RBI Urban Cooperative Bank AI Governance 2026: Tier-by-Tier MRMF Obligations

UCB Regulatory Architecture Post-2020

Urban cooperative banks were historically regulated under a dual control arrangement — the Reserve Bank of India governed banking functions while the Registrar of Cooperative Societies administered organisational matters. This dual control created persistent regulatory gaps: UCBs could fall between jurisdictions on supervisory matters that spanned both domains. The Banking Regulation (Amendment) Act 2020 resolved this by giving RBI direct supervisory authority over UCBs, closing the gap and bringing UCBs into the same supervisory framework as commercial banks.

The 2022 UCB Regulatory Framework introduced a four-tier classification based on net worth, deposit size, and capital adequacy requirements:

Scale context from RBI 2025 data: 1,514 UCBs total. Tier 1 accounts for approximately 1,100 UCBs; Tier 2 approximately 350; Tier 3 approximately 55; Tier 4 approximately 9. UCBs now face the same supervisory examination process as commercial banks — CAMELS framework, the RBI DAKSH supervisory portal, CRAR requirements, and now AI governance under MRMF.

Which RBI AI Frameworks Apply to UCBs

MRMF June 2026

The Model Risk Management Framework (June 2026) explicitly covers "scheduled commercial banks, small finance banks, payments banks, non-banking financial companies, and other RBI-regulated entities." UCBs fall within "other RBI-regulated entities" — MRMF applies. RBI applies proportionality in its supervisory expectations: Tier 1 UCBs face lighter obligations than Tier 4 UCBs, but all tiers are within scope.

RBI Cybersecurity Framework for Banks

The RBI Cybersecurity Framework for Banks (2016, updated) applies to UCBs above ₹100 crore in deposits. Smaller UCBs follow a lighter IT framework. AI security controls under the Cybersecurity Directions apply where the cybersecurity framework is applicable — making Tier 2 and above the primary scope for cybersecurity-driven AI governance.

FREE-AI (September 2024)

The Fairness, Reliability, Explainability, and Ethics for AI (FREE-AI) principles apply to all RBI-regulated entities. UCBs using AI for any member-facing decision — credit, KYC, transaction limits — face FREE-AI fairness obligations regardless of tier. This is a lower threshold than MRMF's proportionality framework: even a Tier 1 UCB using AI for member credit decisions must be able to explain those decisions and demonstrate basic fairness.

PMLA and KYC

UCBs are reporting entities under PMLA. AI used for KYC, suspicious transaction identification, or beneficial ownership determination carries PMLA compliance obligations. FIU-India examinations specifically review STR quality and volume — any AI-assisted STR decision must have a documented decision trail.

UCB AI Deployment Reality: What They Actually Use

UCB technology maturity varies enormously across tiers. Tier 4 UCBs — Saraswat Bank, Cosmos Bank, TJSB, and a handful of others — have technology sophistication approaching small finance banks. Tier 1 UCBs may run on core banking systems with minimal AI beyond standard CBS features.

The most important pattern for AI governance purposes: core banking system vendors including Infosys Finacle, Temenos BankFusion, TCS BaNCS, Oracle FLEXCUBE, and Polaris have progressively embedded AI and ML features into their platforms. UCBs running these platforms may be using AI for credit decisions, fraud detection, or liquidity management without a formal governance framework — because the AI came bundled with the CBS, not as a deliberate AI system deployment decision.

Common AI deployments across UCBs by type:

• Core banking AI features: transaction monitoring, fraud detection, and liquidity management features built into major CBS platforms — UCBs may be running these without a formal inventory
• KYC automation: video KYC and document verification AI for member onboarding, especially post-2021 as RBI expanded V-CIP guidelines
• Loan processing AI: credit appraisal AI in CBS for small-ticket personal and housing loans
• Transaction fraud detection: CBS-embedded fraud monitoring for digital banking channels
• Digital banking AI: some Tier 3 and Tier 4 UCBs have deployed digital banking apps with AI-assisted customer service and chatbot functionality

Tier-Proportional AI Governance Obligations

Tier 1 UCBs (≤₹100 crore, ~1,100 UCBs) — Minimum Viable AI Governance

• Identify whether the CBS includes AI features — contact the CBS vendor for a feature inventory
• If video KYC is used: document the AI provider, UIDAI integration, and error rates
• No independent validation requirement for embedded CBS AI under proportionality
• Data localization: basic check that the CBS is hosted in India — most major CBS vendors comply, but the UCB is responsible for confirming

Tier 2 UCBs (₹100–1,000 crore, ~350 UCBs) — Structured AI Governance

• Formal model inventory: list all AI systems in use, including CBS-embedded features, with owner and purpose documented
• Risk tiering: classify AI systems by risk level — customer-facing credit AI is High; internal analytics tools are typically Low
• Performance monitoring: for credit AI, track approval rate, NPA rate by AI-scored cohort, and rejection reason distribution monthly
• PMLA AI documentation: if AI assists STR generation, document the model and maintain an audit trail sufficient for FIU-India examination
• Cybersecurity framework: AI security controls per the RBI Cybersecurity Framework, including access controls for AI systems and incident classification

Tier 3 UCBs (₹1,000–10,000 crore, ~55 UCBs) — MRMF-Aligned Governance

• Full MRMF model inventory with formal risk tiering using MRMF's High/Medium/Low/Critical classification
• Independent validation for High and Critical AI systems — validation by a function independent of the model development team
• Board-level AI risk oversight — at minimum annual reporting to the Board or its Risk Committee on the AI risk profile
• DAKSH supervisory portal readiness: AI governance documentation accessible for RBI examination through DAKSH-compatible formats
• FREE-AI compliance: fairness testing for credit and member service AI, with documentation of test methodology and results

Tier 4 UCBs (>₹10,000 crore, ~9 UCBs) — Full MRMF Compliance

• Same AI governance obligations as commercial bank peers of equivalent size
• Board-approved AI risk appetite statement as a standalone document, not embedded in general risk appetite
• Dedicated model risk management function — not necessarily a separate team, but a designated owner with governance authority
• MRMF-compliant validation, change management, and ongoing monitoring frameworks with documented policies
• CERT-In registration and AI incident reporting under the 6-hour notification framework for AI system compromise events

CBS-Embedded AI: The Hidden Governance Gap

The most common AI governance gap in UCBs is also the least visible: core banking system vendors have added AI and ML capabilities to their platforms over the past five years, and UCBs running these platforms may be using AI for material decisions — credit scoring, fraud detection, liquidity management — without a governance framework, simply because the AI arrived bundled with the CBS rather than as a deliberate deployment decision.

RBI MRMF is unambiguous: the regulated entity — the UCB — is responsible for all AI used in its operations. The fact that the AI came from a CBS vendor does not transfer this responsibility. Three CBS-embedded AI governance actions that every UCB must take:

1. Vendor AI inventory: contact the CBS vendor and request a list of all AI and ML features enabled in the UCB's specific configuration. Most major vendors maintain a model inventory list for their platform. This is the starting point for any UCB AI governance program and costs nothing.
2. Configuration review: confirm which AI features are active (default-on versus explicitly enabled), what decisions they influence, and what the human override or review process is. CBS platforms typically allow certain AI features to be disabled — understanding the configuration is prerequisite to understanding governance obligations.
3. Contract addendum: ensure the CBS contract includes AI model documentation obligations, change notification when AI features are updated, and performance reporting requirements. Standard CBS contracts from 2020 or earlier will not include these provisions. Renegotiating or supplementing the contract is necessary for MRMF compliance on vendor AI.

Five Priority Actions for UCB AI Governance

1. CBS vendor AI inventory (all tiers, immediate): Contact the CBS vendor and request the AI feature inventory for the UCB's configuration. This is the foundation of any UCB AI governance program. It requires no budget, only a conversation with the vendor account manager, and it maps the full scope of AI the UCB is already operating. Most banks that have done this discover they are running more AI than they believed.
2. PMLA AI documentation (Tier 2 and above, priority): Any AI that assists in suspicious transaction report generation or suspicious transaction identification must be documented with a decision trail sufficient for FIU-India examination. FIU examinations specifically review STR quality, volume, and the basis for identification — an AI-assisted STR decision without documentation creates direct regulatory exposure.
3. Video KYC AI governance (all UCBs using V-CIP): UCBs using video KYC for member onboarding must document the AI provider, validate error rates including the false rejection rate for legitimate members, and ensure UIDAI OTP integration compliance. DPDP Act obligations apply to biometric data processed in video KYC — this creates a data protection layer on top of the existing KYC compliance framework.
4. Credit AI performance monitoring (Tier 2 and above): For any AI involved in credit decisions — whether CBS credit scoring, external credit bureau integration, or internal credit appraisal AI — track monthly metrics: approval rate, NPA rate by AI score band, and rejection reason distribution. This monitoring serves both MRMF compliance and practical credit risk management, and provides the data needed for DAKSH examination readiness.
5. Board AI awareness (Tier 3 and Tier 4): RBI's post-2020 UCB supervision has elevated board governance requirements across all domains. Board members should receive at minimum one AI governance briefing per year — covering what AI the UCB operates, what the key risks are, and what the current governance status is. MRMF's board reporting requirement applies to Tier 3 and Tier 4 UCBs as a formal obligation; for Tier 2 UCBs it is advisable governance hygiene.

Frequently Asked Questions