RBI eMRM Compliance: What India's Draft Extended Model Risk Management Guidelines Require — and Why Banks Should Align Now, Before Finalization

A document is circulating in India BFSI compliance circles describing draft "Extended Model Risk Management" (eMRM) guidance from RBI, reportedly issued for consultation around mid-2026. This review's knowledge cutoff predates that date, and no independent confirmation of the document's exact title, publication date, or clause-level text is available here — treat every specific requirement below as a description of what's being discussed in the market, not a verified quote from RBI, and confirm against RBI's actual published text before building a compliance program around any single clause. What's genuinely useful, regardless of whether this specific draft matches what's described, is the underlying gap it's responding to: India's existing model risk management guidance was built for statistical models, and AI/ML — especially LLMs and agentic systems — exposes gaps that any serious extension would need to close.

The gap pattern, if the reported structure holds

If RBI's extended guidance follows the pattern being discussed, the shift from existing MRM to an AI/ML-extended version would plausibly include: broadening scope to explicitly cover LLMs, generative AI, agents, and third-party AI APIs (categories most current inventories exclude); adding validation dimensions like adversarial robustness and behavioral consistency testing for LLMs; closing the vendor-attestation gap by requiring bank-commissioned independent validation regardless of what a vendor supplies; and adding India-specific proxy-variable fairness testing as a validation requirement rather than a nice-to-have. None of this would be a radical departure from where RBI's publicly confirmed FREE-AI committee report (August 2025) was already pointing — it would be a logical, expected next step, which is also exactly why banks should prepare for it directionally now without over-committing resources to clause-level specifics that haven't been confirmed.

The one gap every Indian bank almost certainly already has, regardless of the draft's final text

Walk through any Indian bank's vendor relationships — credit scoring platforms, fraud detection tools, document-extraction AI embedded in a digital lending partner's stack — and you'll find models running in production with no bank-side independent validation, only the vendor's own testing documentation on file. Whether or not RBI's final guidance uses the word "eMRM," this is already a defensible gap under existing SR 11-7-style principles that most model risk teams would recognize as a problem if they looked directly at it. Closing it doesn't require waiting for final guidance — it requires picking the highest-risk-tier vendor models and commissioning independent validation on them now, because this is reportedly the longest-lead-time item in any version of this requirement that gets finalized.

India proxy-variable fairness testing: build this regardless of the draft's fate

Caste, religion, language, and disability proxy-variable testing requires methodology that standard Western ML fairness toolkits were never built to provide — this is true independent of whether any specific eMRM draft requires it by name, because RBI's FREE-AI report already points toward fairness testing appropriate to India's social structure. This is consistently the slowest capability for banks to build, because it requires pairing census-level demographic data with the bank's own feature set to construct statistically defensible proxy indicators, not a plug-in library. Start this work now on the strength of the FREE-AI report alone; if a formal eMRM requirement later confirms it, you'll already be compliant rather than starting the clock late.

Behavioral monitoring and agentic AI governance: operational necessities, not just compliance checkboxes

A fixed evaluation set, run against production LLM behavior on a recurring cadence and compared to a validation-time baseline, catches the drift that standard performance monitoring misses — this is good practice whether or not a specific regulatory clause mandates the cadence. The same logic applies to agentic AI: document what each autonomous system is authorized to do, who reviews its actions and how often, and how every action gets logged, because an examiner asking about an unsupervised lending agent is going to ask these questions regardless of which specific document they're citing when they ask.

Preparation checklist — useful with or without final eMRM text

1. Extend your model inventory to explicitly include LLMs, generative AI, agents, and third-party/API-accessed AI — most current inventories are scoped too narrowly to catch these.
2. Commission bank-side independent validation for every Critical and High tier vendor model currently relying only on vendor attestation — start with the highest-exposure relationships.
3. Begin building India proxy-variable fairness testing capability now, on the strength of RBI's published FREE-AI report, rather than waiting for a specific eMRM clause to confirm the requirement.
4. Stand up behavioral consistency monitoring for every production LLM with a documented baseline and escalation path.
5. Document agentic AI authorization scope, human oversight cadence, and action-level logging for every autonomous system already in production.
6. Track RBI's actual published guidance directly and update this preparation plan against the confirmed text the moment it's available — don't let a secondhand market summary become your compliance baseline.