India's co-lending ecosystem has grown significantly since RBI's co-lending framework was formalized. Banks — who have low-cost capital but limited reach — partner with fintech Loan Service Providers who have origination channels, borrower relationships, and AI-driven credit assessment capabilities. The fintech brings the credit model; the bank brings the balance sheet. FLDG arrangements formalize the risk-sharing: the fintech provides a First Loss Default Guarantee (capped by RBI at 5% of the portfolio).
The structural problem for AI governance: the fintech's AI credit scoring model makes the lending decision in substance. But MRMF June 2026, which will require validation and governance of AI models used in credit decisions, applies to the regulated entity — the bank — not the fintech. The bank is accountable for a credit decision made by a model it does not own, has not validated, and may not be able to audit.
What the Bank Owns
- FLDG exposure (up to 5% cap)
- 80% of the loan portfolio (typical co-lending split)
- RBI regulatory accountability for the credit decision
- MRMF compliance obligation for AI models in credit
- IT Outsourcing Directions 2023 obligations for LSP vendor
- DPDP Act obligations for borrower personal data
What the Fintech Owns
- AI credit scoring model (trained, maintained, updated by fintech)
- Borrower origination and data collection
- Credit assessment and recommendation output
- Model weights, training data, validation methodology
- 20% of loan portfolio (typical co-lending split)
- NO MRMF obligation (fintech is not an RBI RE)
What No One Governs
- Validation of the fintech's AI credit model
- Audit trail for fintech AI model decisions
- Fairness/bias assessment of fintech model for protected characteristics
- Model change governance — fintech updates model without bank approval
- Explainability of fintech AI credit decisions to borrower or regulator
- Kill switch — bank cannot halt a fintech AI model producing poor outcomes
RBI FLDG Circular RBI/2023-24/41 — What It Says and What It Doesn't
RBI Circular RBI/2023-24/41 (June 8, 2023) establishes the FLDG regulatory framework following the Supreme Court's direction to formalize FLDG practices that had developed informally. Key provisions:
Permitted FLDG: Regulated entities (banks and NBFCs) can accept FLDG from fintech Loan Service Providers on loan portfolios originated through co-lending arrangements. The FLDG may be in the form of corpus deposit (fixed deposit with the RE), corporate guarantee, or bank guarantee. FLDG cap: 5% of the outstanding portfolio at any point in time. This cap was set to limit the RE's structural dependence on FLDG — the RBI's concern was that FLDG was being used to transfer credit risk back to fintechs in ways that undermined the RE's primary credit responsibility. Credit assessment responsibility: the RE must retain primary responsibility for credit assessment and underwriting. The circular states the RE cannot outsource the credit decision itself. Co-lending arrangement structure: RBI's co-lending master directions remain operative; FLDG provisions supplement them.
The circular has zero provisions on AI, ML, credit scoring models, model validation, or algorithmic decision-making. This is not unusual — the FLDG circular addresses the financial structure of the guarantee, not the credit assessment methodology. But the absence becomes a governance gap when MRMF's model risk requirements are read alongside it.
MRMF Examination Will Expose This Gap
MRMF June 2026 requires regulated entities to validate, govern, and document AI models used in credit decisions. An MRMF examiner reviewing a bank's co-lending AI governance will ask: "Show me the model validation documentation for the AI credit scoring model used in your co-lending portfolio." The bank's answer — "the model belongs to the fintech LSP, which is not a regulated entity and has not provided validation documentation" — is not an acceptable MRMF governance answer. The examiner will conclude the bank is using an unvalidated, ungoverned AI model in its credit operations. Governance of third-party AI models is explicitly an MRMF obligation. FLDG arrangements create a structurally novel version of this: the bank has even less leverage over the fintech's model than it has over a typical IT vendor, because the FLDG arrangement economically benefits the fintech and the bank has limited negotiating leverage to demand model access.
Eight Governance Dimensions Banks Must Address for Fintech AI Credit Models
| Governance Dimension | MRMF Requirement on RE | Fintech LSP Typically Provides | Gap / Exposure |
|---|---|---|---|
| Model documentation | Required: intended use, architecture, training data, operational boundaries | Sometimes: commercial summary, not technical documentation | RE cannot validate model without full documentation. Fintech may decline as IP-sensitive. |
| Independent validation | Required: by RE's model risk function or approved third party | Rarely: fintech maintains own validation, does not share with bank | Bank cannot independently validate fintech model without model access. Structural impossibility. |
| Performance monitoring | Required: continuous monitoring of model performance post-deployment | Sometimes: portfolio performance reports; not model-level monitoring | Bank sees portfolio outcomes, not model drift. Early warning of model degradation may not reach bank. |
| Model change governance | Required: RE governs significant model changes, re-validates before production | Rarely: fintech updates model as commercial decision; bank not notified | Fintech may retrain model on new data, change architecture, or alter features without bank knowledge. |
| Explainability / adverse action | Required: explanation for adverse credit decisions; DPDP Act rights | Sometimes: score band and reason codes; not model-level explanation | If borrower challenges credit denial, bank may not be able to produce explanation sourced from fintech model. |
| Fairness and bias testing | Required: RBI FREE-AI Fairness Sutra; caste/religion/language proxy discrimination | Rarely: India-specific fairness testing against INDIC-BIAS dimensions not standard | Fintech model may discriminate against protected characteristics via proxy channels. Bank bears regulatory accountability. |
| Kill switch | Required: MRMF requires tested capability to suspend or deactivate AI models | No: bank cannot unilaterally halt fintech model; can only halt portfolio inflow | Bank has no kill switch on fintech AI. Can exit co-lending arrangement, but cannot pause model producing poor outcomes while arrangement continues. |
| Audit trail | Required: audit trail for AI credit decisions; RBI examination access | Sometimes: decision logs available; model state at time of decision may not be preserved | RBI examiner may request reconstruction of specific credit decisions — requires model version, inputs, outputs at time of decision. Fintech may not maintain Forensic Replay capability. |
Before MRMF Examination Exposes the Gap
MRMF is not yet in final form as of October 2026. The examination process that will test these provisions is 12–18 months away. Banks that restructure co-lending LSP agreements now will have governance documentation in place. Banks that wait will face examination with governance gaps on one of their fastest-growing credit portfolios.
- Model documentation clause: require the fintech LSP to provide and maintain full model documentation for AI credit scoring models — architecture, training data sources, feature list (with proxy discrimination assessment), validation results, performance benchmarks. Documentation to be updated within 30 days of any significant model change. This is the MRMF documentation requirement translated into a contractual obligation on the fintech. Many fintechs will object to sharing model architecture as IP — negotiate disclosure to the bank's model risk function under NDA as an alternative to full disclosure.
- Material model change notification: require the fintech to notify the bank of any material change to the AI credit scoring model (architecture changes, retraining on substantially new data, feature additions or removals, threshold adjustments affecting credit score distributions) before the change goes to production on the co-lending portfolio. Give the bank a review period (30 days minimum) before the changed model applies to the co-lending book. This addresses the model change governance gap — the bank needs to assess whether a model change materially affects the credit risk of the portfolio it holds exposure on.
- Audit rights and RBI access: IT Outsourcing Directions 2023 require the RE's vendor contracts to include audit rights for the RE and RBI access to the vendor's systems and data. For fintech LSPs, this means the contract must provide: (a) the RE's right to audit the fintech's AI credit scoring model (including model performance monitoring, validation documentation, and change history); (b) RBI's right to access the fintech's AI model documentation and decision logs in connection with any RBI examination of the RE's co-lending portfolio. Fintechs resist RBI access clauses — they are required under IT Outsourcing Directions regardless. Banks that do not include them are in violation of IT Outsourcing Directions, not just MRMF.
- Fairness testing requirement: require the fintech LSP to conduct and share bias testing results for the AI credit scoring model, specifically against India-relevant demographic dimensions (caste/religion/language proxy channels, geographic proxies for protected populations). Reference INDIC-BIAS as the testing framework. This addresses both the RBI FREE-AI Fairness Sutra obligation and the DPDP Act non-discrimination requirement. Banks deploying co-lending credit at scale — particularly in Tier 2/3/4 geographies with significant SC/ST/OBC borrower populations — face meaningful regulatory and reputational exposure if the fintech's AI model produces disparate outcomes. The contractual fairness testing requirement gives the bank evidence of due diligence regardless of the fintech's internal practices.