GIFT City — India's International Financial Services Centre in Gandhinagar — hosts over 400 regulated entities: IFSC Banking Units of Indian and foreign banks, insurance companies, capital markets intermediaries, fund managers, alternative investment funds, and a growing population of TechFin companies providing AI-enabled financial services. IFSCA, its unified regulator, has moved quickly on AI governance.
In 14 months (July 2025 to July 2026), IFSCA issued three AI governance instruments — more than most comparable IFSC regulators globally. A comprehensive AI governance framework, aligned with India's national Seven Sutras and drawing from RBI, SEBI, and IRDAI approaches, is in development. For GIFT City entities, the question is not whether AI governance requirements are coming, but whether to build compliance infrastructure before or after the full framework issues.
Three AI Governance Instruments: Timeline and What Each Requires
IFSCA TechFin Regulations — AI/ML Companies Classified as Regulated Entities
IFSCA's TechFin Regulations formally classify AI and ML companies operating in GIFT City as "TechFins" — a distinct regulated category requiring IFSCA registration. Before this, AI/ML companies serving GIFT City financial entities occupied a classification grey zone. The TechFin framework resolves this: any AI/ML company providing services to IFSCA-regulated entities (banks, insurers, fund managers, capital markets intermediaries) must register as a TechFin with IFSCA. Registration creates disclosure obligations (capabilities, use cases, regulated entity clients) and subjects TechFins to IFSCA's conduct and data protection requirements. For GIFT City banks and other regulated entities: AI/ML vendors should be assessed for TechFin registration status. Using an unregistered TechFin may expose the regulated entity to regulatory scrutiny. For global AI governance platforms considering GIFT City: TechFin registration may be required if they provide AI governance tools to IFSCA-regulated entities.
IFSCA TechFin Regulations — July 10, 2025 · Currently bindingIFSCA-CSD/MSC/3/2026-DCS — Eleven Frontier AI Cyber Controls
IFSCA's first explicit AI issuance: Circular IFSCA-CSD/MSC/3/2026-DCS addresses frontier AI risks for regulated entities. Two structural governance controls (board-level review and human oversight) and nine cybersecurity-focused controls covering secure deployment, adversarial testing, incident response, access controls, monitoring, supply chain security, data security, documentation, and staff training. IFSCA explicitly states this is a cybersecurity advisory — the comprehensive AI governance framework is under development. The eleven controls are the current baseline for IFSCA examination of AI practices. GIFT City entities deploying frontier AI (LLMs, agentic systems, multimodal AI) are expected to implement all eleven controls. Documentation of compliance will be expected at examination.
IFSCA-CSD/MSC/3/2026-DCS · June 4, 2026 · Currently bindingIFSCA AI Survey Report — 65% GenAI Adoption Across 400+ Entities
IFSCA's AI Survey across GIFT City's regulated population found 65% of entities already using GenAI for financial services operations. The survey covers IBUs, insurance companies, capital markets intermediaries, fund managers, and TechFins. Key risk areas flagged: cross-border data flows (most GIFT City AI runs on global infrastructure — AWS, Azure, GCP — raising India data localization questions), third-party AI concentration risk (high vendor concentration across GIFT City entities using common LLM providers), and frontier AI opacity (LLM outputs in financial decision contexts with limited explainability). The survey is IFSCA's baseline for the forthcoming comprehensive AI governance framework — IFSCA now knows what is deployed and will calibrate framework requirements to the actual deployment landscape. Entities that disclosed deployments in the survey will have their governance programs assessed against those disclosures.
IFSCA AI Survey Report · July 30, 2026 · Signals forthcoming frameworkThe Eleven Frontier AI Controls (June 2026 Circular)
Board-Level Review
Board must establish oversight of AI deployments, specifically frontier AI. Board reviews AI risk appetite, approves high-risk AI use cases, receives periodic AI risk reporting. Structural governance requirement, not just cybersecurity. Evidence required: board minutes with AI agenda items, board-approved AI risk appetite statement.
Human Oversight
Meaningful human oversight capability for AI decisions with customer impact. Override capability must exist. Oversight model (HITL/HOTL/HIC) not specified — entity determines appropriate model for each use case. Documentation of human oversight mechanisms for each high-risk AI deployment required at examination.
Secure AI Deployment
Secure model deployment practices for frontier AI: hardened serving infrastructure, access controls on model weights and inference endpoints, network segmentation for AI inference services.
Adversarial Testing Pre-Deployment
AI systems tested for adversarial inputs before production deployment. For LLMs: jailbreak testing, prompt injection, harmful content generation. Documentation of pre-deployment test results required. Aligns with RBI MRMF red-teaming mandate.
AI-Specific Incident Response
Incident response plans specifically addressing AI system failures — not just generic IT incident plans. AI incident categories: model producing harmful outputs, adversarial attack detected, model drift causing incorrect decisions, third-party AI provider outage.
Access Controls for AI Parameters
Access controls on AI model parameters, training data, and fine-tuning pipelines. Privileged access management for AI infrastructure. Audit logging for parameter access events. Prevents unauthorized model modification and training data exfiltration.
Post-Deployment Monitoring
Continuous monitoring of AI system behavior after production deployment. Performance monitoring, anomaly detection, drift indicators. Aligns with MRMF's continuous monitoring requirement. GIFT City cross-border context: monitoring must detect behavioral drift introduced by provider-side model updates for third-party LLMs.
AI Supply Chain Security
Security assessment of third-party AI components, including LLM providers, AI model marketplaces, and fine-tuned model vendors. AIBOM (AI Bill of Materials) documentation — aligns with CERT-In Blueprint's AIBOM requirement for banking AI. For GIFT City: global AI supply chain assessment given heavy reliance on US/EU LLM providers.
AI Training and Inference Data Security
Data security specifically for AI training data and inference input data. Connects to RBI 2018 data localization circular for payment data in AI training pipelines. DPDP Act 2023 consent requirements for personal data in AI inference. Cross-border data flow governance for GIFT City entities using global AI infrastructure.
AI System Architecture Documentation
Documentation of AI system architectures — what components, what data flows, what external dependencies. AIBOM as the structured format. Foundation model documentation (aligns with MRMF requirement). Architecture documentation is the evidence baseline for all other controls: an examiner starts with architecture documentation to understand what is deployed before assessing other controls.
AI-Specific Staff Training
Staff awareness training on AI-specific cyber risks: prompt injection recognition, deepfake and synthetic content identification in financial contexts, AI-assisted social engineering, model output limitations awareness for staff acting on AI recommendations. Training records maintained for examination evidence.
What GIFT City Entities Should Do Now, Before the Full AI Governance Framework Issues
IFSCA's comprehensive AI governance framework — expected to add model governance, fairness, explainability, and bias testing requirements — is 12–18 months away. Entities that build ahead of it will present a governance program at examination. Entities that wait will face a compressed build timeline and potential supervisory attention for governance gaps in an already-deployed AI estate.
- Complete the eleven-control compliance baseline now. The June 2026 circular is already binding. Two structural controls (board-level review and human oversight) require governance work beyond cybersecurity: board agenda items on AI, board-approved AI risk appetite, human oversight mapping per AI deployment. Seven of the nine cybersecurity controls require documentation (AIBOM, architecture docs, test records, training records). Complete this baseline first — it is the foundation the forthcoming framework will build on.
- Build AI model inventory now. IFSCA's forthcoming framework will require a model inventory aligned with RBI MRMF's approach (given ReBIT's cross-institutional influence on India's AI governance standards). GIFT City entities that have a complete, documented inventory when the framework issues can immediately assess gaps. Those starting from scratch face mapping an entire deployed AI estate against the new requirements simultaneously.
- Map cross-border data flows for AI workloads. The IFSCA AI Survey flagged cross-border data flows as a primary risk area IFSCA will address in its full framework. GIFT City entities using global AI infrastructure (AWS Mumbai region but model training on AWS US regions, inference via Azure global endpoints, OpenAI API calls routing through US infrastructure) face data localization exposure under both IFSCA's forthcoming framework and RBI's 2018 payment data localization circular. Map every AI workload's data geography now: where is training data stored, where does inference happen, where are model weights stored.
- Align with MeitY Seven Sutras as the national layer. IFSCA's forthcoming framework will align with MeitY's Seven Sutras (Trust, People First, Innovation over Restraint, Fairness Equity, Accountability, Understandable by Design, Safety Resilience Sustainability) — the same national layer that RBI FREE-AI, CERT-In Blueprint, and IRDAI's working group all reference. Building your GIFT City AI governance program against the Seven Sutras now means the forthcoming IFSCA framework will require addition, not replacement, of governance controls already in place.