Do Upper Layer NBFCs face AI governance obligations under RBI's Scale Based Regulation?

Yes — implicitly and materially. RBI's SBR Master Direction 2023 (RBI/2023-24/53, DNBR.PD.008/03.10.119/2023-24, April 19, 2023) places Upper Layer NBFCs (UL-NBFCs) — the RBI-designated list including Bajaj Finance, Shriram Finance, L&T Finance, Mahindra Finance, Tata Capital — under governance and oversight obligations equivalent to scheduled commercial banks in many respects. Clause 73 mandates a Board-level risk management committee with oversight over all material risks. At Bajaj Finance, which processes 12+ million new loans annually using ML credit scoring, the Board risk committee's obligation to oversee 'all material risks' unambiguously includes the credit AI model risk. However: unlike banks (which fall under RBI MRMF 2026), UL-NBFCs have no explicit NBFC-specific model risk management circular. The governance obligation exists — it flows from Clause 73 and the general risk management provisions — but the specific requirements for model inventory, independent validation, and board reporting are undefined. This creates a first-mover compliance gap: UL-NBFCs with sophisticated AI portfolios are operating in a regulatory space where the obligation is clear but the standard is absent.

How does the ICAAP requirement in SBR create a model validation obligation for NBFC credit AI?

RBI's SBR Master Direction requires UL-NBFCs to conduct an Internal Capital Adequacy Assessment Process (ICAAP) to assess whether their capital is adequate relative to their risk profile. At Bajaj Finance, Shriram Finance, and other UL-NBFCs, credit risk capital requirements are substantially driven by ML credit scoring models — the model's output determines which loans are originated, at what ticket size, and at what expected loss rate, which feeds the ICAAP capital calculation. This chain creates a model validation obligation: if the credit AI model systematically mis-estimates default probability (model drift, out-of-distribution behaviour on new customer segments), the ICAAP capital calculation is wrong, and the NBFC's reported capital adequacy overstates its actual buffer. RBI MRMF 2026 — which covers banks — explicitly addresses this risk through its pre-deployment validation and ongoing PSI monitoring requirements. NBFCs face no equivalent circular. The practical consequence: an UL-NBFC presenting ICAAP results to RBI's supervisory team with credit risk driven by an un-independently-validated ML model has a gap that RBI inspectors increasingly flag, even without a specific NBFC model risk circular.

What AI governance obligation arises from SBR's liquidity requirements for Middle Layer NBFCs?

SBR Master Direction Clauses 41–52 require Middle Layer and Upper Layer NBFCs to comply with Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio (NSFR) requirements. AI-driven liquidity forecasting models — used to project cash inflows, model prepayment behaviour on loan portfolios, and forecast Net Cash Outflows for LCR calculation — are implicitly in scope of the SBR's 'stress scenario' provisions. The obligation: liquidity stress scenarios must be credible and conservative. If the AI model used for LCR forecasting has been trained on data from a benign liquidity environment and has not been stress-tested against scenarios like the 2018 IL&FS crisis or the 2020 COVID liquidity shock, its outputs cannot satisfy the stress scenario requirements. Three unaddressed questions in the SBR framework: (1) Is there a documentation requirement for NBFC liquidity AI models comparable to the model card concept in MRMF? No — SBR is silent. (2) Must the AI model's performance be validated independently before it feeds ICAAP/LCR submissions? SBR does not specify. (3) What is the NBFC's obligation when its liquidity AI model is provided by a third-party treasury management system vendor? SBR's outsourcing provisions apply, but no NBFC-specific AI vendor risk management standard exists.

How can ML credit scoring models at NBFCs accelerate PCA trigger conditions?

RBI's Prompt Corrective Action Framework for NBFCs (December 14, 2021) triggers supervisory restrictions when an NBFC's Net NPA ratio exceeds 6% or its Capital to Risk-weighted Assets Ratio falls below prescribed levels. ML credit underwriting models that systematically mis-estimate credit risk — through training data that underrepresents stressed borrower behaviour, feature selection that creates adverse selection, or model drift as borrower profiles shift — can produce a deteriorating loan book that reaches PCA trigger conditions faster than rule-based underwriting would. Three AI-specific PCA risk dynamics: (1) Concentration risk from model-driven similarity: ML models trained on historical approval data may recommend loans with systematically similar risk characteristics, creating portfolio concentration that amplifies the NPA impact of any sector or macroeconomic shock; (2) Rapid portfolio expansion enabled by AI: NBFCs with AI underwriting have significantly expanded loan disbursement volumes and customer segments. A model that performs well in growth conditions but hasn't been validated on stressed conditions could produce large NPA volumes quickly; (3) Vintage analysis gap: traditional credit risk management uses vintage analysis to track cohort default rates over time. AI-underwritten cohorts may have fundamentally different risk characteristics than historically-modeled cohorts, making vintage analysis less predictive of future PCA risk than it was for rule-based portfolios. NBFC risk committees should build PCA sensitivity testing into their AI model governance: what NPA deterioration scenario from model failure would trigger PCA threshold conditions, and over what time horizon?

AI Governance · RBI · NBFC · Scale Based Regulation · Upper Layer · India BFSI

RBI Scale Based Regulation NBFC AI Governance: Upper Layer NBFC Credit AI, ICAAP Model Validation Gap, Liquidity AI Stress Testing and PCA Trigger Risk India 2026

RBI's SBR Master Direction 2023 places Upper Layer NBFCs (Bajaj Finance, Shriram Finance, L&T Finance) under bank-equivalent governance obligations that implicitly cover their AI-driven credit, liquidity, and collections systems — without an NBFC-specific model risk management circular to define the standards. Board risk committee oversight covers credit AI. ICAAP capital calculations fed by ML models have no validation standard. Liquidity AI models face undefined stress testing requirements. ML underwriting drift can accelerate PCA trigger conditions. Zero global competitor coverage.

Zytra Research Team · October 2026 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's Non-Banking Financial Company sector — with 9,400+ registered NBFCs including giants like Bajaj Finance (assets exceeding ₹3.5 lakh crore), Shriram Finance, L&T Finance, Mahindra Finance, and Tata Capital — has adopted AI at a pace that outstrips Indian banks in some dimensions. Bajaj Finance processes loan applications in 180 seconds using ML; Shriram Finance has AI-driven collections scoring for its large used-vehicle loan portfolio; HDFC Securities and other NBFC-affiliate securities firms use AI for portfolio construction and risk monitoring.

RBI's Scale Based Regulation (SBR) framework, introduced through Circular RBI/2021-22/112 (October 22, 2021) and operationalised through the SBR Master Direction 2023 (RBI/2023-24/53, April 19, 2023), restructures NBFC oversight into four layers — Base Layer, Middle Layer, Upper Layer, and Top Layer — with escalating governance obligations. Upper Layer NBFCs face bank-equivalent requirements in risk management, governance, and capital adequacy. Middle Layer NBFCs face lighter but still significant compliance obligations. Neither category has a dedicated model risk management circular.

SBR Clause 73: Board AI Oversight Without a Standard

SBR Master Direction Clause 73 requires Upper Layer NBFCs to establish a Board-level Risk Management Committee (RMC) with oversight over all material risk categories. The clause is not AI-specific — it was written with credit risk, liquidity risk, and operational risk in mind. But the RMC's scope over "all material risks" cannot exclude the credit AI models that originate 90% of an UL-NBFC's loan volume, or the collections AI that manages 100% of its post-disbursement portfolio.

What the SBR framework provides and what it leaves undefined:

Provided: Board-level oversight obligation for all material risks
Undefined: What constitutes adequate AI governance for the RMC to satisfy its oversight obligation
Provided: Chief Risk Officer requirement with independent reporting line to the Board
Undefined: Whether the CRO's risk oversight includes AI model risk, and what documentation standards apply
Provided: Internal audit with risk-based scope (Clause 89)
Undefined: Whether AI model audit requires CERT-In empanelled auditors (as for banks under Clause 26), specialist AI auditors, or only internal audit capability

RBI's MRMF 2026 fills these gaps for banks explicitly. UL-NBFCs, pending an NBFC-specific model risk circular (which RBI's Discussion Paper on MRM framework, August 2023, foreshadowed), should treat MRMF as a governance standard to aspire to — but the legal obligation flows from Clause 73 and is expressed as the general duty to manage material risks, not the specific MRMF obligations.

ICAAP and Credit AI: The Capital Adequacy Model Validation Gap

SBR requires UL-NBFCs to conduct an Internal Capital Adequacy Assessment Process (ICAAP) and submit it to RBI. The ICAAP assesses whether the NBFC's capital adequately covers its credit risk, market risk, operational risk, and other material risks under both baseline and stress scenarios.

At Bajaj Finance, Shriram Finance, and other ML-intensive UL-NBFCs, credit risk capital requirements are substantially model-driven. The ML model's output — expected probability of default, loss given default, exposure at default — flows into the ICAAP credit risk capital calculation. An independently unvalidated ML model that has drifted from its training distribution, or that performs poorly on recently-onboarded customer segments, produces an ICAAP with systematically understated credit risk capital needs.

Minimum AI governance for ICAAP-linked credit models:

Model documentation: architecture, training data vintage, feature set, validation methodology, out-of-time validation results
Independent validation: internal (by a team independent of the model development team) or external validation of the model's performance on current portfolio characteristics
Stress scenario performance: validation of model performance specifically under stress scenarios comparable to those in the ICAAP — not only through-the-cycle performance
Change management: documentation when model is retrained or architecture modified; re-validation before retrained model feeds ICAAP
Board reporting: regular reporting to the RMC on credit model performance, including segment-level accuracy and NPA prediction tracking versus actual outcomes

PCA Sensitivity: The AI Underwriting Acceleration Risk

RBI's PCA Framework for NBFCs (December 2021) triggers intervention when NPA ratios or capital ratios breach thresholds. Three AI-specific dynamics that can accelerate PCA trigger conditions:

ML-enabled volume expansion: AI underwriting has allowed NBFCs to significantly expand origination — processing more applications, approving loans with thinner data profiles. If the model's risk calibration is off, the expanded volume multiplies NPA exposure
Portfolio concentration from algorithmic similarity: ML approval models may generate portfolios of borrowers with systematically similar risk profiles (same feature combinations lead to approval). A macroeconomic shock affecting that profile creates correlated defaults, amplifying NPA deterioration faster than traditional underwriting's natural diversification
Model drift undetected until vintage analysis: Credit model performance typically becomes visible in loan vintage analysis at 6–12 month cohorts. A drifted model may have been originating substandard loans for 6 months before the NPA deterioration becomes visible in RBI reporting — giving limited time to remediate before PCA thresholds are approached

NBFC SBR AI Governance Checklist

☐ Board RMC charter: explicitly includes AI/ML model risk in the RMC's oversight scope; AI governance agenda item at minimum quarterly RMC meetings
☐ Credit AI documentation: model cards for all ICAAP-linked credit scoring models; training data vintage documented; feature set reviewed for DPDP Act compliance
☐ Independent validation: at least annual independent validation of material credit AI models; validation scope covers stress scenario performance
☐ ICAAP model linkage: ICAAP submission documents the AI models used in credit risk capital calculation; model validation status included in ICAAP
☐ Liquidity AI documentation: LCR/NSFR forecasting AI models documented; stress scenario performance tested against historical stress episodes (2018 IL&FS, 2020 COVID)
☐ PCA sensitivity analysis: PCA threshold breach scenarios modeled under credit AI deterioration assumptions; board-level risk appetite for AI model failure incorporated in PCA monitoring
☐ Internal audit AI scope: internal audit programme includes AI model audit; scope covers model validation currency, change management, performance monitoring, data governance
☐ RBI examination readiness: AI governance documentation packaged for RBI NBFC inspection; credit model documentation, ICAAP model linkage, validation reports available on request