What AI governance obligations do RBI's Urban Co-operative Banks Governance Directions 2025 create?

RBI's Urban Co-operative Banks (Governance) Directions, 2025 (effective November 28, 2025), establish board-level governance structures, director qualification norms, and senior management accountability for all Urban Co-operative Banks — creating a formal governance architecture through which AI-related obligations flow. The Directions themselves do not use the word 'artificial intelligence,' but they create the governance infrastructure through which RBI's other AI-specific circulars (the Draft Guidance on Regulatory Principles for Model Risk Management, 2026, and the FREE-AI Framework, 2025) now apply to UCBs. Four specific AI governance implications: (1) Board-level accountability for material risks including AI/ML: the Governance Directions require boards to exercise meaningful oversight of all material operational risks. RBI's Draft MRMF 2026, which explicitly extends model risk management obligations to Urban and Rural Co-operative Banks, defines AI/ML model risk as a material operational risk. A UCB board that has not addressed AI/ML model risk in its risk committee deliberations is non-compliant with the combined effect of the Governance Directions and the MRMF; (2) CEO and senior management AI oversight: the Directions impose specific accountability requirements on the CEO and senior management. In UCBs where the CEO may simultaneously be managing technology vendor relationships, regulatory reporting, and credit decisions, the AI governance accountability cannot be informally delegated — it requires a defined AI oversight structure; (3) Fit and proper norms for risk oversight: the Directions' fit and proper requirements for board members are relevant to AI governance because RBI's inspection teams increasingly assess whether board members at UCBs can demonstrate understanding of the AI/ML systems their institution deploys. A board with no member who understands AI model risk cannot provide meaningful oversight; (4) Audit committee AI review: the Directions strengthen audit committee requirements. UCBs using AI for credit scoring, fraud detection, or deposit operations must present AI system performance, accuracy, and risk metrics to the audit committee — the same standard that applies to commercial banks under RBI's MRMF.

How does the RBI Draft MRMF 2026 apply differently to Urban Co-operative Banks than to commercial banks?

RBI's Draft Guidance on Regulatory Principles for Model Risk Management (issued June 24, 2026, public comment deadline July 24, 2026) explicitly extends MRMF obligations to Urban Co-operative Banks and Rural Co-operative Banks for the first time — creating AI model risk governance requirements for approximately 1,500 UCBs that previously had no formal model risk framework. The MRMF applies to commercial banks, NBFCs, and now co-operative banks, but the practical implementation challenge differs substantially: (1) Technology team gap: commercial banks have dedicated model risk management teams, data scientists, and validation units. Most UCBs have IT departments of two to five people managing core banking software. The MRMF's requirements for model validation, independent model validation, and ongoing performance monitoring assume a technology and data science infrastructure that most UCBs do not have — the compliance obligation exists but the implementation path is through third-party validation rather than in-house capability; (2) AI deployment pattern: UCBs typically use AI through CBS (Core Banking System) vendors — Finacle, Flexcube, BankMate — which increasingly embed AI features for fraud detection, credit scoring, and know-your-customer analytics. UCBs often do not know which features of their CBS are AI-powered and which are rule-based. The MRMF's model inventory obligation requires UCBs to identify all AI/ML models in use — an obligation that cannot be satisfied without engaging the CBS vendor; (3) Validation independence: MRMF requires independent model validation — the team that validates a model cannot be the team that built it. For UCBs using vendor-embedded AI, the only path to independent validation is a third-party audit of the vendor's AI models, since the UCB has no internal team to provide independence from; (4) Proportionality principle: the Draft MRMF 2026 includes a proportionality clause — the depth of model risk management required should be commensurate with the size, complexity, and risk profile of the institution. UCBs can cite proportionality for lighter-touch implementation, but proportionality is not an exemption. Even a small UCB must have a documented model inventory, a risk-tiered approach, and evidence of governance oversight.

What third-party AI vendor concentration risk obligations arise for Urban Co-operative Banks under the 2025 Governance Directions and MRMF 2026?

Urban Co-operative Banks are almost entirely dependent on third-party vendors for their AI capabilities — they have no significant in-house AI development capacity. The UCB sector's AI footprint consists almost entirely of: CBS vendor-embedded AI (fraud detection, KYC analytics in Finacle, Flexcube); third-party credit scoring platforms (CRIF, Experian, CIBIL-based scoring with AI augmentation); fintech partner AI for digital lending and UPI fraud detection; and increasingly, AI-powered accounting and compliance software. This vendor dependency creates a concentration risk that the RBI MRMF 2026 now requires UCB boards to formally govern. Four specific obligations: (1) Vendor AI inventory: the MRMF model inventory requirement extends to vendor AI — a UCB must document which AI features of its CBS and third-party platforms are active, what they do, and what risk tier they fall into. 'We use Finacle' is not a sufficient model inventory response to an RBI inspection; (2) Vendor AI contract rights: a UCB that does not have audit rights over the AI embedded in its CBS cannot conduct independent validation as required by the MRMF. Retrofitting AI audit rights into multi-year CBS contracts is legally and commercially difficult — but the MRMF creates the obligation regardless; (3) Concentration risk assessment: RBI's MRMF explicitly requires institutions to assess AI vendor concentration risk — the risk that a failure, change, or withdrawal of a vendor AI system would materially impact the UCB's operations. For UCBs where a single CBS vendor provides credit scoring, fraud detection, and KYC analytics, the concentration risk is acute; (4) RBI licence cancellation context: RBI cancelled licences of 10+ UCBs since 2020, in many cases citing governance and oversight failures. A UCB with undisclosed AI vendor dependencies, inadequate model governance, and a board unable to articulate AI risk exposure is presenting the same governance failure profile — in a digital form — that has historically preceded licence cancellation proceedings.

How should Urban Co-operative Banks structure AI governance given their limited technology teams?

Urban Co-operative Banks face a structural implementation challenge: the RBI MRMF 2026 requires model risk governance practices that assume institutional capabilities most UCBs do not have. A practical AI governance structure for UCBs under the combined effect of the Governance Directions 2025 and MRMF 2026 has four components: (1) Board AI risk committee or audit committee mandate: the board does not need an AI expert — it needs a documented process for receiving AI/ML risk reporting from management, asking questions about AI performance and vendor dependency, and making governance decisions. Boards should request a semi-annual AI/ML systems report from management covering: which AI systems are deployed, what risk tier each carries, what validation has been conducted or commissioned, and what vendor dependency and concentration risks exist; (2) Third-party validation procurement: UCBs that cannot validate AI models in-house must procure external validation for their highest-risk AI systems — typically credit scoring and fraud detection. The MRMF's independent validation requirement can be satisfied through third-party audit; NABARD and NAFCUB are expected to issue guidance on pooled third-party validation services for smaller UCBs; (3) CBS vendor AI disclosure: UCBs should formally request from their CBS vendors a disclosure of all AI/ML features in use, the training data sources, validation status, and whether the AI features comply with RBI's MRMF. A CBS vendor that cannot provide this disclosure cannot satisfy the UCB's MRMF model inventory obligation for vendor-embedded AI; (4) DPDP Act intersection: UCBs processing member personal data through AI systems (credit scoring using transaction history, KYC using identity data, fraud detection using behavioral biometrics) must have DPDP Act-compliant consent architecture for AI processing of member personal data — the same requirement that applies to commercial banks, but typically absent in UCB consent forms designed before DPDP Act 2023 was enacted.

AI Governance · RBI · Urban Cooperative Banks · UCB · MRMF · Model Risk · India BFSI

RBI Urban Co-operative Banks Governance Directions 2025 and MRMF 2026 AI Model Risk: Board AI Accountability, MRMF Extension to Cooperative Banks and Third-Party AI Vendor Concentration Risk for 1,500 UCBs India

RBI Urban Co-operative Banks (Governance) Directions 2025 (effective November 28, 2025) combined with the explicit extension of RBI's Draft Model Risk Management Framework 2026 to Urban and Rural Co-operative Banks create a dual AI governance compliance burden for approximately 1,500 UCBs serving 8 crore depositors. Board-level AI oversight, third-party vendor AI model validation, concentration risk governance — all required. UCBs have no in-house AI teams and must comply through CBS vendor disclosure, third-party validation, and board-level reporting structures. RBI has cancelled 10+ UCB licences since 2020; AI governance opacity is the next governance failure mode. Zero global competitor coverage.

Zytra Research Team · November 2025 · 12 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's Urban Co-operative Banking sector — 1,500 banks, 8 crore depositors, predominantly serving Tier-2 and Tier-3 city members — is not typically associated with AI governance discussions. But UCBs are deploying AI: through their CBS vendors (Finacle, Flexcube, BankMate), through third-party credit scoring platforms, and through fintech partnerships for UPI fraud detection and digital lending. They are deploying AI without the governance infrastructure to manage it — and as of November 2025, RBI has formally required that infrastructure to exist.

The combination of the UCB Governance Directions 2025 (board accountability for material operational risks) and the MRMF 2026 extension to co-operative banks (AI/ML model risk management obligations) creates a compliance stack UCBs were not built to manage. The proportionality principle in the MRMF gives small UCBs some implementation flexibility — but it does not exempt them from the core obligations: model inventory, risk tiering, oversight, and validation.

The CBS Vendor Problem: AI You Use But Don't Govern

Most UCBs cannot tell you which features of their core banking software are AI-powered. Credit scoring modules, fraud detection rules, KYC analytics — whether these are rule-based or ML-driven is typically undisclosed in standard CBS vendor contracts. The MRMF model inventory obligation requires UCBs to know. A UCB that asks its CBS vendor for an AI/ML feature disclosure and receives no clear answer has a MRMF compliance gap that the vendor created — but the UCB owns.

RBI UCB AI Governance Checklist

☐ CBS vendor AI disclosure: formal written request to CBS vendor for list of all AI/ML features in use, training data sources, validation status, MRMF compliance; vendor response documented
☐ AI/ML model inventory: all AI/ML models in use (including vendor-embedded) listed; risk-tiered (credit scoring and fraud detection typically Critical/High); validation status tracked
☐ Board AI reporting: semi-annual AI/ML systems report presented to board audit committee or risk committee; covers deployed systems, risk tiers, validation status, vendor concentration
☐ Proportionality documentation: UCB's proportionality position documented (size, complexity, risk profile); lighter-touch implementation justified and filed
☐ Third-party validation: highest-risk AI systems (credit scoring, fraud detection) third-party validated; validation commissioned from external auditor or NABARD/NAFCUB pooled service
☐ Vendor concentration risk: CBS vendor AI dependency assessed; concentration risk for multi-function vendor AI dependency documented; board notified
☐ DPDP Act AI consent: member data AI processing consent architecture reviewed; purpose limitation for credit AI vs analytics; consent forms updated for AI processing disclosure
☐ RBI examination readiness: model inventory, board AI reporting records, vendor AI disclosure, third-party validation evidence — packaged for RBI UCB inspection