India has four RBI-licensed credit information companies: TransUnion CIBIL with over 300 million consumer credit records, Experian India, Equifax India, and CRIF Highmark. Together they underpin every retail credit decision made by the country's banks, NBFCs, and fintechs. A credit score from one of these bureaus is not a data point — it is infrastructure. When a consumer applies for a home loan, a car loan, or a credit card, the lender's decision model calls a CIC. The CIC's AI model scores the consumer. The bank's model acts on that score.
RBI's Draft Guidance on Model Risk Management (June 24, 2026) — the MRMF — explicitly lists credit information companies as one of eleven regulated entity types in scope. This is not an implied inclusion. CICs are named. The implication is significant: the AI at the core of India's credit infrastructure now has a regulatory governance framework — model documentation, independent validation, performance monitoring, explainability requirements, bias testing, and kill switch capability — all mandated under MRMF for every material AI model a CIC operates.
The Four CICs: Scope and Scale
TransUnion CIBIL
Largest CIC in India. Over 300 million consumer records, 40+ million commercial records. CIBIL Score (300–900 range) is the most-cited credit metric in Indian retail lending. Operates CIBIL Score 1.0, 2.0, and 3.0 — three separately governed models under MRMF. RBI-licensed under the Credit Information Companies (Regulation) Act 2005.
Experian India
Subsidiary of global Experian PLC. Operates Experian Credit Score for India consumers. Expanding into alternate data scoring using Account Aggregator data. MRMF scope includes both the core bureau score model and any AA-powered alternate models deployed in India.
Equifax India
Indian subsidiary of global Equifax. Operates Equifax Credit Score for Indian consumers and commercial entities. Has faced data governance scrutiny globally — India operations under RBI oversight subject to MRMF model risk requirements independently of global parent governance.
CRIF Highmark
Merged entity (CRIF and Highmark). Strong in microfinance, agricultural credit, and NE India coverage. CRIF MRMF obligations include niche segment scoring models that cover thin-file and rural populations — segments with the highest INDIC-BIAS exposure and the greatest need for robust fairness testing.
All four CICs are RBI-licensed under the Credit Information Companies (Regulation) Act 2005 and regulated by RBI. MRMF's inclusion of CICs as regulated entities means RBI examination of a CIC will now assess its model risk management program — not just its data security and member service obligations.
Five AI Use Cases at CICs — All MRMF-Covered
Core Credit Score Models
CIBIL Score 1.0, 2.0, and 3.0 are three distinct machine learning models built on payment history, credit utilization, age of credit, inquiry frequency, and credit mix. Under MRMF, each version in active production use is a separate model requiring its own documentation and performance monitoring — a CIC cannot treat legacy score versions as exempt simply because a newer version exists, if member institutions are still consuming the older score.
Alternate Credit Scoring
Account Aggregator-powered models score thin-file consumers — those with no or minimal bureau history — using bank statement cash flows, GST filing patterns, and UPI transaction behavior. These models serve India's unbanked population entering formal credit for the first time. MRMF requires full model governance for these AI systems, including DPDP consent architecture for the AA data inputs.
Credit Inquiry Fraud Detection
AI models detect synthetic identity fraud and fraudulent inquiry patterns — multiple lenders pulling credit on a single consumer in a short window, fabricated identity clusters with similar bureau characteristics, and abnormal inquiry velocity. These models are material risk models under MRMF and require independent validation of their detection accuracy and false positive rates.
Collections Propensity Models
Predictive models shared with lending member institutions to identify which delinquent accounts have the highest recovery probability. These models are outputs of CIC AI that affect consumer financial outcomes — MRMF's fairness and bias requirements apply because propensity scores that systematically deprioritize certain demographic groups' accounts affect their debt resolution outcomes.
DPDP Consent Management AI
Automated systems that capture, log, and expire consumer consent for credit inquiries under the Digital Personal Data Protection Act 2023. As credit inquiries require consumer consent under DPDP, any AI automating consent workflow — including consent validity checks, expiry management, and inquiry rejection when consent is absent — is a material system under both DPDP and MRMF's broader model governance scope.
MRMF Obligations Specific to CIC AI Models
Model Documentation for All Score Versions
CIBIL Score 1.0, 2.0, and 3.0 are three separate models under MRMF. Each requires its own model documentation: feature definitions, training data provenance, intended use, operational boundaries, known limitations. A CIC that has deployed Score 3.0 but has not decommissioned 1.0 and 2.0 for all members must maintain documentation for all active versions in production use.
Independent Validation
A CIC cannot validate its own credit score model. MRMF requires independent validation — the validation function must be organizationally separate from model development. For a CIC, this means engaging an external model risk validator for the core score model on a quarterly cycle. Independent validation scope: predictive accuracy, population stability, feature contribution analysis, calibration assessment, and INDIC-BIAS testing.
Performance Monitoring
Monthly monitoring of Gini coefficient (model discriminatory power), KS statistic (separation of good/bad borrowers), and Population Stability Index (distribution drift in the scored population). For AA-powered alternate models, PSI is especially important — the AA-enabled population grows rapidly, and the model may drift as it encounters increasingly diverse financial profiles beyond its training distribution.
Explainability and Reason Codes
RBI's Fair Practices Code already requires CICs to provide reason codes explaining a low score to the consumer. MRMF adds the obligation that these reason codes must be derived from the actual model's feature contributions — not generic explanations. An AI-generated score must produce explainability outputs that accurately reflect which factors drove the score, enabling the consumer to take corrective action.
Bias Testing (INDIC-BIAS)
Credit score models trained on historical bureau data inherit historical credit exclusion patterns. MRMF requires bias and fairness testing for AI models used in decisions affecting consumers. For CIC models, INDIC-BIAS testing must assess score distributions across: rural vs. urban populations, state-level segments, gender, SC/ST communities, and thin-file vs. thick-file consumers. Geographic proxies (pincode) and name-based proxies require explicit feature exclusion analysis.
Kill Switch Architecture
MRMF requires a tested kill switch capability. For a CIC score model, this means: ability to revert to a prior validated model version, ability to freeze new score generation while a defect is investigated, and ability to exclude specific features from scoring while a feature-level defect is isolated. The kill switch must be tested — not just documented — with records of the test date, scenario, outcome, and activation authority.
Third-Party Model Governance
If a CIC deploys a licensed vendor score model — a FICO-licensed model, an open-source scoring framework, or an external AI vendor's alternate scoring product — MRMF accountability remains with the CIC. The CIC must obtain model documentation from the vendor, maintain oversight of vendor model updates, and demonstrate that vendor models have been independently validated to MRMF standards. Vendor accountability does not transfer model risk ownership.
DPDP Act Obligations for CIC AI
The Digital Personal Data Protection Act 2023 creates parallel obligations that intersect directly with CIC AI governance. Credit inquiry data is financial data — sensitive personal data under DPDP. Five key intersections:
Consumer Consent for AI Scoring: Credit inquiry requires consumer consent under DPDP. When a lender pulls a consumer's credit report, the consumer's DPDP consent covers that pull. But which credit score model version processed their data? If CIBIL Score 3.0 is deployed and a consumer consented to credit inquiry processing generically, does that consent cover being scored by a specific AI model version? DPDP requires purpose specificity — consent for a credit inquiry is consent for that inquiry's purpose, and AI model versioning may require updated consent architecture.
Right to Correction and Model Error Propagation: If a consumer disputes a tradeline — a payment record that is incorrect — DPDP's right to correction requires correction within defined timelines. For CIC AI, this creates a model error propagation risk: if the corrected tradeline has already been consumed in a recent score computation, the previously delivered score to lenders was based on incorrect data. MRMF performance monitoring must include correction-triggered recomputation protocols.
Credit Freeze and Real-Time AI Enforcement: Consumers can restrict access to their credit data. DPDP's right to restrict processing means a CIC's AI systems must enforce a credit freeze in real time — a score inquiry from a lender must be rejected if the consumer has placed a freeze, and this enforcement cannot have lag. The AI systems underlying credit freeze management are operational risk models under MRMF.
Data Minimization for Alternate Scoring: AA-powered alternate scoring models access bank statement data, GST records, and UPI transaction history. DPDP data minimization requires that only data relevant to the credit assessment purpose be processed. Alternate scoring models that use lifestyle inference features — food delivery frequency, subscription services, entertainment spending — may exceed the minimization boundary. MRMF model documentation must explicitly define the alternate model's permitted feature scope.
Data Retention for AI Training: DPDP limits retention of personal data beyond the purpose for which it was collected. CIC AI models trained on historical bureau data must document the retention period for training data and the legal basis for that retention. Score models trained on data that exceeds the DPDP-permitted retention period have a compliance exposure that MRMF governance documentation must address.
When CIBIL Score 3.0 Has a Bug, Every Indian Bank Gets It Simultaneously
The systemic risk profile of CIC AI is qualitatively different from the risk profile of any individual bank's internal model. A bank's credit model affects that bank's lending. CIBIL Score 3.0 affects every member institution's lending simultaneously. If Score 3.0 has a bias bug that underscores consumers from a particular geographic region or demographic group, every bank in India using that score under-lends to that group at the same time. This is correlated failure — not individual institution risk, but systemic exclusion at the scale of the Indian banking system.
MRMF's residual risk measurement for CIC models should explicitly incorporate a network multiplier factor. The residual risk of a bias defect in a CIC score model is not the same as the residual risk of the same defect in a single bank's internal model. The former propagates to 300+ member institutions within hours of the next credit inquiry cycle. MRMF's model risk classification framework should treat CIC models as high-systemic-impact models requiring enhanced governance intensity: more frequent independent validation cycles, faster kill switch activation thresholds, and proactive member notification protocols when model anomalies are detected.
- Network multiplier effect: A 2% systematic under-scoring of thin-file rural consumers by CIBIL Score 3.0 translates to reduced credit access for millions of consumers simultaneously, across all lending institutions that use the score.
- Feedback loop risk: Under-scored consumers receive less credit, build thinner credit histories, and are under-scored in the next cycle — a self-reinforcing exclusion loop that MRMF's performance monitoring must be designed to detect and break.
- Member reliance assumption: Most member institutions use CIC scores as a near-decisive input in their credit decisioning. MRMF's model use policy — the obligation to understand and appropriately weight model outputs — applies to the using institution, but the CIC's own governance cannot assume member institution skepticism as a risk mitigant.
Practical Compliance Steps: Five Actions for CICs
-
Model inventory for all active score models. Build a complete model inventory covering every score model currently delivering outputs to member institutions — including legacy versions (CIBIL Score 1.0, 2.0) that may still be consumed by some members even after newer versions are released. The inventory must document each model's version, deployment date, member usage, last validation date, and current monitoring status. MRMF examination begins with the model inventory.
-
Engagement of an independent MRM validator for the core score model. Establish a quarterly independent validation cycle for the primary credit score model. The validation scope must include predictive accuracy assessment, population stability analysis, feature contribution audit, calibration testing, and INDIC-BIAS testing across rural/urban, state, gender, and thin-file segments. The independent validator must be organizationally separate from the CIC's model development team — an internal team with a different reporting line is insufficient; external validation is the standard.
-
INDIC-BIAS quarterly testing program. Implement a formal quarterly bias testing program that assesses score distributions across: rural vs. urban populations (defined by RBI's financial inclusion segments), state-level analysis (NE India, tribal areas, aspirational districts), gender (available from member-submitted data), thin-file vs. thick-file segments, and SC/ST community proxies if identifiable from geographic data. Document test methodology, results, and remediation actions. MRMF requires that bias findings result in model remediation, not just documentation.
-
Reason code explainability audit. Verify that the four reason codes delivered to consumers and lenders with each score are derived from the actual model's feature contribution outputs — not from a generic lookup table of standard reason codes. This audit should compare the model's top-contributing features for a sample of recent score computations against the reason codes delivered, confirming alignment. Where reason codes are generated by a separate rules engine rather than directly from model output, the alignment mechanism must be documented and validated.
-
DPDP consent architecture review for the credit inquiry pipeline. Map the end-to-end consent flow: consumer consent captured by lending institution → transmitted to CIC with inquiry → scope of consent relative to AI model version used → retention of consent records → consumer right to correction and freeze enforcement in AI pipeline. Identify gaps between the current consent architecture and DPDP purpose specificity requirements. For AA-powered alternate models, specifically assess whether the AA consent framework covers the specific data types actually used as model features.
When a CIC Licenses a Vendor Score Model, MRMF Accountability Does Not Transfer
Several CICs deploy scoring models that incorporate licensed technology from global vendors — FICO score licensing, open-source ML frameworks with commercial support, or alternate data scoring products from fintech vendors. MRMF is explicit: when a regulated entity deploys a third-party model, the regulated entity retains full model risk accountability. The CIC cannot present a vendor's validation documentation as a substitute for its own MRMF-compliant validation. Four obligations remain with the CIC regardless of vendor sourcing:
- Model documentation ownership: The CIC must maintain documentation for the vendor model as part of its MRMF model inventory, including the vendor's model design documentation and any restrictions on permitted inputs or outputs.
- Independent validation: The CIC must independently validate the vendor model's performance and bias characteristics for its Indian population. A validation conducted by the vendor for a global population does not substitute for India-specific INDIC-BIAS testing.
- Change governance: When a vendor updates their model, the CIC is responsible for detecting the change, assessing its impact on score outputs, and re-validating if the change is material. Vendor update notifications are the minimum; the CIC must have governance processes that do not depend solely on vendor-initiated disclosure.
- Kill switch authority: The CIC must maintain the ability to suspend use of a vendor model and revert to an alternative — even if the vendor model is deeply integrated into the scoring pipeline. MRMF's kill switch requirement applies to vendor models as fully as to internally developed models.
Frequently Asked Questions
Does MRMF apply to credit information companies?
Yes, explicitly. RBI's Draft Guidance on Model Risk Management (MRMF, June 2026) lists credit information companies as one of eleven regulated entity types in scope. All four RBI-licensed CICs — TransUnion CIBIL, Experian India, Equifax India, and CRIF Highmark — must comply with the full set of MRMF obligations for their AI models: model inventory, documentation, independent validation, performance monitoring, explainability, bias testing, and kill switch capability. MRMF applies to all AI and ML models used in material decisions, which includes credit score generation, alternate data scoring, fraud detection, and DPDP consent management AI systems.
What is the INDIC-BIAS risk for credit score models?
Credit score models trained on historical credit data can encode historical credit exclusion into their outputs. Geographic proxies — a pincode correlating with income or caste — can function as indirect discriminatory features. Name-based proxies can signal community affiliation. Thin-file penalization disproportionately affects rural populations, SC/ST communities, women, and people in northeastern India who were historically excluded from formal credit. INDIC-BIAS testing requires quarterly evaluation of score distributions across these segments to identify systematic under-scoring. MRMF requires that bias findings result in model remediation.
What does "kill switch" mean for a CIC credit score model?
For a credit score model, the kill switch is the ability to: revert to a prior validated model version if the current version is found defective — e.g., CIBIL Score 3.0 has a bias bug and must revert to Score 2.0 outputs; freeze new score generation while an investigation is conducted; and exclude specific input features while a feature-level defect is isolated without shutting down scoring entirely. MRMF requires the kill switch to be tested — not merely documented — with records of test date, scenario, outcome, and activation authority.
Are alternate data credit scores subject to MRMF?
Yes. Account Aggregator-powered alternate credit scoring models are AI/ML models under MRMF. They require model documentation (feature definitions, training data provenance, intended use, limitations), independent validation, DPDP consent architecture documentation for the AA data inputs, and performance monitoring including PSI on a population that may change rapidly as AA adoption grows. The thin-file population scored by alternate models is often the most vulnerable — making MRMF's bias and fairness requirements particularly critical for these models.