How do Central Recordkeeping Agencies under PFRDA use AI and what governance obligations arise?

India's two Central Recordkeeping Agencies — Protean CRA (formerly NSDL e-Governance) and KFin Technologies CRA — manage the member records, contribution tracking, withdrawal processing, and tax reporting for India's 60 million NPS subscribers. CRAs are the operational backbone of the NPS architecture: every NPS contribution, every fund allocation, every withdrawal, and every annuity purchase flows through CRA systems. AI is embedded in multiple CRA functions, creating specific governance obligations under PFRDA/2024/14/ICS/01: (1) Member service AI: CRAs deploy AI for member authentication, grievance classification, and query handling. Member authentication AI that misidentifies a subscriber faces the same consequences as a bank authentication failure — unauthorized withdrawal of retirement savings. PFRDA's audit obligation applies to authentication AI because it directly affects member access to retirement funds; (2) Contribution reconciliation AI: CRAs use AI for automated reconciliation of subscriber contributions across thousands of employers and POPs. AI reconciliation errors that result in under- or over-crediting of contributions affect member balances — the AI audit obligation covers reconciliation AI because inaccuracy creates direct member harm; (3) Fraud detection AI: CRAs deploy AI to detect fraudulent withdrawal requests, unauthorized PRAN (Permanent Retirement Account Number) changes, and beneficiary manipulation. The PFRDA circular's explicit inclusion of AI fraud detection in the ICSRM audit scope means CRAs must periodically test and document the accuracy of their fraud detection AI; (4) Tax and regulatory reporting AI: CRAs generate tax reporting (Form 16, TDS certificates) and PFRDA regulatory reports using automated systems with AI components. AI errors in tax reporting directly affect subscriber tax obligations — the audit obligation extends to AI in regulatory reporting pipelines.

What AI governance obligations do Pension Funds (Scheme Investment Managers) face under PFRDA's 2024 cybersecurity circular?

Pension Funds — SBI Pension Funds, LIC Pension Fund, HDFC Pension Management, ICICI Pru Pension, and others — are responsible for investing NPS contributions across four asset classes (equity, corporate bonds, government securities, and alternative assets) in accordance with PFRDA's investment guidelines. AI increasingly drives fund management decisions, and PFRDA/2024/14/ICS/01 creates governance obligations for that AI. Three pension fund AI governance obligations: (1) Investment AI governance: Pension Funds using AI for portfolio optimization, sector allocation, and rebalancing decisions must include those AI systems in their ICSRM framework. The board-level accountability requirement means the Pension Fund's board must be able to assess AI-driven investment decision performance and accuracy — not merely approve an investment mandate and then allow AI to execute unchecked; (2) NAV calculation AI security: Net Asset Value (NAV) is calculated daily for each NPS scheme across all Pension Funds and reported to CRAs. If an AI system used in NAV calculation is compromised or produces inaccurate outputs, millions of subscriber accounts are affected simultaneously. The PFRDA cybersecurity circular's ICSRM framework requires AI security controls for NAV calculation pipelines — distinguishing between the investment AI (portfolio construction) and the accounting AI (NAV computation); (3) Member suitability AI: Pension Funds are developing AI-based member engagement tools that recommend scheme changes (Active vs Auto Choice, asset allocation adjustments) to subscribers. AI-driven suitability recommendations for retirement savings carry the same governance requirements as investment adviser AI recommendations under SEBI — the subscriber must understand that AI is involved, and the Pension Fund bears accountability for AI recommendation accuracy. The PFRDA circular's fair treatment requirements extend to AI-generated member engagement.

How does PFRDA's AI governance circular interact with RBI and SEBI AI obligations for entities that are regulated by multiple regulators?

Several entities in the NPS ecosystem are regulated by both PFRDA and another financial sector regulator — creating a multi-regulatory AI governance obligation that requires careful mapping: (1) Bank-DPs that are also POPs: major banks (SBI, HDFC Bank, ICICI Bank, Axis Bank, Kotak Bank) serve as both Points of Presence for NPS (PFRDA Category II entities) and as RBI-regulated banks. For AI systems used in NPS member services (PFRDA AI obligation) versus AI used in banking credit and payments (RBI AI obligation), these banks face simultaneous obligations. The practical approach is a single AI governance framework that satisfies both regulators, with role-based risk mapping to each regulatory obligation; (2) Broker-DPs that are POPs: stockbrokers that are also NPS POPs face SEBI AI obligations (Responsible Usage Framework, Institutional Mechanism Circular) for their securities business and PFRDA AI obligations for their NPS distribution. A broker's AI systems used for NPS subscriber onboarding and contribution processing fall under PFRDA/2024/14/ICS/01; its trading surveillance AI falls under SEBI/HO/MIRSD/MIRSD-PoD-1/P/CIR/2024/96; (3) Category II entity exemption: PFRDA's circular exempts Category II entities from the ICSRM requirement if their principal regulator (RBI or SEBI) already imposes equivalent cybersecurity rules. This exemption requires an affirmative assessment: the entity must determine whether its primary regulator's cybersecurity framework covers the same AI risk categories as PFRDA/2024/14/ICS/01. An entity that assumes it is exempt without conducting that assessment may be incorrect — particularly for AI-specific obligations that RBI's general IT framework does not explicitly address in the same terms as PFRDA's circular.

AI Governance · PFRDA · NPS · Pension Funds · CRA · AI Risk Management · India BFSI

PFRDA Information and Cybersecurity Policy Guidelines 2024 AI Governance: AI Risk Register, CISO-Led Board Accountability and Periodic AI Audit Obligations for NPS Pension Funds and Central Recordkeeping Agencies India

PFRDA Circular PFRDA/2024/14/ICS/01 (August 1, 2024) explicitly lists artificial intelligence alongside cloud computing and APIs as technologies requiring structured governance under the Information and Cybersecurity Risk Management (ICSRM) framework — the first and only AI governance obligation for India's pension sector. CISO-led ICSRM Committee with board-level reporting, AI in ICT risk register, periodic AI system audits covering member data processing, NAV calculation AI, and NPS fraud detection. Applies to Protean CRA, KFin CRA, SBI/LIC/HDFC/ICICI Pension Funds, and NPS Trust. 60 million NPS subscribers. Zero global competitor coverage.

Zytra Research Team · August 2024 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's National Pension System — 60 million subscribers, ₹12+ lakh crore in assets under management, operated through two CRAs and seven Pension Funds — is not an obvious target for AI governance regulation. But CRAs use AI for member authentication, contribution reconciliation, and fraud detection. Pension Funds use AI for portfolio optimization and NAV calculation. PFRDA's August 2024 circular is the sector's first explicit AI governance requirement: AI is now named alongside cloud and APIs as a technology requiring structured ICSRM governance.

The circular's significance for Zytra's target market is its scope: pension fund CISOs and compliance officers who have been managing IT risk under generic cybersecurity frameworks now have a specific AI obligation — ICSRM must address AI as a distinct technology category, with board-level reporting on AI risk posture.

The CISO Accountability Gap in Pension AI Governance

PFRDA's requirement for a CISO-led ICSRM Committee with board accountability creates a structural challenge for smaller Pension Funds that do not have dedicated CISOs with AI expertise. A traditional security-focused CISO managing firewall rules and incident response is not the same as a CISO who can report to the board on AI model accuracy, bias risks in fund allocation AI, and member authentication AI failure modes. The 2024 circular implicitly requires AI competency at the CISO level — a capability most pension sector entities are still building.

PFRDA AI Governance Checklist

☐ ICSRM framework AI section: AI explicitly addressed as a technology category in ICSRM documentation; AI risk identification, assessment, and treatment procedures documented separately from generic IT risk
☐ CISO-led committee board reporting: ICSRM Committee established; CISO with AI competency or access to AI expertise; board-level AI risk reporting cadence defined
☐ ICT risk register AI entries: AI-specific risks listed — model accuracy failures affecting member data, fraud detection AI misclassification, NAV calculation AI errors, suitability AI recommendation accuracy
☐ AI system audit schedule: periodic audit schedule established for AI systems in member data processing, fund NAV calculation, and NPS transaction fraud detection; audit scope includes accuracy, security, compliance
☐ Multi-regulator AI mapping (for banks/brokers that are also POPs): assessment whether principal regulator framework (RBI/SEBI) satisfies PFRDA exemption; documented where exemption claimed
☐ DPDP Act NPS subscriber data: AI processing of subscriber personal data (contributions, transactions, beneficiary data) covered by DPDP Act consent; purpose limitation for AI beyond stated NPS account purpose
☐ PFRDA examination readiness: ICSRM AI section, CISO committee records, AI risk register, audit evidence — packaged for PFRDA inspection