Does RBI MRMF apply to fintech companies in the RBI Regulatory Sandbox?

Yes. RBI MRMF June 2026 applies to all entities using AI/ML models in material financial decisions — and the sandbox does not exempt participants from this obligation. MRMF Sections 2 and 3 apply to sandbox participants using AI models in their proposed product. The sandbox framework requires participants to operate under a defined regulatory relaxation (the 'sandbox dispensation') while complying with consumer protection, data governance, and systemic risk requirements that are not relaxed. AI model governance falls within the non-relaxed requirements: if a sandbox participant's product uses an AI model to make credit decisions, assess insurance risk, or execute payment routing, that model must meet MRMF's documentation and validation requirements. RBI's sandbox admission review evaluates AI governance maturity as part of the eligibility assessment — a fintech that cannot demonstrate basic AI model documentation is unlikely to receive sandbox admission for an AI-driven product.

What AI governance documentation does RBI Regulatory Sandbox require for Cohort 6 and 7 applicants?

RBI's sandbox enabling framework (October 2019) and Cohort 6 theme circular (MSME lending, 2023) require applicants to submit a product description that includes: (a) the AI/ML model's purpose, inputs, and outputs; (b) the training data approach and data governance; (c) the validation methodology and results to date; (d) explainability approach — how the model's decisions can be explained to customers and regulators; (e) bias testing results — evidence that the model does not produce systematically discriminatory outcomes; and (f) monitoring plan — how the participant will track model performance during the sandbox period. For Cohort 7 (expected theme: emerging payment technologies and embedded finance), the same requirements are expected with additional emphasis on agentic AI governance given RBI's 2026 agentic AI attention. A fintech that submits a sandbox application with an AI model but without these governance documents is unlikely to be selected.

What happens to AI governance requirements when a fintech exits the RBI sandbox?

RBI's sandbox enabling framework Section 11 (exit conditions) requires that a successful sandbox participant seeking to scale beyond the sandbox obtain either a full license or operate under an existing Regulated Entity partner. The exit governance package — the documentation a fintech must prepare to demonstrate readiness for full deployment — includes AI governance as a core component. Specifically, the exit package must show: (a) model validation results on production-scale data, not just the limited sandbox population; (b) performance monitoring infrastructure in place and operational; (c) governance structures (model risk committee, model inventory) appropriate for the scale of deployment proposed; (d) compliance with all MRMF requirements that applied in relaxed form during the sandbox. A fintech that ran a successful sandbox experiment but did not build production-ready AI governance during the sandbox period faces a delay between sandbox graduation and production deployment — the governance infrastructure takes time to build, and RBI will not approve full deployment without it.

How does the RBI Innovation Hub (RBIH) approach AI governance for fintech collaborations?

RBIH, as RBI's wholly owned subsidiary for financial innovation, engages with fintechs on product development and regulatory engagement. In RBIH's collaboration framework, AI governance is assessed at the early engagement stage — RBIH evaluators who review fintech products for potential RBI regulatory engagement assess whether the product's AI components have been designed with governance in mind. Products that use AI for credit scoring, fraud detection, or financial advisory are expected to have articulated their model documentation approach, their explainability design, and their bias testing plan before RBIH will recommend them for sandbox consideration. RBIH has specifically flagged that foundation model-based products (using GPT, Claude, Gemini, or similar as the underlying AI) require additional governance documentation: the fintech must demonstrate that it understands and can govern the behavior of the foundation model it is building on, not just its own application layer.

AI Governance · RBI Regulatory Sandbox · RBIH · Fintech · India BFSI

RBI Regulatory Sandbox AI Governance: What Fintech Cohort Applicants Must Demonstrate and Why MRMF Applies Inside the Sandbox

The RBI Regulatory Sandbox does not exempt participants from AI governance obligations — MRMF applies to sandbox AI models. Cohort 6 required MSME credit AI documentation. Cohort 7 preparation requires the same, with additional agentic AI governance emphasis. Fintechs that enter the sandbox without AI governance infrastructure face both admission risk and delayed exit graduation.

Zytra Research Team · October 2026 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's RBI Regulatory Sandbox has completed five cohorts since 2019 and has evaluated over 300 fintech applications. AI and ML-powered products appear in every cohort theme — from AI-driven MSME credit scoring in Cohort 6 to AI-based payment fraud detection in Cohort 5. In every case, RBI's sandbox evaluation team assesses whether the applicant has a credible AI governance approach before admitting the product to the sandbox.

The common misconception among fintech founders applying to the sandbox: that the sandbox is a governance-free zone, a space to experiment before the regulatory requirements kick in. This is not how RBI's sandbox works. The sandbox provides a defined regulatory dispensation — specific rules that are relaxed for the duration of the sandbox experiment — but consumer protection, data governance, and AI model accountability are not in the dispensed category. They apply inside the sandbox with the same force as outside it.

Understanding what RBI expects from sandbox participants using AI — and what the governance documentation package for sandbox application and exit looks like — is material for every fintech preparing to apply and for RBI-regulated entities (banks and NBFCs) considering sandbox partnerships with AI-native fintechs.

The Sandbox Framework and Its AI Governance Baseline

RBI's "Enabling Framework for Regulatory Sandbox" (October 2019, circular RBI/2019-20/161) establishes the eligibility criteria, operational requirements, and exit conditions for sandbox participants. Section 8 (eligibility) requires that applicants demonstrate:

A minimum viable product that is ready for testing
Adequate consumer protection measures
Fit and proper criteria for the entity's management team
Adequate financial standing
Compliance plans for applicable regulations

For AI-powered products, "adequate consumer protection measures" and "compliance plans for applicable regulations" together require AI governance documentation. A product that makes credit decisions using an AI model but cannot explain those decisions to a customer whose application is declined does not have adequate consumer protection measures. A product using an AI model that the team has not validated does not have adequate compliance plans for MRMF.

RBI's sandbox admission review is not a box-checking exercise — the evaluation team includes technical reviewers who assess whether the product's AI components are genuinely governed, not just superficially documented. Fintechs that produce model governance language they do not actually implement are identified in the review process.

Cohort 6 (MSME Lending) AI Documentation Requirements

Cohort 6's MSME lending theme attracted the highest proportion of AI-powered applications of any sandbox cohort to date. RBI's Cohort 6 theme circular identified AI-driven credit assessment for MSMEs as a priority innovation area — alternative data scoring, cash-flow-based lending using GST data and bank statements, and AI-powered collateral-free underwriting were all within scope.

For applications in this theme, RBI's evaluation team required:

Model purpose and scope. A clear statement of what the AI model does — what inputs it takes, what output it produces, and how that output influences credit decisions. Vague descriptions ("AI analyzes customer data and produces a credit score") were insufficient; the evaluation team expected specific feature category descriptions and output interpretation guidance.

Data governance documentation. A description of the data sources used for model training and inference, consent and data minimization documentation, and compliance with RBI's Digital Lending Guidelines data collection restrictions. Cohort 6 applications using phone behavioral data or social graph data without clear consent documentation were flagged.

Validation evidence. Evidence that the AI model had been tested on representative data — ideally a mix of bureau-positive and bureau-thin/bureau-negative MSME profiles, since the underserved MSME population the sandbox theme targeted often has limited credit bureau history. Models validated only on bureau-rich profiles were questioned for their ability to perform on the actual target population.

Explainability approach. A description of how credit decisions would be explained to MSME borrowers. Models with no explainability mechanism were not admitted — a fundamental consumer protection requirement under the sandbox framework's consumer protection conditions.

Bias testing results. Evidence that the model had been tested for differential performance across geographic regions, industry categories, and owner demographics. Cohort 6 evaluators were specifically attentive to whether models performed differently for women-owned MSMEs and for MSMEs in rural or semi-urban locations — segments that RBI considers priority financial inclusion beneficiaries.

MRMF Application Inside the Sandbox

MRMF June 2026 applies to all RBI-regulated entities and — for sandbox participants that are not yet independently licensed — applies through their Regulated Entity partner. Most sandbox participants operate under a partnership or co-origination arrangement with a licensed bank or NBFC; that RE partner is accountable for the AI model governance of the fintech's system under MRMF, in the same way that REs are accountable for LSP AI models under the Digital Lending Guidelines.

For sandbox participants that receive a sandbox license directly (the rarer case), MRMF's requirements apply to the participant itself. The practical obligations:

Model inventory entry. The AI model used in the sandbox experiment must be in a model inventory — the sandbox participant's own inventory if independently licensed, or the RE partner's inventory if operating under a partnership. The sandbox experiment period is not a period of operation outside the model governance framework; it is a period of limited-scale production deployment with relaxed prudential rules but not relaxed governance rules.

Ongoing monitoring. MRMF Section 6 requires production performance monitoring. For a sandbox experiment running on a limited population (sandbox scale is typically bounded), "production" means the experiment population. Performance metrics tracked during the sandbox period become the baseline for the exit governance package.

Explainability at scale. The explainability mechanism tested during the sandbox must be scalable to full production deployment. A sandbox that uses manual explanation generation — a human analyst writing explanations for the limited sandbox population — has not demonstrated a production-ready explainability architecture. RBI exit reviews assess whether the governance mechanisms scale.

RBIH Engagement and Foundation Model Governance

RBIH, as RBI's innovation subsidiary, engages with fintechs before sandbox application — through innovation challenges, collaboration programs, and direct engagement. RBIH's early-stage assessment of AI-powered products now explicitly includes foundation model governance when the product is built on a large language model or multimodal AI foundation.

RBIH evaluators assess foundation model products on dimensions that differ from traditional ML model governance:

Guardrail documentation: what guardrails prevent the foundation model from generating harmful, incorrect, or non-compliant outputs in the financial context?
Hallucination management: for products where the AI provides financial information or recommendations, what mechanisms detect and prevent hallucinated outputs that could mislead customers?
Prompt injection resistance: for products with customer-facing LLM interactions, what defenses exist against prompt injection that could cause the model to bypass its intended behavior?
Vendor dependency risk: if the product depends on a third-party foundation model API (OpenAI, Google, Anthropic), what is the continuity plan if the API is unavailable, rate-limited, or changes its behavior?

These questions are not hypothetical — they reflect RBIH's actual assessment criteria for foundation model products, informed by the incidents documented in MeitY's Digital Threat Report and RBI's own supervisory observations.

Exit Governance Package: What Sandbox Graduation Requires

Section 11 of the sandbox enabling framework defines exit conditions. For an AI-powered product seeking to graduate from sandbox to full deployment, the exit governance package must demonstrate:

Production-scale validation results: model validation on the sandbox experiment data, showing real-world performance metrics, not just pre-sandbox validation on historical data
Performance monitoring infrastructure: operational monitoring system with defined alert thresholds, not a spreadsheet tracking model outputs manually
Governance structure appropriateness: model risk committee or equivalent oversight structure appropriate for the intended deployment scale
Full MRMF compliance documentation: complete model card, validation report, ongoing monitoring plan, escalation protocols — everything MRMF requires for a production AI model
Consumer protection mechanism validation: evidence from the sandbox experiment that the consumer protection mechanisms (explainability, grievance, disclosure) functioned as intended with real borrowers

Sandbox AI Governance Readiness Checklist

☐ Model purpose and scope documentation: specific inputs, outputs, decision influence — not vague AI capability description
☐ Data governance: data sources documented; DL Guidelines data collection compliance confirmed; consent architecture for alternative data
☐ Training data validation evidence: representative of target population (bureau-thin, rural, women-owned if applicable)
☐ Explainability mechanism: production-ready, not manual; generates explanation per decision; translates to plain language
☐ Bias testing results: differential performance across geographic, demographic, and industry segments; financial inclusion segments specifically tested
☐ MRMF model inventory entry: model in inventory of sandbox participant or RE partner
☐ Sandbox monitoring infrastructure: production monitoring for sandbox experiment population; metrics tracked and baseline established
☐ Foundation model governance (if applicable): guardrails, hallucination management, prompt injection defenses, vendor dependency continuity plan
☐ RBIH early engagement: AI governance documentation reviewed at RBIH pre-application stage if RBIH engagement path is pursued
☐ Exit package preparation: production-scale validation plan defined before sandbox admission; governance infrastructure build timeline aligns with sandbox experiment duration
☐ RE partner governance agreement: if operating under RE partnership, RE has model in MRMF inventory; RE has conducted or commissioned independent validation

The RBI Regulatory Sandbox is an accelerated path to market for fintech innovation — but it is not a shortcut around AI governance. The most common failure mode for fintechs in the sandbox is not technical product failure; it is governance infrastructure inadequacy at exit. Building AI governance during the sandbox period — not as a separate compliance project after graduation — is the condition for a smooth path from sandbox to scale.