Does RBI's AI governance framework apply to NBFCs?

Yes. RBI's 2024 AI Circular applies to all RBI-regulated entities, including NBFCs. The FREE-AI Framework (Fairness, Reliability, Explainability, Ethics, Accountability, Inclusivity) and the draft eMRM guidelines both apply to NBFCs using AI/ML models for credit assessment, collections, fraud detection, or customer service. The key distinction is that RBI has acknowledged a proportionality principle — a small NBFC deploying a single credit-scoring model has different governance obligations than a large NBFC-ICC deploying dozens of AI systems. The obligations are real; the implementation approach can be scaled to organizational size.

What DPDP Act obligations apply to NBFC digital lending AI?

NBFC digital lending AI processes personal financial data, including transaction history, social connection data, mobile usage patterns, and location data — all subject to DPDP Act consent and purpose limitation requirements. Key obligations: (1) Explicit consent for each data category used in credit scoring — a single terms-and-conditions acceptance is not sufficient for processing sensitive financial signals; (2) Purpose limitation — data collected for loan underwriting cannot be repurposed for insurance cross-sell or marketing without separate consent; (3) Data minimisation — only the data actually needed for the model can be processed; (4) Data principal rights — borrowers must be able to access what data was used for their credit decision.

What is model risk management for NBFCs?

Model risk management (MRM) for NBFCs requires: (1) An inventory of all AI/ML models used in credit, collections, fraud, and customer operations; (2) Risk tiering — classifying models by potential harm (customer-facing credit decisions are higher tier than internal operational models); (3) Validation — independent review of model performance, bias, and explainability before deployment; (4) Monitoring — ongoing tracking of model performance in production, with drift detection and recalibration triggers; (5) Governance — documented accountability, approval trails, and evidence for RBI examination. RBI's draft eMRM guidelines extend these requirements explicitly to ML and generative AI models.

NBFC AI Compliance in 2026: What RBI and the DPDP Act Actually Require

RBI's own registry lists roughly 9,000-plus active NBFCs, and a large share of the digital lenders among them run AI somewhere in credit scoring, collections, fraud detection, or onboarding. There is no AI-specific carve-out by asset size in RBI's regulatory architecture — a ₹200 crore NBFC-ND-SI and a ₹40,000 crore NBFC-UL answer to the same underlying expectations on model governance, even though the intensity of supervision differs sharply between the two. This piece sets out what RBI and the DPDP Act actually require today, where the two most commonly cited frameworks are still recommendations rather than rules, and what a governance build looks like at each stage of NBFC growth.

Why an NBFC's governance burden is set by its RBI layer, not its AI maturity

NBFCs often assume AI governance is a large-bank problem — something that applies to SBI or HDFC Bank but not to a mid-size digital lender. That assumption misreads how RBI actually tiers supervisory intensity. Since October 2022, every NBFC sits in one of four layers under the Scale-Based Regulation (SBR) framework: Base Layer, Middle Layer, Upper Layer (NBFC-UL, currently around 15-16 named entities subject to bank-like regulatory intensity), and an as-yet-unpopulated Top Layer reserved for NBFCs RBI judges to pose outsized systemic risk. A non-deposit-taking NBFC with assets above ₹500 crore is separately classified NBFC-ND-SI, a legacy label that still governs several prudential thresholds inside the Middle and Upper layers.

The practical effect: an NBFC-UL entity gets examined with near-bank rigor, including model governance documentation, while a Base Layer NBFC gets a lighter-touch review — but both are expected to have a model inventory if they run AI in lending decisions. What a growth-stage NBFC should actually plan for is layer migration. Cross the asset or activity thresholds that move you from Middle to Upper Layer, and your AI governance documentation that passed muster last year will not pass muster this year, because the Upper Layer bar includes several bank-equivalent board governance and risk-committee expectations. I have sat through an RBI inspection where the examiner's first question on the AI book wasn't about model accuracy — it was "show me the layer-appropriate governance committee minute where this model was approved." No minute, no credit for the model working well.

The AI use cases most common in NBFCs — alternative-data credit scoring, automated collections, digital onboarding — also happen to be among the highest-consequence deployments in the regulatory landscape, because they directly gate credit access for borrowers who frequently have no other lending channel. That combination of low supervisory size-threshold and high per-decision consequence is what makes NBFC AI governance harder than NBFCs expect, not any special AI-specific rulebook.

The regulatory stack: what's binding today versus what's still a recommendation

Instrument	Status	What it actually obliges NBFCs to do	AI use cases most affected
RBI Digital Lending Directions (2022, consolidated/updated through 2025)	Binding	Disclosure of the Key Fact Statement before loan execution; disclosure of the main factors behind an algorithmic lending decision on borrower request; restrictions on what device data a lending app can access; a named grievance redressal officer	Digital lending apps, credit-bureau integration, collection bots
RBI FREE-AI Framework (Committee report, August 2025)	Recommendations, not yet notified as binding regulation	7 guiding "sutras" (trust as foundation, people-first, innovation over restraint, fairness and equity, accountability, understandable-by-design, safety/resilience/sustainability) and 26 recommendations spread across six pillars — Infrastructure, Policy, Capacity, Governance, Protection, Assurance.	All AI/ML deployments including vendor models, once RBI acts on the recommendations
"RBI 2024 AI Circular"		—	—
RBI's draft/evolving Model Risk Management guidance (sometimes referred to in industry commentary as "eMRM")	Reportedly in progress; exact scope and date not independently confirmable at time of writing	Expected direction: independent validation requirement extended to vendor-supplied AI/ML models, tier-based validation cadence	Credit models, fraud models, all predictive models — treat specifics as provisional until RBI publishes the final Master Direction
DPDP Act 2023	Binding (Act in force; Rules under phased notification)	Purpose-specific consent per data category used in AI; purpose limitation; data minimisation; data-principal rights including the basis of an automated decision; data localisation for certain categories	Alternative-data scoring, mobile-device data, social data, biometric KYC

The honest summary for a compliance head: the piece of this stack you can get examined against today is the Digital Lending Directions, the DPDP Act, and RBI's existing fair-practice code applied to AI-assisted decisions. FREE-AI and the enhanced MRM guidance are directional — build toward them, but do not represent either one to your board as a settled compliance obligation with a hard deadline, because RBI hasn't notified either as such yet.

Alternative-data credit scoring: where proxy discrimination actually hides

Alternative-data scoring — mobile app usage, bill-payment history, social graph, location patterns, e-commerce behaviour — is the defining AI use case for digital NBFCs, and it's also the use case with the thinnest defensible explanation when a regulator or a rejected borrower asks "why." The DPDP Act treats several of these signals as requiring their own purpose-specific consent; you cannot fold "location data for credit scoring" into a general app-permissions click-through. The real governance failure I see most often isn't malicious discrimination — it's a feature that correlates with pin code, which correlates with religion or caste composition in that pin code, surviving into production because nobody ran a disparate-impact test segmented by geography before launch.

Required controls:

Feature audit before production: identify and strip features that proxy for protected characteristics (pin code, surname pattern, social graph composition); run disparate-impact testing across gender, religion, and geography, not just overall accuracy
DPDP-compliant consent: granular, purpose-specific consent captured per data category (mobile, location, social, payment) rather than a bundled app-permission screen
Decision-level explainability (SHAP/LIME or equivalent) stored per credit decision and retrievable both for a borrower query and for an RBI examiner's sample pull
A standing audit comparing declared app permissions against the data actually fed into the scoring model — permission scope creep is the single most common finding in this area

Collections AI: the harassment threshold is a compliance line, not a UX setting

Collections AI prioritizes overdue accounts, triggers automated outreach, and in more advanced builds recommends settlement terms. RBI's fair-practice code for recovery agents — originally written for human collection agents — applies in substance to AI-driven outreach, and a model that learns "this borrower responds better to more frequent contact" will walk straight into a regulatory harassment threshold if nothing caps it at the model layer. Treating the contact-frequency limit as a policy document rather than an enforced system constraint is how NBFCs end up explaining themselves to RBI's consumer-protection desk.

Required controls:

Contact-frequency caps enforced in the AI output layer itself, with hard per-borrower daily/weekly limits — not just a policy that assumes staff will follow it
Quarterly disparate-impact monitoring on collections intensity across demographic and geographic segments
Mandatory human review before dispatch for any AI-generated settlement offer above a defined threshold
A complete audit log of every AI-triggered contact with a reason code, built to survive an RBI examination sample request, not just an internal dashboard

Digital onboarding and KYC AI: biometric data is where DPDP Act bites hardest

Video KYC, document verification, and liveness detection are now standard across digital NBFCs, and the biometric data they process is treated as sensitive personal data under the DPDP Act, which means the consent and retention bar is higher than for ordinary financial data. The most common gap is retention: biometric capture for KYC verification purposes gets kept indefinitely "in case we need it again," with no separate consent covering that extended retention.

Required controls:

Delete biometric data after verification completes, with an audit record of the deletion; retain it only against a separate, explicit consent for that specific purpose
Test facial-recognition accuracy across skin tone and lighting conditions before deployment, and monitor false-positive/false-negative rates by demographic segment in production
Monitor document-extraction error rates by ID type, with low-confidence extractions routed to human review rather than silently accepted into the loan record

Proportionate governance: what to actually build at each stage

The regulatory obligation is identical for a ₹500 crore NBFC and a ₹50,000 crore NBFC. What should differ is the sophistication of the implementation, not whether it exists.

Early stage (1-5 AI models): a structured model inventory document, per-deployment validation, explainability reports sampled by borrower cohort, a DPDP consent audit before each model goes to production, and a self-assessment against RBI's existing fair-practice and digital-lending requirements.

Growth stage (5-20 AI models, typically Middle Layer): a formal model risk register inside a GRC tool rather than a spreadsheet, independent validation for every credit-affecting model, automated bias testing wired into CI/CD, a continuous monitoring dashboard, and examination-ready evidence packs built before the inspection notice arrives, not after.

Scale stage (20+ AI models including agentic deployments, typically Upper Layer): a full MRM framework — inventory, risk tiering, validation lifecycle, Model Risk Committee sign-off — automated residual-risk scoring, a board-level AI risk-appetite statement, and a tamper-evident, signed evidence ledger that survives a layer-appropriate bank-grade examination.

The DPDP Act timeline problem: why "wait for the Rules" is the wrong plan

A number of NBFCs are treating DPDP Act compliance as something to finish once the Rules are fully notified. That's a risky sequencing decision for any NBFC running AI on personal data, for three reasons.

First, consent architecture is not retroactive. A consent mechanism built after the Rules are notified does not reach back and cover data already collected and already feeding live credit models — remediating that gap at scale, after the fact, is materially harder than building it correctly now.

Second, several alternative-data signals already common in NBFC credit models — contact-list analysis, broad social-media signals — sit uncomfortably inside the Act's purpose-limitation principle, and the Rules are more likely to tighten that fit than loosen it.

Third, the DPDP Act's monetary penalties run up to ₹250 crore for serious breaches, and the "per incident versus per company" question matters enormously at scale. Whether a lapse affecting 100,000 borrowers is legally one incident or 100,000 is not yet settled by any Data Protection Board order — but any NBFC sizing its compliance risk on the optimistic reading of that open question is making a bet, not a compliance decision.

Action checklist for an NBFC CRO or Compliance Head

Map every AI model to its RBI layer context. Confirm whether your NBFC is Base, Middle, or Upper Layer today, and model what governance documentation you'll need if you cross a layer threshold in the next 12 months — don't wait for the reclassification letter.
Separate "binding today" from "directional." Brief your board accurately: Digital Lending Directions, fair-practice code, and the DPDP Act are enforceable now; FREE-AI and the enhanced MRM guidance are recommendations to build toward, not deadlines to cite in a board minute.
Run a consent audit on every data category feeding a live AI model this quarter, not after the DPDP Rules are fully notified — retrofitting consent is far more expensive than building it first.
Enforce collections contact-frequency caps and biometric-deletion rules at the system layer, not as a policy document staff are trusted to follow — this is the single most common gap an RBI examiner finds.
Build your model inventory and evidence pack before the examination notice arrives. If you can't produce a validation report and an MRC approval record for every credit-affecting model within 48 hours of being asked, you don't have a governance program — you have a policy document.

AI governance built for India NBFCs

From model inventory to RBI examination evidence — Zytra covers the full NBFC AI compliance stack, sized for NBFC scale and priced for NBFC budgets.