In April 2026, the US Federal Reserve, OCC, and FDIC jointly released SR 26-2 — the successor to SR 11-7 after 15 years — and explicitly excluded agentic and generative AI from scope, characterizing them as "novel and rapidly evolving" and directing banks to apply SR 11-7 principles while awaiting dedicated guidance. That exclusion creates a governance vacuum in the US banking context.
RBI's MRMF, released in June 2026, takes no such exclusion. The six core requirements apply to all AI and ML models. Indian banks deploying agentic AI are already in MRMF scope — without the relief the US provided by SR 26-2's explicit exclusion. The implication: Indian banks face a more immediate agentic AI governance obligation than their US counterparts, in a regulatory environment where agentic AI deployment is accelerating as fast as anywhere else in Asia.
The governance debt calculation: HDFC Bank has 5 agentic AI use cases in production. RBI MRMF requires each to have a model inventory entry, risk tier classification, validation documentation, explainability documentation, human oversight protocol, and kill switch. If MRMF becomes final in Q4 2026 with a 12-month compliance timeline, HDFC has until Q4 2027. Building that governance documentation for 5 live agents and 14 more in development is a multi-quarter program — starting now is the only way to meet the deadline.
SBI's Know Your Agent (KYA) Framework: Five Governance Elements
State Bank of India Chairman CS Setty identified three pillars of agentic AI trust — accuracy, accountability, and access without asymmetry — and grounded them in a five-element Know Your Agent framework. KYA is the governance architecture for agentic AI deployment in Indian BFSI, analogous to KYC for customers.
Identity
Every agent has a documented identity: what it is, what it does, who owns it, and what system it represents. KYA register = RBI MRMF model inventory entry for agentic AI.
Authentication
Agents authenticate as authorized agents, not just API callers. Authentication must establish both agent identity and the principal identity the agent represents in each interaction.
Consent
Agents acting on customer data or initiating transactions must have specific, informed consent under DPDP Act 2023. Blanket "use AI for banking" consent is not sufficient for autonomous financial action.
Transaction Limits
Agents operate within defined authorization boundaries: per-agent, per-action-category, per-customer-account transaction limits. Limits define the ceiling of financial consequence without explicit human approval.
Revocation
Agents must be revocable by human principals immediately: customer revokes agent access, bank suspends agent, or MRMF kill switch is exercised. Effective immediately, no technical delay.
Indian Banks' Agentic AI Deployments and Governance Status
5 Live Agents + 14 Under Development + Agentic Studio
HDFC has built an internal AI platform with Agentic Studio (agent development) and Agentic Mesh (multi-agent orchestration). Five use cases in production span enterprise search, document extraction, voice agents, and model evaluation. Governance investment: the platform includes model evaluation and governance tools. MRMF obligation: each of the 5 live agents needs model inventory, risk tier, validation docs, and kill switch before MRMF compliance deadline. The 14 in development must be governed at design stage under CERT-In's secure-by-design mandate.
20-25 Standalone AI Agents
Kotak has 20-25 standalone agents in deployment across credit-bureau analysis, document intelligence, OCR, financial-statement analysis, and employee support. These are primarily internal operational agents — MRMF Medium risk tier — reducing immediate compliance urgency versus customer-facing agents. Governance priority: inventory all 20-25 agents, assign risk tiers, and identify which (if any) touch customer data or consequential decisions. Those that do require the same governance depth as customer-facing agents regardless of internal operational labeling.
KYA Framework as Governance Infrastructure
SBI's strategic position: build governance infrastructure before scaling agentic AI deployment. The KYA framework (identity, authentication, consent, transaction limits, revocation) provides the governance architecture for agentic AI at SBI's scale — 500M+ customers, 22,000+ branches. At that scale, agentic AI governance must be systematic rather than case-by-case. SBI's three-pillar model (accuracy, accountability, access without asymmetry) maps directly to RBI MRMF: accuracy maps to validation requirements; accountability to model inventory and audit trail; access without asymmetry to fairness, explainability, and financial inclusion obligations.
Pilot-to-Production Agentic AI Pipeline
Major private sector banks are accelerating from agentic AI pilots to production deployments in FY2027. Use cases include customer onboarding agents, KYC automation agents, loan origination agents, and customer service agents. Banks in the pilot-to-production transition face governance documentation timing risk: governance built after deployment means operating an MRMF-non-compliant agent in production for the duration it takes to build documentation. Zytra's governance infrastructure is designed to be built in parallel with or ahead of agent deployment — not as a post-production compliance exercise.
Four Agentic AI Governance Challenges Unique to India BFSI
Standard AI governance frameworks were designed for static, single-prediction models. Agentic AI — AI that plans, executes multi-step tasks, uses tools, and potentially delegates to other agents — requires governance at each of these dimensions. India's BFSI regulatory framework creates four specific governance challenges not present in other sectors:
Authorization boundary management: An agentic AI's scope of action may expand during operation as it discovers new tools, accesses new data, or receives instructions from other agents. RBI MRMF's model inventory must capture the authorized actions and data access of each agent — a static snapshot is insufficient for systems whose action scope is dynamic. Banks need authorization boundary monitoring: real-time tracking of what each agent is actually doing versus what it was authorized to do, with alerts for scope creep and automatic escalation to human oversight when boundaries are approached.
DPDP Act, RBI Fair Lending, Financial Inclusion, and Multi-Jurisdictional Agentic AI
- DPDP Act consent for agentic AI actions: Under India's Digital Personal Data Protection Act 2023, consent must be specific to purpose. An agentic AI that accesses customer account data, credit bureau data, and transaction history across multiple steps requires consent for each data access purpose — not a blanket consent for "AI banking." Banks deploying customer-facing agents must map every data access point in the agent workflow to a specific DPDP Act consent entry, document the consent basis, and build consent withdrawal mechanisms that immediately suspend agent access to that data category.
- Fair lending obligations for credit decision agents: Agentic AI used for credit decisions (loan origination agents, pre-qualification agents, credit limit adjustment agents) is subject to RBI's fair lending guidelines, MRMF's explainability requirements, and DPDP Act's data minimisation principle — simultaneously. A credit agent that makes a pre-qualification decision based on behavioral data inferred from account patterns must: explain the decision to the customer (MRMF), have used only data necessary for the credit decision (DPDP Act data minimisation), and demonstrate its decision criteria do not proxy for protected characteristics (RBI fair lending).
- Financial inclusion obligations for autonomous agents: RBI's financial inclusion mandate extends to AI agents. An agentic AI that optimizes account management, investment rebalancing, or loan servicing for digitally sophisticated customers while providing degraded service to rural, low-literacy, or feature-phone-based customers violates the financial inclusion principle of India's banking regulatory framework. Agentic AI governance must include inclusion testing: does agent performance differ systematically by customer segment, and if so, does the difference reflect customer preferences or AI capability gaps?
- Cross-border agentic AI for global banks in India: Global banks with India operations (Citi India, HSBC India, Standard Chartered India, JP Morgan India) are deploying agentic AI globally that inevitably affects India-customer interactions. An agentic AI in the bank's global infrastructure that handles India customers is subject to RBI MRMF for those customers' interactions, regardless of where the agent is hosted. Cross-border agentic AI governance requires: identifying which agents in the global infrastructure touch India-regulated customer relationships; mapping those agents to RBI MRMF requirements; and building India-specific governance documentation that satisfies RBI examination while the global governance program satisfies home-jurisdiction requirements.