentic requirements (June 2026). Human checkpoint architecture for irreversible banking actions.
Read more →AI Compliance
AI compliance program for banking: five components, the disconnected program failure pattern, and what RBI FREE-AI requires at program level
Documentation vs evidence — the distinction RBI examiners make. Five-component structure: inventory and risk tiering, control testing, Forensic Replay audit trail, monitoring and exception management, board reporting. Most common examination finding: all five exist but none connect to deployed models.
Read more →Governance Tools
AI governance tools for banking: eight categories, what generic platforms miss, and how to evaluate vendors
Model inventory, risk scoring, guardrails, explainability, fairness testing, audit trail, monitoring, GRC integration — 8 tool categories BFSI teams need. What international vendors miss for India: RBI FREE-AI, eMRM, DPDP Act, India proxy variable fairness. Six evaluation criteria that separate BFSI-fit vendors from generic enterprise tools.
Read more →LLM Security
LLM security in banking: six threat categories, guardrails architecture, and what RBI examiners check
Prompt injection, indirect injection, PII exfiltration, jailbreak, KV cache leakage, hallucination with financial consequences — six LLM threats banks must govern. Three-layer guardrails: input classification, output verification, behavioral monitoring. RBI FREE-AI Security and Reliability pillar requirements.
Read more →AI Security
AI security in banking: the attack surface traditional cybersecurity doesn't see — and what RBI FREE-AI's Security pillar requires
Adversarial examples, prompt injection, KV cache leakage, agentic scope violations, model extraction — eight AI threats standard intrusion detection cannot see. OWASP LLM Top 10 for BFSI. RBI FREE-AI Security pillar: five required control categories.
Read more →Model Risk
AI model risk management for banking: five dimensions traditional MRM misses — and how RBI's eMRM closes the gap
Behavioral consistency, adversarial robustness, India proxy variable fairness, agentic AI action scope, vendor model independence — how to extend SR 11-7 and RBI MRM for LLMs and agentic AI without rebuilding from scratch. RBI eMRM four new requirements mapped.
Read more →LLM Governance
LLM hallucination management for banking: six BFSI-specific failure modes, detection methodology, and RBI FREE-AI Reliability requirements
Regulatory deadline fabrication, product term invention, context contamination, compliance status hallucination — the six failure modes standard quality metrics miss. Three-layer mitigation architecture: context quality controls, post-generation entity checking, behavioral consistency monitoring.
Read more →AI Compliance
AI compliance checklist for banking: 42 requirements across RBI, SR 11-7, EU AI Act, and DPDP Act
Structured checklist covering model inventory, audit trail, India fairness testing, explainability, security, monitoring, and board governance requirements — organized by framework and area, with implementation sequence for fastest examination-readiness.
Read more →Risk Assessment
AI risk assessment for banking: how to score inherent risk, measure control effectiveness, and produce board-ready residual scores
Inherent risk scoring (impact × likelihood), control effectiveness measurement across four dimensions (coverage, effectiveness, testability, regulatory alignment), residual risk heat maps by domain. What RBI FREE-AI, SR 11-7, and EU AI Act require from an AI risk assessment.
Read more →India · Framework
AI governance framework for India: six components, India-specific proxy variable testing, and what RBI FREE-AI, DPDP Act, SEBI, and IRDAI require
What makes India's AI governance framework unique — caste, religion, language, disability proxy variable testing; per-incident DPDP Act penalty structure; sectoral regulatory architecture; RBI eMRM behavioral consistency testing. Six framework components with regulatory mapping.
Read more →SR 11-7 · AI
SR 11-7 AI compliance: five gaps where traditional model risk management falls short for machine learning and LLMs
Behavioral consistency testing for LLMs, vendor model independent validation, fairness testing beyond demographics, agentic AI authorization scope, Forensic Replay audit trail — how to extend SR 11-7 for AI without rebuilding your MRM program.
Read more →BFSI Governance
BFSI AI governance 2026: what banks, NBFCs, and insurers must build — RBI, SEBI, IRDAI, DPDP Act requirements
Seven governance components for BFSI, the India-specific regulatory stack (RBI FREE-AI, RBI 2024 AI Circular, DPDP Act, SEBI, IRDAI), and what makes BFSI AI governance structurally different from other sectors.
Read more →AI Risk Management
AI risk management in banking: 21 risk domains, how to measure residual exposure, and what regulators examine
141 risk categories across 21 AI governance domains — why AI risk differs structurally from traditional banking risk, how to measure residual exposure after controls, and what RBI, SR 11-7, and EU AI Act examiners look for.
Read more →AI Regulation
AI regulation in banking 2026: every framework that applies, what each requires, and how to comply from one program
RBI 2024 AI Circular, FREE-AI, eMRM, EU AI Act, SR 11-7, SEBI Responsible AI, DPDP Act, MAS TRM — complete mapping of which regulations apply to which bank type, what each requires, and the integration methodology for one governance program satisfying all of them.
Read more →Governance Program
How to build an AI governance program for banking: eight components, implementation sequence, and examination-ready evidence
Board governance, model inventory, risk assessment, validation, explainability, fairness testing, monitoring, audit trail — the eight components of a bank AI governance program, the sequence that produces maximum regulatory coverage, and what examination-ready evidence looks like for RBI, SR 11-7, and EU AI Act.
Read more →Explainability
AI explainability in banking: five levels, why SHAP is the regulatory standard, and what RBI FREE-AI and EU AI Act require
Decision-level vs model-level explainability, SHAP vs LIME for examination-level evidence, customer credit denial explanation, RBI FREE-AI Explainability pillar, EU AI Act Art. 13 and Art. 86 — five levels of explainability and what each requires from a banking AI program.
Read more →RBI · eMRM
RBI eMRM compliance: what India's June 2026 draft extended model risk management requires — and why to align now
Vendor model independent validation, India-specific fairness testing, behavioral monitoring for LLMs, agentic AI governance — how RBI eMRM extends existing MRM and the preparation sequence before finalization.
Read more →Credit AI Governance
AI credit scoring governance: validation, disparate impact testing, and why EU AI Act classifies credit AI as high-risk
Five governance dimensions for credit AI — SR 11-7 validation, India proxy variable fairness testing, SHAP explainability for credit denial, EU AI Act Annex III high-risk classification, and RBI FREE-AI full-pillar requirements.
Read more →Model Risk
AI model monitoring for banking: why performance monitoring is not enough for LLMs
Performance monitoring vs behavioral monitoring — what SR 11-7 requires, why LLM behavioral drift doesn't appear in quality metrics, RBI FREE-AI Reliability pillar, and the three-layer monitoring architecture for BFSI AI.
Read more →India · Regulations
AI governance in India 2026: RBI, SEBI, DPDP Act, IRDAI, MeitY — complete regulatory landscape
Every active AI governance obligation for India — RBI 2024 AI Circular, FREE-AI, eMRM, SEBI Responsible AI, DPDP Act, IRDAI. India-specific characteristics: per-incident DPDP Act exposure, proxy variable fairness testing, RBI audit trail vs EU AI Act logging. One program for all regulators.
Read more →Fairness
AI fairness in banking: India-specific proxy variables and what RBI FREE-AI requires
Why standard fairness testing is insufficient for India — caste, religion, language, and disability proxy variables, disparate impact testing methodology, and what RBI FREE-AI Fairness pillar examination evidence must show.
Read more →Responsible AI
Responsible AI in banking: SEBI's circular, RBI FREE-AI's five pillars, and what governance requires in practice
What SEBI's Responsible AI circular requires from capital markets firms, what RBI FREE-AI defines for banks, and the five capabilities that distinguish genuine responsible AI governance from responsible AI statements.
Read more →Security
AI security for financial services: ten threat categories and the controls that address each
Prompt injection, adversarial examples, cross-tenant leakage, model extraction, data poisoning, supply chain attacks — the attack surface traditional cybersecurity doesn't cover and BFSI-specific controls required by RBI FREE-AI, EU AI Act, and NIST AI RMF.
Read more →Compliance
AI compliance for banking: what RBI, SR 11-7, and EU AI Act require — and how to satisfy all three from one program
Which AI compliance obligations are active now, what examination evidence must show, the most common gaps RBI examiners find, and the integration approach that produces one governance program satisfying all three regulatory frameworks.
Read more →LLM Governance
LLM governance for banking: seven controls before deploying large language models in BFSI
Production guardrails, behavioral consistency monitoring, KV Cache isolation, adversarial evaluation, agentic scope controls, Forensic Replay, and inference-level audit trail — how LLM governance differs from statistical model governance and what regulators require.
Read more →Risk Management
AI risk management framework for banking: six components, one sequence, what regulators check first
Board governance, model inventory, risk assessment, validation, monitoring, audit trail — what each component must contain and the build sequence that produces maximum regulatory coverage for RBI, SR 11-7, and EU AI Act examinations.
Read more →Frameworks
NIST AI RMF for banking: how to implement GOVERN, MAP, MEASURE, MANAGE in BFSI
The integration methodology that makes one governance program satisfy RBI FREE-AI, SR 11-7, EU AI Act, and ISO 42001 simultaneously — with implementation sequence and framework crosswalks.
Read more →Generative AI
Generative AI risk in banking: eight failure modes that don't exist in traditional AI
Hallucination, prompt injection, cross-tenant leakage, excessive agency, context drift — the LLM risk categories traditional model risk management governance misses entirely, and the governance architecture that addresses each.
Read more →Model Risk
AI model validation for banking: beyond SR 11-7 for machine learning and LLMs
Six dimensions of AI model validation — adversarial robustness testing, India-specific fairness, SHAP explainability validation, LLM behavioral baseline — plus what RBI eMRM's independent validation requirement means in practice for vendor models.
Read more →Security
AI incident response for banking: playbook, root cause analysis, and regulatory reporting
P1–P4 AI incident classification, six-phase IR playbook, Forensic Replay for LLM root cause analysis, and notification requirements for RBI Cyber Security Framework, DPDP Act, EU AI Act Art. 73, and MAS TRM.
Read more →Security
OWASP LLM Top 10 for banking: how each risk manifests in BFSI and what banks must control
OWASP LLM01–LLM10 applied to customer service chatbots, agentic loan processing, AML document analysis, and internal banking AI — with BFSI-specific attack scenarios, regulatory mapping (RBI FREE-AI, DPDP Act, EU AI Act), and FinProof adversarial coverage.
Read more →Board Governance
AI board reporting for banks: the five metrics directors need and what RBI expects from board AI oversight
What bank boards must see on AI governance — residual risk heat maps, validation coverage, open findings, monitoring breaches, and regulatory readiness. How to set AI risk appetite and what RBI 2024 AI Circular requires from board-level oversight.
Read more →Governance
AI audit trails in banking: what regulators actually ask for — and what most banks can't produce
The difference between inference logs (what happened) and audit trails (that it was governed). Five-layer audit trail framework, hash-chaining for tamper-evident evidence, and what RBI 2024 AI Circular, SR 11-7, and EU AI Act Art. 12 require.
Read more →Model Risk
AI model inventory for banks: what SR 11-7 and RBI eMRM require — and how to build one
The 12-field model inventory that satisfies SR 11-7, RBI eMRM, and EU AI Act examination — risk tiering methodology, vendor model coverage, and what makes an inventory examination-ready vs just a list.
Read more →Fintech
AI governance for India fintech: payment aggregators, P2P lenders, and WealthTech
RBI payment aggregator AI obligations, P2P NBFC credit scoring governance, SEBI robo-advisor requirements, and the DPDP Act per-incident amplifier for fintech transaction volumes.
Read more →Frameworks
AI governance frameworks for banking: NIST AI RMF vs ISO 42001 vs EU AI Act vs RBI compared
Decision guide for BFSI institutions: which framework applies, what each requires, and how to build one governance program that satisfies NIST AI RMF, EU AI Act, RBI FREE-AI, SR 11-7, and ISO 42001 without building five separate compliance programs.
Read more →Model Risk
AI model drift in banking: context drift, distribution shift, and SR 11-7 monitoring gaps
SR 11-7 performance metric monitoring doesn't detect context drift in deployed LLMs. How to build a drift monitoring program that covers data drift, concept drift, and context drift — with RBI eMRM and EU AI Act post-market monitoring requirements.
Read more →Vendor Risk
Third-party AI vendor risk for banks: RBI eMRM, MAS TRM §12, and SR 11-7 obligations
Vendor attestations are not independent validation. RBI eMRM requires banks to independently validate third-party AI models — including credit scoring APIs, LLM services, and fraud detection platforms. Eight-point due diligence framework and contract requirements.
Read more →Explainability
AI explainability for banking: SHAP, LIME, and regulatory evidence for RBI and EU AI Act
SHAP vs LIME for credit decisions, five explainability levels mapped to decision impact, and examination-ready evidence requirements for RBI FREE-AI Explainability pillar, EU AI Act Art.13/14, and SR 11-7.
Read more →Fairness
AI bias testing for banking: fairness evaluation for credit and lending AI
India-specific disparate impact testing covering caste, religion, disability, and language — the protected characteristics Indian banks are actually liable for. Regulatory evidence for RBI FREE-AI, eMRM, EU AI Act, and SEBI fairness requirements.
Read more →Security
KV Cache governance for banking AI: cross-tenant data leakage and isolation enforcement
How shared LLM inference caches create DPDP Act violations at scale, what regulatory frameworks require, and Forensic Replay — Zytra's unique capability to reconstruct the exact model context state for regulatory investigation.
Read more →Security
AI red teaming for banking: adversarial evaluation against BFSI threat categories
FinProof benchmark B-01 to B-14, five-phase BFSI adversarial methodology, and regulatory evidence requirements for SR 11-7 robustness testing, RBI eMRM validation, and EU AI Act Art.15.
Read more →Global Banks
MAS TRM and AI governance: what Singapore and global banks must implement
MAS Technology Risk Management Guidelines §5/7/9/12/13 and FEAT Principles for AI — with dual regulatory architecture for banks operating across Singapore and India under both MAS and RBI.
Read more →Risk & Regulatory
Cost of AI non-compliance in India: DPDP Act ₹250 Cr, RBI enforcement, and SEBI penalties
What AI regulatory non-compliance actually costs India BFSI firms — per-incident framing for the DPDP Act, published RBI enforcement precedents, SEBI penalties, and the hidden costs boards should model before the ROI conversation.
Read more →NBFC
NBFC AI compliance 2026: RBI, DPDP Act, and governance that scales
AI compliance for India's 9,500+ NBFCs — alternative data credit scoring, collections AI, digital onboarding — with RBI FREE-AI, eMRM, Digital Lending Guidelines, and DPDP Act obligations mapped to proportionate controls.
Read more →Insurance
IRDAI AI governance for Indian insurers: underwriting, claims, and DPDP Act
IRDAI's AI governance requirements across underwriting AI, claims automation, fraud detection, and customer service — with DPDP Act sensitive personal data obligations that exceed banking requirements.
Read more →Model Risk
Model risk management for AI: extending SR 11-7 to machine learning and generative AI
Six SR 11-7 gaps for AI, required extensions, RBI eMRM alignment, MRC approval process for LLMs, and what examination documentation actually looks like. The complete MRM framework for banking AI.
Read more →Agentic AI
Agentic AI in BFSI: governance for loan agents, fraud agents, and KYC agents
Use-case-specific governance for the four major BFSI agentic deployments — with distinct risk profiles, regulatory obligations, and controls for each. No generic governance framework covers this.
Read more →Agentic AI
Agentic AI risk in banking: governance beyond model validation
D-09 indirect injection, D-10 authorization boundary creep, D-11 multi-agent coordination failures — the three agentic risk categories SR 11-7 doesn't cover, with controls and regulatory mapping.
Read more →Model Risk
LLM hallucination in banking: detection, measurement, and regulatory evidence
Factual fabrication, citation hallucination, and omission hallucination in BFSI — what RBI FREE-AI, eMRM, and EU AI Act require, and how to produce examination-ready evidence.
Read more →Security
Prompt injection in banking: OWASP LLM01 for BFSI
Direct and indirect injection attacks, why standard guardrails fail in banking, regulatory mapping (RBI FREE-AI, eMRM, SEBI, EU AI Act), and how to measure detection effectiveness.
Read more →Resource
AI Governance Checklist for Banks: 50 Controls Across 8 Domains
50-point checklist mapped to SR 11-7, EU AI Act, RBI 2024, FREE-AI, eMRM, SEBI, and DPDP Act. Use before any regulatory examination.
View checklist →Technical
SR 11-7 and generative AI: six things your model risk management framework doesn't cover
SR 11-7 was designed for statistical models. Generative AI breaks six of its core assumptions — from non-deterministic validation to prompt injection to agentic authorization risk.
Read more →Landscape
India AI Governance 2026: every regulation, every obligation, every deadline
RBI, SEBI, DPDP Act, MeitY — India's complete four-layer AI governance landscape for banking, with implementation priority order and the full timeline of how it was built.
Read more →Policy
MeitY National AI Governance Guidelines 2025: what Indian banks must know
India's four-layer AI governance stack: MeitY national framework, RBI sector obligations, SEBI requirements, and DPDP Act — how they interact and what financial services firms must implement.
Read more →Compliance
SEBI Responsible AI 2025: governance principles for capital markets intermediaries — control-level mapping
First control-level mapping of SEBI's June 2025 responsible AI consultation: Fairness, Accountability, Transparency, Robustness, Privacy, Explainability — what brokers, advisers, and exchanges must implement.
Read more →Compliance
RBI eMRM 2026: enhanced Model Risk Management for Indian banks — independent validation mandatory
RBI's June 2026 draft eMRM guidelines mandate independent validation for all AI/ML models including third-party vendor models. Tier classification, validation lifecycle, and what Indian banks must implement.
Read more →Compliance
DPDP Act 2023: AI compliance checklist for Indian banks — inference pipeline obligations
What India's data protection law requires at the AI inference layer — consent verification, PII detection, data minimisation, and why pipeline-level compliance cannot wait for Rules notification.
Read more →Compliance
RBI FREE-AI Framework: 26 recommendations for Indian banks — clause-level mapping
All 26 FREE-AI recommendations mapped to implementation controls, evidence required, and Zytra capabilities. No other vendor has published this mapping.
Read more →Compliance
RBI AI Circular 2024: a compliance checklist for Indian banks
Clause-level breakdown of all six RBI obligations — what evidence an examiner will ask for and what controls you need in place before the inspection.
Read more →Product
Shifting governance left with the Zytra SDK
Embedding policy checks directly into CI/CD so compliance evidence is a by-product of shipping, not a separate workstream.
Read more →Perspective
Agentic AI in banking: the new governance frontier
Why agent-to-agent interactions demand network-level oversight, and why model validation misses the failure modes that matter.
Read more →Compliance
RBI, SEBI & DPDP: mapping India's AI rules to controls
A practical crosswalk from India's three active AI regulatory frameworks to a single controls program that satisfies all three.
Read more →India BFSI · All Regulators · Complete Guide · 2026
India BFSI AI governance 2026: complete RBI, SEBI, IRDAI, NPCI and DPDP compliance guide — the multi-regulator map no international platform has built
The only complete multi-regulator AI governance map for India BFSI. Five regulators (RBI MRMF, SEBI AI/ML guidelines, IRDAI Working Group 2026, NPCI Unified Agent Protocol, DPDP SDF obligations) — mapped by entity type (bank, insurer, broker, NBFC, payment bank), with India-specific obligations no international framework covers: proxy variable fairness, vernacular explainability, PMJDY segment monitoring, data localization for AI artifacts.
Read more →IRDAI · Insurance AI · India · Working Group 2026
IRDAI AI governance insurance India 2026: Working Group June 17 framework, claims AI, underwriting AI, fraud detection, chatbot guardrails, and DPDP Act policyholder obligations
IRDAI Working Group on AI formed June 17, 2026 — India's first insurance-specific AI governance framework. Five use cases: claims settlement AI (accuracy, explainability), underwriting AI (fairness, proxy discrimination), fraud detection AI (FPR governance), distribution AI (suitability), customer chatbots (financial advice boundary). LIC, SBI Life, HDFC Life, Star Health, ICICI Lombard compliance timelines. DPDP Act health data consent for underwriting AI. 5-step IRDAI compliance plan.
Read more →NPCI · UPI · Agentic AI · Payments · India 2026
NPCI UPI agentic AI payments governance India 2026: sovereign AI model, FiMI LLM, Unified Agent Protocol, and authorization boundary controls for banks
NPCI × NVIDIA sovereign AI model (November 2025); FiMI LLM 1M+ users; Unified Agent Protocol (UAP) enabling agentic UPI payments. Three authorization boundary risks: scope creep, agent compromise, cascading authorization failures. FREE-AI Recommendations 3/9/14/19/22 mapped to agentic payments. Five governance requirements for banks deploying agentic payment AI: intent verification, per-transaction authorization caps, behavioral monitoring, kill-switch obligations, NPCI consent architecture compliance.
Read more →Get research & product updates
Occasional notes on AI safety, benchmarks and BFSI governance, no spam.