India BFSI AI Governance 2026: The Complete RBI, SEBI, IRDAI, NPCI & DPDP Compliance Guide

India has more active AI governance regulatory developments per square kilometre of financial services than any other jurisdiction on earth right now. Between June and October 2026 alone: the RBI published its Model Risk Management Framework draft (June 24), the IRDAI formed its AI Working Group (June 19), NPCI unveiled the Unified Agent Protocol at Global Fintech Fest Mumbai (September 8–11), SEBI announced AI/ML guidelines with kill-switch requirements, BCBS published AI in banking guidance (October 2026), and the FSB completed its sound practices consultation.

International AI governance platforms — Credo AI, Arthur AI, Holistic AI — have published nothing on any of these developments. Their content maps to EU AI Act, NIST AI RMF, and ISO 42001. These frameworks matter. But for a bank operating in India, they answer maybe 30% of the compliance question. The other 70% is distinctly Indian: proxy variable fairness, data localization, vernacular language explainability, and a multi-regulator stack that no single international framework addresses.

This guide maps the complete India BFSI AI governance landscape. It covers every active regulator, every major obligation, and what each means for banks, NBFCs, insurers, brokers, and payment system operators.

The Five Regulators Governing AI in India BFSI

India's AI governance obligations for financial services do not flow from a single regulator. Five distinct authorities have published or are developing rules that apply — often simultaneously — to a large Indian bank.

RBI: MRMF, FREE-AI, and the Model Risk Stack

The RBI's AI governance framework sits on two pillars. The first — FREE-AI (Framework for Responsible and Ethical Enablement of AI), published August 2025 — sets principles: Fairness, Robustness and Safety, Explainability, Ethics, and Accountability. The second — the Model Risk Management Framework (MRMF), published for comment June 24, 2026 — sets operational requirements. Both are in force or imminently enforceable for all 11 categories of RBI-regulated entities.

MRMF: What Banks Must Do

The MRMF is the most operationally demanding AI governance requirement India has yet produced. Key obligations:

• Board-approved model risk framework. The board must approve a written MRMF covering all AI and ML models in production. Vendor-supplied models are explicitly not exempt.
• Comprehensive model inventory. Every AI system — including third-party APIs used for credit scoring, fraud detection, or customer-facing applications — must be catalogued with risk tier, ownership, validation status, and deployment date.
• Independent model validation. Models must be validated by teams independent of the development function. For LLMs and agentic systems, the MRMF extends traditional SR 11-7-style validation to cover behavioral consistency, out-of-distribution testing, and authorization scope.
• Explainability for credit and fraud decisions. AI systems making or materially influencing credit approvals or fraud determinations must produce decision-level explanations communicable to customers. SHAP feature importance charts satisfy technical documentation; they do not satisfy customer explanation requirements.
• Human oversight for consequential decisions. AI decisions with consequential customer impact require meaningful human oversight — not nominal review. Override governance frameworks must track override rates by segment to detect automation bias.
• Kill-switch mechanisms. Every production AI system must have a documented kill-switch procedure — not just a technical off-switch, but a validated fallback process with tested rollback capability.
• Red-teaming. AI systems, especially those customer-facing, require adversarial testing before deployment and periodically in production.

For detailed analysis, read: RBI MRMF 2026: what banks must prepare and RBI FREE-AI: the full recommendations decoded.

The India-Specific Compliance Gap: Proxy Variables

No international model risk framework addresses what RBI FREE-AI calls out directly: proxy variable discrimination in India. Credit, fraud, and insurance models trained on Indian data frequently encode correlations between legitimate features (pincode, UPI counterparty patterns, device language, mobile number prefix) and protected characteristics (caste, religion, language community, disability status). The MRMF's fairness requirements mandate explicit proxy variable screening before training and segment-level fairness testing in validation — obligations that no international AI governance standard specifies. Read: India proxy variable fairness in AI banking.

SEBI: Kill-Switch, Human Oversight, and Algorithmic AI

SEBI's AI governance approach is calibrated to capital markets risk. Unlike the RBI's process-heavy model risk framework, SEBI's requirements are operationally focused on control mechanisms: kill switches, human-in-the-loop requirements, and pre-approval for algorithmic strategies.

AI/ML Guidelines 2026: Core Requirements

• Kill-switch obligation. Every AI system used in trading, research, or customer-facing advisory must have a technically validated kill switch — not a policy statement, but a tested mechanism to halt AI operation and revert to manual processes within a defined timeframe.
• Human-in-the-loop by risk tier. SEBI's tiered approach requires human oversight calibrated to risk level. High-risk AI systems (autonomous trading, AI-generated investment recommendations) require mandatory human review gates at defined intervals or transaction thresholds.
• Accountability regardless of source. SEBI explicitly holds regulated entities accountable for AI outcomes whether the system was built internally or procured from a third party. There is no vendor-liability carveout.
• RAIDAR surveillance. SEBI's RAIDAR (Risk-based AI for Detection of Anomalous Research) tool applies AI-based surveillance to detect AI-driven market manipulation. Regulated entities should anticipate RAIDAR will flag algorithmic strategies that trigger anomalous patterns.

For detailed SEBI AI governance analysis: SEBI AI governance securities India 2026, SEBI kill-switch technical implementation, and algorithmic trading AI kill-switch governance.

IRDAI: India's First Insurance AI Governance Framework

IRDAI formed its Working Group on AI on June 19, 2026 — seven members chaired by Prof. Sandeep K. Shukla (IIIT Hyderabad), with representation from ReBIT and CERT-In. The working group's mandate covers ethical AI, frontier AI risk, audit frameworks, and policyholder data protection. Recommendations were due September 2026, with formal guidelines expected Q4 2026.

Five High-Risk Insurance AI Use Cases

The IRDAI framework is expected to address five use cases where AI presents the highest policyholder risk:

1. Underwriting AI. AI systems determining premiums or coverage eligibility must demonstrate fairness across geographic, demographic, and health segments. Proxy variable discrimination (pincode as socioeconomic proxy, telematics data patterns as behavioral proxies) is an explicit concern for motor and health insurance.
2. Claims settlement AI. Automated claims decisions — including same-day motor claims using image AI — require explainability for disputed decisions and human escalation paths that meet the IRDAI's consumer protection standards.
3. Fraud detection AI. False positive rates that disproportionately flag claims from specific policyholder segments (rural, elderly, minority language speakers) constitute a discriminatory outcome regardless of aggregate accuracy metrics.
4. Distribution AI. AI-driven product recommendations must satisfy suitability obligations. SEBI's investment adviser suitability AI framework is the closest regulatory parallel.
5. Customer chatbots. LLM-based customer service systems must not cross the insurance advice boundary — the equivalent of SEBI's financial advice prohibition for investment chatbots.

For full IRDAI analysis: IRDAI AI Working Group June 2026: 5-step compliance plan, IRDAI AI governance for insurers, and AI governance for insurance: actuarial AI and claims fairness.

NPCI: Unified Agent Protocol and Agentic Payment Governance

NPCI's Unified Agent Protocol (UAP), unveiled at Global Fintech Fest Mumbai in September 2026, is a globally unique development: national payment infrastructure purpose-built for AI agents. UAP extends UPI Circle's delegated payment capabilities to autonomous AI agents — enabling an AI assistant to execute UPI transactions on a user's behalf without per-transaction human confirmation.

UAP Governance Requirements for Banks

UAP creates four new governance obligations that no existing AI governance framework anticipated:

• Authorization boundary controls. AI agents operating under UAP must have documented scope limitations — which payees, amounts, and transaction types an agent can authorize autonomously. Scope creep — an agent executing transactions outside its declared authorization — is an MRMF-relevant behavioral risk.
• Per-transaction spending limits. UAP-enabled agents must operate within per-transaction and aggregate spending limits that are technically enforced, not just policy-stated. NPCI's consent architecture requires these limits to be customer-visible and revocable.
• Agent registration and audit trail. Each AI agent operating in the UAP ecosystem requires registration with the bank and an auditable record of authorization events — both approvals and rejections — for regulatory inspection.
• Kill-switch and incident response. An AI agent that is compromised, exhibiting anomalous behavior, or subject to a prompt injection attack must be terminable without disrupting non-agent UPI infrastructure. Incident response plans must cover agent-specific failure modes distinct from standard IT incidents.

For detailed analysis: NPCI UAP agentic payments governance 2026 and Unified Agent Protocol: what India's banks must implement.

DPDP: Significant Data Fiduciary Obligations for AI

The Digital Personal Data Protection (DPDP) Act 2023, with Rules notified November 13, 2025, creates AI governance obligations that apply across all BFSI entities — independent of and stacked on top of RBI, SEBI, and IRDAI requirements.

Significant Data Fiduciary (SDF) Status

Large banks and insurers processing high volumes of personal data will likely qualify as Significant Data Fiduciaries under the DPDP Rules. SDF status triggers four additional obligations directly relevant to AI governance:

• Annual Data Protection Impact Assessments (DPIAs) for AI systems. Every AI system processing personal data requires an annual DPIA assessing privacy risk, data minimization, and consent appropriateness.
• Algorithmic fairness audits. AI systems making automated decisions affecting data principals (credit decisions, fraud flags, insurance underwriting) require periodic algorithmic fairness audits — distinct from but overlapping with RBI FREE-AI's fairness validation requirements.
• Data Protection Officer (DPO) appointment. SDFs must appoint a DPO with defined responsibility for AI-related data governance, including handling data principal requests relating to automated decisions.
• Right to explanation and human review. DPDP Act Section 12 grants data principals the right to information about automated decisions affecting them and the right to human review of such decisions — creating an explanation obligation complementary to but distinct from RBI's Fair Practices Code adverse action requirements.

For detailed DPDP AI governance analysis: DPDP Rules 2025: SDF obligations for Indian banks and AI data privacy: DPDP Act obligations for AI systems.

Compliance Matrix by Entity Type

Not every obligation applies to every entity. This matrix maps the primary applicable frameworks by BFSI entity type:

India-Specific Obligations No International Framework Covers

International AI governance frameworks — NIST AI RMF, ISO 42001, EU AI Act, OWASP LLM Top 10 — provide useful reference points. They do not cover four obligations that are uniquely Indian and that RBI FREE-AI and the MRMF explicitly address.

1. Proxy Variable Screening

Pincode, UPI counterparty name, mobile number series, and device operating language are legitimate operational features that correlate, in Indian data, with caste, religion, language community, and disability status respectively. Indian banks must screen for these correlations explicitly — before training, in validation, and in continuous monitoring — using methods (TCAV, intersectional testing) that no international standard specifies. Read: India proxy variable fairness testing.

2. Vernacular Language Explainability

Adverse action notices and AI-generated customer communications must be meaningful in the customer's language. For PMJDY-segment customers, the majority-language explanation is often not Hindi — it may be Tamil, Kannada, Bengali, Marathi, or Odia. LLM-generated explanations must be validated for accuracy and regulatory adequacy in regional languages, not just English or Hindi. Read: AI explainability requirements: the gap between SHAP and regulatory standards.

3. PMJDY Population Monitoring

The Pradhan Mantri Jan Dhan Yojana (PMJDY) population — over 500 million zero-balance or low-activity accounts representing India's financially included but historically underserved population — is substantially underrepresented in historical banking AI training data. MRMF fairness requirements explicitly target this segment. Models that perform acceptably in aggregate may fail for PMJDY segments due to training data recency and representativeness gaps. Read: AI bias testing for banking: India proxy and PMJDY segment requirements.

4. Data Localization for AI Artifacts

RBI's payment data localization directive — data processed in India must remain in India — extends to AI model artifacts derived from that data: embeddings, fine-tuned weights, inference traces, and RAG knowledge base vectors generated from payment, lending, or account data. This effectively mandates on-premises or India-hosted inference infrastructure for fraud, credit, and AML AI systems. Cross-border LLM API calls may inadvertently violate this requirement. Read: RBI data localization and AI model training 2026.

India BFSI AI Governance: Implementation Checklist

This checklist covers the minimum governance foundation required for a commercial bank or large NBFC operating in India under the combined MRMF, FREE-AI, and DPDP obligations.

Further Reading by Regulator

RBI

• RBI MRMF 2026: complete compliance guide for banks and NBFCs
• RBI FREE-AI recommendations: all seven pillars decoded
• RBI eMRM: enhanced model risk management
• RBI data localization and AI model training
• RBI MRMF: the generative AI and agentic gap
• RBI Account Aggregator AI governance
• RBI Payments Vision 2028 and AI governance
• RBI Payment Aggregator AI governance 2025
• Agentic AI governance India BFSI under RBI MRMF
• Small Finance Banks AI governance under MRMF

SEBI

• SEBI AI governance securities India 2026
• SEBI AI/ML kill-switch guidelines
• Algorithmic trading AI kill-switch governance
• SEBI responsible AI for securities markets
• SEBI investment adviser AI disclosure
• SEBI AIF AI governance 2026
• SEBI mutual fund AI/ML quarterly reporting

IRDAI

• IRDAI AI Working Group June 2026: 5-step compliance plan
• IRDAI AI governance for insurance India
• IRDAI AI Working Group: terms of reference
• IRDAI AI cybersecurity guidelines 2026
• AI governance for insurance: actuarial AI and claims fairness
• India insurtech AI governance and IRDAI sandbox

NPCI & Payments

• NPCI UAP agentic payments governance 2026
• Unified Agent Protocol: governance requirements
• RBI Payments Vision 2028 AI governance
• Payment system provider AI governance

DPDP & Data Governance

• DPDP Rules 2025: SDF obligations for Indian banks
• DPDP Act AI governance for financial services
• AI data privacy: DPDP Act obligations for AI systems
• RBI data localization and AI model training