What AI/ML governance obligations does IFSCA's TechFin and Ancillary Services Regulations 2025 create for technology companies serving GIFT City financial institutions?

IFSCA (TechFin and Ancillary Services) Regulations, 2025 (IFSCA/GN/2025/005, notified July 8, 2025, effective July 10, 2025) creates the first dedicated AI/ML licensing and governance regime for technology companies serving financial institutions in GIFT IFSC. Five core AI governance obligations: (1) Mandatory IFSCA registration for AI/ML service providers: any entity offering AI/ML, machine learning, Big Data Analytics, RegTech, or related technology services to financial institutions in GIFT IFSC must obtain a Certificate of Registration from IFSCA. No grandfathering — technology companies already providing AI services to GIFT City financial institutions must register within the transition window. AI/ML is explicitly listed as a first-class permitted TechFin service category alongside Web 3.0, Blockchain, Quantum Computing, and IoT. This is the first Indian financial regulatory framework that requires AI/ML vendors to hold a regulatory licence before serving financial institutions; (2) Fit and proper criteria for AI vendors and their key management personnel: all registered TechFin entities and their principal officers, directors, and key management personnel must satisfy IFSCA's fit and proper criteria — covering technical competence, financial integrity, absence of regulatory disqualification, and character assessment. This is the first time fit and proper criteria have been applied to AI developers and vendors in India's financial regulatory space. A SEBI-registered intermediary deploying a third-party AI model from a TechFin vendor must now verify that the vendor and its key personnel satisfy IFSCA's registration and fit and proper requirements; (3) Mandatory Code of Conduct for all TechFin registrants: registered entities must comply with a mandatory Code of Conduct covering regulatory compliance, investor and client protection, prompt disclosure of significant operational changes, and maintenance of adequate technical and financial resources. Critically, a 'significant operational change' in the AI/TechFin context includes material changes to AI models, data pipelines, training data sources, or algorithmic approaches — requiring proactive disclosure to IFSCA, not just retrospective notification; (4) IFSCA direct enforcement jurisdiction over AI service providers: IFSCA retains inspection, registration suspension, and enforcement powers specifically over TechFin registrants. This creates a direct regulatory accountability chain for AI vendors serving GIFT City financial institutions — IFSCA can act against the AI vendor directly, rather than acting against the financial institution and expecting it to manage its vendors; (5) Transition compliance deadline: existing Ancillary Service Providers and TechFin entities registered under the prior IFSCA (Ancillary Services) Regulations 2021 and IFSCA (FinTech Incentive Scheme) Regulations 2022 must complete transition to the new consolidated registration framework by July 10, 2026.

How does IFSCA's jurisdiction differ from SEBI, RBI and IRDAI for AI governance, and why does it matter for GIFT City financial institutions?

GIFT IFSC (International Financial Services Centre) is a separate regulatory jurisdiction from the domestic Indian financial market — it operates under the IFSCA Act, 2019, and IFSCA is the unified single regulator for all financial services within GIFT City. SEBI, RBI, and IRDAI regulations do not extend to GIFT City entities unless IFSCA has specifically adopted them by reference. This creates four distinct governance implications for AI in GIFT City: (1) Separate regulatory authority: a bank operating as an IFSC Banking Unit (IBU) in GIFT City is regulated by IFSCA, not RBI. The RBI's AI governance circulars — FREE-AI, MRMF, AI-ACT&RS — apply to domestic Indian banks. The IBU's AI governance obligations are set by IFSCA. The TechFin Regulations 2025 are the primary AI governance instrument for GIFT City entities and their technology vendors; (2) Broader entity population: GIFT City hosts a unique mix of financial institutions not present in the domestic market in the same regulatory configuration — IBUs, international mutual funds, foreign insurance offices, aircraft leasing SPVs, maritime finance companies, hedge funds, and fund management entities (FMEs) operating under IFSCA's FME framework. All of these entities, and the AI vendors serving them, are governed by IFSCA's TechFin Regulations — not by RBI or SEBI AI governance instruments; (3) Separate AI vendor licensing: unlike the domestic market where SEBI's Chapter III-A imposes sole liability on the financial intermediary for its AI vendors, IFSCA's TechFin Regulations directly license and regulate the AI vendors themselves. This creates a two-sided governance structure unique to GIFT City — the financial institution has obligations under its sector-specific IFSCA regulations, and the AI vendor has independent registration and conduct obligations under the TechFin Regulations; (4) Global financial services AI governance context: GIFT City is India's gateway to global financial markets. GIFT City entities transact with international counterparties and are subject to international standards (FATF, IOSCO, BCBS, IAIS). IFSCA's AI governance framework for GIFT City must be understood alongside international AI governance standards — the TechFin Regulations create the domestic governance foundation, but GIFT City entities may also need to consider IOSCO AI standards, BCBS AI operational risk guidance, and IAIS AI insurance standards for their cross-border operations.

Which AI/ML service categories require mandatory IFSCA registration under the TechFin Regulations 2025?

The IFSCA (TechFin and Ancillary Services) Regulations 2025 enumerate approximately 50 permitted TechFin service categories across several technology domains. AI/ML-related categories that require registration include: (1) AI/ML and Machine Learning services: the primary category covering providers of AI models, ML pipelines, AI-powered analytics platforms, and AI decision-support systems used by financial institutions in any capacity — underwriting, credit assessment, fraud detection, compliance monitoring, customer service, portfolio management, risk management; (2) Big Data Analytics: providers of large-scale data processing platforms, analytical engines, and data-driven insight tools that may incorporate AI components — including alternative data providers, ESG data analytics platforms, and real-time market data analytics; (3) RegTech: providers of regulatory compliance technology including AI-powered KYC/AML systems, automated regulatory reporting tools, AI-based surveillance platforms, and compliance workflow automation. RegTech is explicitly a first-class TechFin category under the Regulations; (4) Cybersecurity AI: providers of AI-powered threat detection, anomaly detection, vulnerability assessment, and incident response automation platforms serving GIFT City financial institutions; (5) Digital identity AI: providers of AI-based digital identity verification, biometric authentication, deepfake detection, and e-KYC platforms; (6) Cloud AI infrastructure: cloud service providers offering AI/ML computing services, model training infrastructure, and AI-as-a-service APIs to GIFT City financial institutions may fall within the ancillary services registration requirement depending on the nature and scope of their AI-specific service offerings. Note: the exact scope of which cloud providers require registration versus which qualify for an exemption is subject to IFSCA's regulatory guidance. Entities should seek IFSCA clarification on borderline cases rather than assuming an exemption.

What practical compliance steps must AI/ML vendors and GIFT City financial institutions take under the IFSCA TechFin Regulations 2025?

Compliance with the IFSCA TechFin Regulations 2025 requires action from both AI vendors and the financial institutions they serve: For AI/ML technology vendors serving GIFT City: (1) Registration assessment: determine whether the AI/ML services provided fall within the enumerated TechFin permitted activity categories; if so, prepare and file a Certificate of Registration application with IFSCA including technical capability description, key personnel fit and proper documentation, and financial resources evidence; (2) Transition registration if already operating: entities operating under prior IFSCA Ancillary Services 2021 or FinTech Incentive Scheme 2022 registrations must complete transition to the consolidated TechFin registration by July 10, 2026 — the transition window is not automatic renewal, it requires a new registration filing; (3) Code of Conduct compliance: establish internal governance for the Code of Conduct requirements — particularly the significant operational change disclosure obligation. Define what constitutes a material AI model change (retraining on new data, feature set changes, accuracy threshold changes, architectural changes) and implement a process for notifying IFSCA on such changes; (4) Fit and proper maintenance: ensure all principal officers, directors, and key management personnel remain continuously fit and proper — track any regulatory actions, insolvency events, or disqualification events that would trigger a fitness and propriety re-assessment; For GIFT City financial institutions (IBUs, FMEs, insurance offices, capital market intermediaries): (1) Vendor verification: before procuring AI/ML services from a technology vendor for GIFT City operations, verify that the vendor holds or has applied for an IFSCA TechFin registration. Continuing to use an unregistered AI vendor after the transition deadline creates regulatory risk for the financial institution; (2) Contract review: review existing AI vendor contracts to confirm the vendor's registration obligation is addressed — contracts should include representations as to registration status and obligations to notify the financial institution of any registration suspension or enforcement action; (3) Group entity considerations: where a financial institution's parent or group entity provides AI services to the GIFT City IBU or FME, assess whether the group entity requires a TechFin registration for that intra-group AI service provision.

AI Governance · IFSCA · GIFT City · TechFin · AI Licensing · India BFSI

IFSCA TechFin and Ancillary Services Regulations 2025: First Dedicated AI/ML Licensing Regime for GIFT IFSC — Mandatory Registration for AI Vendors, Fit and Proper Criteria Applied to AI Key Personnel and IFSCA Enforcement Jurisdiction Over AI Service Providers India

IFSCA (TechFin and Ancillary Services) Regulations 2025 (IFSCA/GN/2025/005, notified July 8, 2025, effective July 10, 2025) creates the first dedicated regulatory licensing regime for AI/ML service providers operating in GIFT IFSC — India's international financial services hub. Any entity offering AI/ML, Big Data Analytics, RegTech, cybersecurity AI, or digital identity AI to GIFT City financial institutions must obtain a Certificate of Registration from IFSCA. Fit and proper criteria — applied for the first time in India financial regulation to AI developers and vendors — cover technical competence, integrity, and regulatory disqualification for all key management personnel. A mandatory Code of Conduct requires proactive disclosure of significant operational changes including material AI model or pipeline changes. IFSCA holds direct enforcement jurisdiction over registered AI vendors — creating a two-sided governance structure unique in India's financial AI regulatory landscape. Transition deadline July 10, 2026 for existing service providers. Zero global competitor coverage.

Zytra Research Team · July 2025 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

Every major India BFSI AI governance circular — RBI's FREE-AI, MRMF, AI-ACT&RS; SEBI's Chapter III-A and Responsible Usage Framework; IRDAI's sector circulars — places accountability on the financial institution for its AI tools. IFSCA's TechFin Regulations do something different: they license the AI vendor directly.

In GIFT City, the AI technology company that sells a fraud detection platform or RegTech compliance engine to an IFSC Banking Unit is itself a regulated entity, subject to registration, fit and proper assessment, code of conduct obligations, and IFSCA enforcement. This is not just a vendor management requirement on the financial institution — it is a direct regulatory relationship between IFSCA and the AI vendor. No other Indian financial regulator has constructed this accountability structure.

GIFT City as a Separate AI Governance Jurisdiction

GIFT IFSC operates under the IFSCA Act, 2019, with IFSCA as the unified single regulator for all financial services. RBI, SEBI, and IRDAI AI governance circulars do not apply to GIFT City entities unless IFSCA has specifically adopted them. An IBU's AI governance obligations are set by IFSCA's own framework — primarily the TechFin Regulations 2025 and the IFSCA Cybersecurity Advisory 2026. GIFT City compliance teams that assume their parent bank's RBI-compliant AI governance framework also covers the IBU need to verify this assumption against IFSCA's specific requirements.

The AI Model Change Disclosure Obligation

The Code of Conduct's significant operational change disclosure requirement has a practical implication for AI vendors with iterative model development cycles: material AI model changes — retraining, feature set additions, architectural updates — may trigger a proactive disclosure obligation to IFSCA before the change is deployed to GIFT City financial institution clients. Vendors that ship frequent model updates to their GIFT City clients need to define what constitutes a "significant operational change" in their AI context and implement a governance process around that definition.

IFSCA TechFin AI Governance Compliance Checklist

☐ Registration assessment: AI/ML service provision to GIFT City financial institutions assessed against TechFin permitted activity categories; registration application filed or transition registration completed by July 10, 2026
☐ Fit and proper documentation: all principal officers, directors, and key management personnel fit and proper documentation prepared; fit and proper register maintained; material events (regulatory actions, insolvency) tracked
☐ Code of Conduct compliance: significant operational change policy defined; material AI model change definition documented; IFSCA disclosure process established
☐ Financial institution vendor verification: GIFT City financial institution confirmed vendor IFSCA registration status for all AI/ML service providers; vendor contracts include registration status representation
☐ IFSCA inspection readiness: registration documentation, fit and proper records, Code of Conduct compliance evidence — packaged for IFSCA inspection