Small Finance Bank AI Governance India — RBI MRMF 2026 Obligations for SFBs

What Are Small Finance Banks

Small finance banks are a differentiated banking category licensed by the Reserve Bank of India under the Small Finance Bank guidelines of 2014–2016. RBI created the SFB category for a specific purpose: to extend basic banking and financial services to underserved segments that commercial banks historically failed to reach — migrants, small traders, farmers, women Self-Help Group (SHG) members, and micro and small enterprises.

Twelve SFBs hold RBI licences as of October 2026:

The majority of SFBs originated as microfinance institutions (MFIs) or NBFCs focused on lending to financially excluded populations. Their customer base differs fundamentally from commercial banks: thin-file borrowers with no formal credit bureau history, rural customers transacting in regional languages, women JLG members assessed on group repayment behavior rather than individual credit history, and micro-entrepreneurs whose income is informal and cash-based.

Why SFBs Face Distinct AI Governance Challenges

SFBs operate at the intersection of obligations that commercial banks do not face simultaneously:

• Financial inclusion mandate: SFB licences require maintaining a minimum 75% of their adjusted net bank credit in loans of up to ₹25 lakh, with significant lending to priority sectors including agriculture, micro-enterprises, and economically weaker sections.
• Commercial banking obligations: SFBs are licensed commercial banks, not NBFCs. The same MRMF, Cybersecurity Framework, KYC/AML, and capital adequacy requirements that apply to scheduled commercial banks apply to SFBs.
• MFI legacy systems: Most SFBs originated as MFIs and carry legacy models — JLG scoring models, SHG repayment pattern analysis, group dynamics assessment — built for the MFI context, not for banking-grade model risk governance.
• High-growth digital transformation: Many SFBs are aggressively deploying AI for scale — digital onboarding, automated credit scoring, cross-sell targeting — to achieve operational efficiency without proportionally growing headcount.

The result is a governance gap: AI models trained on SFB customer data carry unique bias risks — toward rural women, SC/ST communities, migrants, tribal populations — that commercial bank AI governance frameworks were not designed to address. MRMF applies the same obligations regardless of customer profile.

MRMF Applies to All 12 SFBs — No Proportionality Exemption

The Model Risk Management Framework issued by RBI in June 2026 covers "scheduled commercial banks, small finance banks, payments banks, non-banking financial companies, and other RBI-regulated entities." SFBs are explicitly named — unlike urban cooperative banks, which fall under the residual "other RBI-regulated entities" category, SFBs have a direct enumeration in the MRMF scope clause.

The current draft MRMF does not include a proportionality carve-out for SFBs by size or asset class. A large SFB like AU Small Finance Bank (assets exceeding ₹1 lakh crore) and a smaller SFB like Shivalik Small Finance Bank (assets below ₹5,000 crore) face the same written MRMF obligations. Industry representations to RBI have raised concerns about implementation feasibility for smaller SFBs, and a tiered approach may appear in the final circular — but compliance planning must proceed against the current draft requirement of full implementation for all 12.

Core MRMF obligations for all SFBs:

• Board-approved MRMF policy: A formal model risk management policy approved at Board level, covering model definition, risk appetite, governance structure, and escalation protocols.
• Comprehensive model inventory: A register of all AI/ML models in production, covering model purpose, owner, data inputs, decision outputs, and risk tier classification.
• Independent model validation: For High and Critical risk models, validation by a team or function independent of the model development team.
• Ongoing monitoring: Regular performance monitoring — model stability, accuracy degradation, population shift — with defined thresholds for remediation or decommissioning.
• Kill switch documentation: Procedures for taking a model out of production in an emergency, with documented fallback decision processes.

Five AI Use Cases at SFBs Requiring Governance

1. JLG and SHG Credit Scoring

Joint Liability Group (JLG) lending is the foundation of most SFBs' microfinance portfolios. In a JLG structure, 4–10 borrowers form a group and guarantee each other's loans — individual repayment history is intertwined with group dynamics. Self-Help Group (SHG) lending involves women's groups of 10–20 members who collectively save, borrow, and guarantee each other.

AI models for JLG and SHG credit scoring are among the highest-risk models in the SFB ecosystem. Members typically have no individual credit bureau history — the models must infer creditworthiness from group repayment patterns, meeting attendance records, savings behavior, and loan officer qualitative assessments. These inputs are inherently soft, subject to officer bias in data entry, and difficult to validate against external benchmarks.

MRMF obligations for JLG/SHG scoring models:

• Full model documentation including feature definitions, training data lineage, and validation methodology
• Classification as High or Critical risk — these models determine credit access for financially vulnerable populations
• INDIC-BIAS testing: women SHG members, SC/ST JLG groups, and tribal area borrowers must be tested as protected segments
• Ongoing monitoring of approval rate differentials across demographic segments

2. Microfinance Repayment Propensity AI

RBI's microfinance regulations (2022 Master Direction) require MFI-origin lenders to conduct household income assessments and over-indebtedness checks before extending credit. The over-indebtedness problem in Indian microfinance — where a borrower carries loans from multiple lenders simultaneously — contributed to the 2010 Andhra Pradesh MFI crisis and remains a systemic risk.

SFBs increasingly use AI models to estimate borrower over-indebtedness risk — scoring which borrowers are approaching debt-service-to-income thresholds across multiple lenders. These models use bureau data (CRIF, Equifax), account aggregator feeds, and proprietary repayment history. AI-driven over-indebtedness checks must be validated against the regulatory definition of over-indebtedness, not just predictive accuracy metrics. A model that is accurate in aggregate but systematically wrong for borrowers with non-bureau lenders (moneylenders, SHG loans, Kisan Credit Cards) fails the regulatory purpose.

3. Digital Onboarding AI — Rural and Low-Connectivity Context

SFBs are among the most active deployers of video KYC (V-CIP) and AI-assisted document verification for customer onboarding — both for efficiency at scale and to reach rural customers who cannot visit branches. The technology works well in urban, high-connectivity environments. The SFB rural context creates specific failure modes:

• Low-quality video in low-connectivity environments: V-CIP AI trained predominantly on urban, high-bandwidth connections may reject rural customers due to image quality rather than identity issues.
• Regional language documents: Voter ID, ration cards, and state government documents in regional scripts (Tamil, Telugu, Kannada, Bengali, Odia, Malayalam, Marathi) have higher OCR error rates than Devanagari or Roman script documents. Errors propagate into KYC records and downstream model inputs.
• Name recognition for non-Roman script transliterations: Indian names transliterated differently across documents (e.g., "Krishnamurthy" vs "Krishnamorthy") cause bureau matching failures that disproportionately affect certain linguistic communities.
• Facial recognition accuracy for diverse demographics: Facial recognition models validated on pan-Indian datasets may underperform for specific tribal or regional demographics with lower representation in training data.

MRMF requires SFBs to test digital onboarding AI against rejection rates by geography, document language, and demographic segment — and to document the validation results and any remediation actions.

4. Small Business and MSME Credit AI

SFBs are among India's largest MSME lenders by volume — the segment where AU Small Finance Bank, Equitas, and Ujjivan have significantly scaled their lending books. AI scoring for ₹1 lakh–₹50 lakh business loans uses GST filing data, current account transaction patterns, Account Aggregator-sourced financial statements, and credit bureau data.

MSME credit AI at SFBs faces the same governance obligations as at commercial banks, with an additional dimension: many SFB MSME customers are at the micro end — ₹1–₹10 lakh ticket size — with informal business records. The gap between what the AI model expects (GST returns, bank statements, audited financials) and what a micro-enterprise can provide creates a selection bias in the training data that systematically undervalues viable micro-businesses.

5. Customer Cross-Sell AI

SFBs cross-sell savings accounts, fixed deposits, insurance products, gold loans, and remittance services to their existing microfinance borrower base. AI-driven cross-sell targeting — identifying which borrowers to approach with which product — is operationally efficient but carries regulatory risk specific to the SFB customer base.

RBI's Fair Practices Code requires all regulated entities to avoid aggressive or coercive lending and selling practices. The intersection of AI-driven targeting and financially vulnerable customers creates heightened risk: a cross-sell AI optimized for conversion rates may systematically target borrowers who are already over-leveraged, or push credit products to customers during financial stress events (natural disasters, crop failures) when acceptance rates are high but suitability is low.

SFBs must include cross-sell AI in their MRMF model inventory and conduct fairness testing to ensure the targeting algorithm does not disproportionately exploit financially vulnerable segments.

INDIC-BIAS Obligations Specific to the SFB Customer Base

RBI's FREE-AI (Fairness, Reliability, Explainability, and Ethics for AI) principles, issued September 2024, require all RBI-regulated entities to test AI models for discriminatory outcomes against protected demographic categories. The INDIC-BIAS framework operationalizes FREE-AI fairness obligations for the Indian demographic context.

SFBs face a critical insight here: their customer base overlaps precisely with the highest-risk INDIC-BIAS categories. The populations that SFBs exist to serve — rural women, SC/ST communities, migrants, tribal area residents — are the same populations most vulnerable to proxy discrimination in AI models. Five specific INDIC-BIAS risks are elevated for SFB AI:

Geographic Proxy Risk

SFB branch locations are, by regulatory design, concentrated in underserved geographies — semi-urban, rural, and unbanked districts. Geographic features in AI models — pincode, district, branch location — serve as strong proxies for demographic identity in this context. A credit model that uses branch location as a feature is, functionally, using demographic composition of the catchment area as a feature. MRMF requires SFBs to test whether geographic features in their models serve as discriminatory proxies.

Language Bias and Transliteration Errors

SFB loan officers enter data in regional languages or transliterate local names into the CBS in non-standardized ways. Names like "Venkataramaiah," "Radhakrishnan," or "Pushpavalli" may appear in multiple transliterations across bureau, Aadhaar, and CBS records. Transliteration mismatches cause bureau matching failures that systematically reduce the apparent creditworthiness of customers from certain linguistic communities. AI models trained on data with systematic transliteration errors inherit and amplify this discrimination.

Thin-File Penalization

SFBs were created specifically to serve thin-file customers — people who have no formal credit bureau history because they have been excluded from the formal financial system. AI credit models trained on bureau-heavy datasets will systematically penalize thin-file applicants, who are disproportionately from SC/ST, rural, and migrant communities. A model that penalizes thin files defeats the core financial inclusion mandate of the SFB licence. MRMF validation for SFB credit models must include explicit assessment of model performance for thin-file applicants as a protected category.

Seasonal Income Patterns

Farmers, agricultural laborers, and seasonal traders — core SFB customer segments — have income patterns that are seasonal and irregular. Cash-flow-based AI scoring models trained on salaried-income data will misclassify creditworthy agricultural customers as high-risk based on cash flow seasonality. Model validation must test performance across seasonal income profiles.

Gender and Group Lending Dynamics

Women JLG and SHG members frequently have no individual credit history — their credit record is the group's record. AI models that cannot handle group lending structures or that interpret group membership as a negative signal (because groups are associated with microfinance, which the model may associate with higher-risk segments) will produce biased outcomes specifically for women borrowers. INDIC-BIAS testing for SFB models must treat women JLG members as a distinct testing population.

DAKSH Supervisory Reporting for SFBs

RBI's DAKSH supervisory technology portal — launched in 2022 — is the primary channel through which RBI-regulated entities submit compliance data and through which RBI examination teams conduct off-site supervision. SFBs are directly supervised by RBI's Department of Regulation and examined by RBI's Department of Supervision. They are not examined by NABARD or state-level regulators.

DAKSH's Supervisory Data Quality Index (SDQI) measures the accuracy and timeliness of data submissions. Persistent SDQI deficiencies attract supervisory escalation — reduced ratings, increased examination frequency, and in severe cases, restrictions on business activities. As RBI expands DAKSH data requirements to include AI governance indicators (model inventory status, validation currency, monitoring performance), SFBs must ensure their AI governance documentation is maintained in DAKSH-compatible formats.

SFBs should anticipate that RBI DAKSH AI governance data fields — model count by risk tier, validation completion dates, monitoring exception counts — will be added to the supervisory reporting schedule in 2027 alongside the MRMF final circular implementation timeline.

Practical 5-Step MRMF Implementation for SFBs

SFBs face a specific implementation challenge: most were not built with model risk governance infrastructure. Unlike large commercial banks that have had internal audit functions reviewing models for a decade, most SFBs are implementing formal MRM governance for the first time. The following five-step sequence is adapted to the SFB context.

Step 1 — Build the Model Inventory

Start with a cross-functional model discovery exercise. The goal is to identify every AI/ML system currently in production — including AI embedded in vendor systems, bureau-provided scorecards, and fintech partner algorithms. Most SFBs will discover 15–30 models upon a thorough inventory. Categories to search: JLG/SHG credit scoring, MSME credit scoring, over-indebtedness check models, video KYC AI, document verification AI, fraud detection, cross-sell targeting, and collection prioritization.

Document for each model: model name and purpose, model owner (team responsible), data inputs, decision outputs (what credit or service decision it affects), vendor or in-house origin, and current monitoring status. The inventory is the foundation for all subsequent MRMF work — it cannot be skipped.

Step 2 — Risk Tier Classification

Classify each inventoried model using MRMF's risk tier framework. For SFBs, the classification guidance is:

• Critical: Models that make autonomous credit decisions without human override for large portions of the portfolio, or models where an error would affect a significant proportion of the SFB's borrower base simultaneously (e.g., a JLG scoring model used across all branches).
• High: JLG and SHG credit models, MSME credit scoring models, over-indebtedness check models, video KYC rejection models, and collection AI that drives field officer prioritization.
• Medium: Cross-sell targeting AI, deposit product recommendation AI, internal analytics models used for business decisions.
• Low: Internal operational models — HR scheduling, inventory management — not affecting customer credit or service decisions.

Step 3 — Independent Validation for High and Critical Models

MRMF requires independent validation — the validation team must be independent of the model development team. For SFBs, this creates a practical challenge: smaller SFBs rarely have separate model development and model risk teams. Options:

• Internal function separation: Large SFBs (AU, Equitas, Ujjivan) can create an internal MRM function that reports to the Chief Risk Officer independently of the analytics or data science function that builds models.
• Third-party validation: Smaller SFBs (Shivalik, North East Small Finance, Capital Small Finance) should engage third-party model validation firms — specialist MRM consultancies or Big-4 risk advisory teams — to validate High and Critical models. This is a legitimate and MRMF-compliant approach.
• Peer validation: Two SFBs of similar scale could potentially engage each other's risk teams for cross-validation — an arrangement that would satisfy independence requirements if organizational boundaries are maintained. This approach has not been formally sanctioned by RBI but is consistent with the independence principle.

Step 4 — INDIC-BIAS Quarterly Testing

Implement a quarterly INDIC-BIAS testing cycle for all High and Critical models. Priority test populations for SFBs: rural women borrowers, JLG members from SC/ST communities, North East and tribal area customers, and thin-file applicants. For each test cycle, document the test population definition, the fairness metric used (approval rate parity, equalized odds, or calibration by group), the test results, and any remediation actions taken.

INDIC-BIAS testing is not a one-time validation activity — it must be repeated quarterly to detect model drift that introduces bias over time, and whenever the model is retrained or updated.

Step 5 — Kill Switch Documentation

For every High and Critical model, document the emergency decommissioning procedure: who can authorize taking the model out of production, what the fallback decision process is, and how the transition to manual processing is managed. For JLG credit models, this is particularly important: an algorithm error that incorrectly flags a large number of JLG groups as over-indebted could trigger false collection actions across a significant portion of the SFB's portfolio. The kill switch procedure must be tested, not merely documented.

The SFB-Specific Gap in RBI MRMF

The current MRMF draft does not contain a proportionality provision for small finance banks. Large bank MRM governance costs — dedicated MRM teams, independent validation functions, external validation engagements — are a manageable operational expense for AU Small Finance Bank or Equitas SFB. They represent a meaningful proportional burden for smaller SFBs like Shivalik Small Finance Bank or North East Small Finance Bank, which operate with total assets well below ₹10,000 crore and limited governance infrastructure budgets.

The industry expectation — articulated through SLBC representations and SFB industry associations — is that RBI's final MRMF circular will introduce a tiered approach for SFBs based on asset size and AI deployment complexity, similar to the proportionality framework applied to urban cooperative banks. However, planning on the basis of an expected exemption that has not yet been issued is a compliance risk. SFBs should implement MRMF against the current draft while tracking RBI's consultation process for the final circular.

The 12 SFBs sit at the most consequential intersection in India's financial inclusion story: they are the institutions most likely to reach the country's financially excluded populations, and simultaneously the institutions most likely to deploy AI that inadvertently excludes or harms those same populations. MRMF compliance is not just a regulatory obligation for SFBs — it is the mechanism that ensures their AI actually serves their mission.

Frequently Asked Questions