India's digital payments ecosystem is the largest in the world by transaction volume: 131 billion UPI transactions in FY2025, growing to an estimated 160 billion in FY2026. The speed, scale, and ubiquity of digital payments in India — from street vendors to stock market settlements — means that AI governance for payments is not a niche compliance topic. It is a systemic risk management obligation affecting every regulated financial institution in the country.
Payments Vision 2028 is RBI's most explicit statement yet that AI will be central to both payments expansion and payments risk management. When RBI Governor Sanjay Malhotra states at FIBAC 2026 that the Digital Payment Intelligence Platform will use AI and machine learning "while retaining human oversight," that phrase is not incidental. It is a governance standard: AI systems that process payments decisions must have human oversight, and that oversight must be real rather than nominal.
Payments Vision 2028: Four AI Governance Dimensions
Digital Payment Intelligence Platform (DPIP)
RBI-operated centralized AI/ML fraud detection infrastructure. Banks connect to DPIP to receive network-level fraud signals. Makes RBI an AI operator — not just an AI regulator. Creates two-level AI governance for payment fraud: network layer (DPIP, RBI-operated) and institution layer (bank's own fraud AI). Banks must treat DPIP signals as third-party AI under RBI MRMF, including independent performance oversight and human override protocols for DPIP-blocked transactions.
Responsible AI Deployment for Financial Inclusion
RBI Governor Malhotra's explicit caution: AI can accelerate financial inclusion, but "careless or poorly governed deployment could create new forms of exclusion." AI that optimizes for existing digital payment users may systematically exclude first-time digital payment users, rural populations, and low-literacy users. Payment AI governance must include inclusion testing: does the AI perform equitably across geographic segments, income segments, and digital literacy levels? AI that achieves low false positive rates in urban Maharashtra but high blocking rates in rural Odisha fails the Vision's financial inclusion mandate.
Shared Responsibility Framework for Fraud
Payments Vision 2028 proposes a shared liability framework where both the issuer bank (customer's bank) and the beneficiary bank share liability for unauthorized digital payment transactions. This creates a financial incentive structure for payment AI governance: a bank with strong fraud AI governance, documented performance metrics, and evidence of adequate controls is better positioned in shared liability disputes than a bank that deployed AI without governance documentation. The adequacy of fraud AI governance becomes a material factor in determining each institution's share of fraud liability.
Customer Kill Switch and AI Override Obligations
RBI's proposed Kill Switch enables customers to instantly block outgoing digital payments during suspected fraud, cyberattacks, device theft or unauthorized access. Banks deploying AI fraud detection must ensure their AI does not conflict with customer-initiated Kill Switch activations. A bank's fraud AI that continues to process outgoing payments after a customer has activated their Kill Switch — because the AI did not receive the Kill Switch signal in time, or because the AI workflow is not integrated with the Kill Switch — creates both regulatory non-compliance and consumer protection risk. Kill Switch integration is an AI governance requirement, not just an operational requirement.
NPCI FiMI: India's First Sector-Specific Payment AI Model
NPCI's FiMI (Finance iMI) is a finance-focused language model developed for India's payments ecosystem. As of 2026, FiMI serves over 1 million users for payment support tasks: canceling UPI mandates, resolving payment failures, checking transaction status, and managing payment disputes. FiMI represents a new category of AI governance challenge: a sector-specific AI model operated by the payments infrastructure operator (NPCI) that banks offer to their customers through integrated channels.
Third-party AI governance obligation: When a bank integrates FiMI into its customer support channels, FiMI is a third-party AI model under RBI MRMF. The bank cannot delegate its AI governance obligation to NPCI. The bank must: maintain visibility into FiMI's performance for its customer segment; retain the ability to override or disable FiMI integration if performance is unacceptable; disclose to customers that AI is being used for payment support; and comply with MRMF's explainability requirements for FiMI outputs when customers dispute payment support decisions. The fact that NPCI developed FiMI does not exempt banks from third-party AI governance — the MRMF explicitly holds regulated entities responsible for third-party model outcomes regardless of the third party's regulatory standing.
RBI MRMF and Payments AI: Application by System Type
RBI's Draft MRMF (June 2026) applies to all AI and ML models used by regulated entities. For payment system participants, this creates governance obligations across five distinct AI system types:
Real-time Fraud Detection AI
AI models that evaluate UPI, NEFT, RTGS, IMPS, and card transactions in real time for fraud risk. These are high-materiality models under MRMF: they affect customers (blocking legitimate transactions), revenue (processing speed and approval rates), and regulatory compliance (fraud liability). MRMF requires: model inventory, independent validation, performance monitoring, human override for flagged transactions, and explainability for blocked payment communications. Real-time AI latency constraints (sub-100ms for UPI) must be balanced against validation depth requirements.
AML Transaction Monitoring AI
AI used for Anti-Money Laundering (AML) transaction monitoring under PMLA/FIU-India requirements. AML AI generates Suspicious Transaction Reports (STRs) and Cash Transaction Reports (CTRs) submitted to FIU-India. MRMF validation for AML AI must address: recall rate (what percentage of genuinely suspicious transactions are flagged), precision (rate of false positives creating compliance team burden), regulatory reporting accuracy (STR/CTR completeness and accuracy), and alert management efficiency (time from flag to SAR/STR submission). AML AI with low recall creates regulatory exposure; AML AI with low precision creates compliance cost.
DPIP Integration AI
AI workflows that receive, process, and act on fraud signals from RBI's Digital Payment Intelligence Platform. DPIP integration AI is inherently third-party AI under MRMF: the signal source (DPIP) is RBI-operated, but the bank's response logic (block transaction, flag for review, pass through) is its own AI layer. Banks must validate the response logic independently, maintain performance metrics for DPIP-integrated workflows (not just DPIP's underlying accuracy), and document how DPIP signals are weighted against the bank's own fraud signals when they conflict.
Cross-border Payments AI
AI for cross-border payment routing, FX conversion, correspondent banking selection, and cross-border fraud detection. Payments Vision 2028 explicitly prioritizes cross-border payment efficiency, including UPI-linked cross-border payments (UAE, Singapore, Bhutan, Nepal, Mauritius, France interlinkages). Cross-border AI creates multi-jurisdiction governance: fraud AI for India-UAE UPI payments is subject to RBI MRMF for the India leg and potentially UAE CBUAE AI regulations for the UAE leg. Banks with cross-border payment AI must map their governance to both jurisdictions.
State Bank of India, HDFC Bank, PhonePe, Paytm, Razorpay, and India's Payments AI Landscape
- SBI and public sector banks — DPIP integration at scale: State Bank of India processes the largest volume of UPI transactions of any bank in India. SBI's integration with DPIP will create one of the largest bank-DPIP AI governance relationships in the country. SBI's MRMF obligations for DPIP integration extend to its entire digital banking infrastructure — SBI YONO's fraud detection, SBI's UPI fraud monitoring, and SBI's AML transaction monitoring all fall within MRMF scope. Public sector banks that are slower to build AI governance infrastructure face examination risk as RBI moves toward MRMF-based supervision.
- HDFC Bank and private sector banks — payments AI sophistication: HDFC Bank has been India's most AI-forward major private sector bank, deploying AI across credit, fraud, customer service, and payments. HDFC's fraud detection AI for its 50 million+ debit and credit card base, its UPI fraud monitoring, and its customer-facing payment AI (Eva chatbot's payment support functions) all require MRMF governance documentation. Private sector banks that have deployed sophisticated payments AI without corresponding governance infrastructure face the largest MRMF gap — their AI capability exceeds their AI governance maturity.
- PhonePe, Paytm, Razorpay — payment aggregators and RBI oversight: Payment aggregators (PAs) are regulated by RBI under the Payment Aggregators and Payment Gateways guidelines. AI deployed by PAs for merchant onboarding, transaction fraud detection, and customer support falls within RBI's oversight. While RBI MRMF's explicit scope is RBI-regulated entities (which includes PAs through PA regulations), the governance expectations the MRMF establishes for banks will create de facto standards for PA AI governance as well. The Digital Payment Intelligence Platform's network-level fraud signals will be extended to PAs over time, creating the same DPIP integration governance obligations for major payment aggregators.
- RBI Payments Vision 2028 and India's G20 global payments leadership: India's G20 2023 presidency established cross-border payment interoperability as a priority. Payments Vision 2028 continues this with UPI-linked cross-border payment extensions to more countries. AI governance for cross-border UPI payments is a new frontier where India's domestic MRMF governance must interoperate with partner jurisdictions' AI governance frameworks — RBI, MAS (Singapore), UAECBUAE, and Reserve Bank of Fiji are all developing AI governance standards simultaneously. Zytra's multi-framework governance approach maps India's MRMF requirements alongside partner jurisdiction requirements for cross-border payment AI.