RBI Governor Tells Banks to Build AI Governance Now, Not After Deployment

Reserve Bank of India Governor Sanjay Malhotra told banking and technology leaders on Tuesday that artificial intelligence will reshape Indian banking as fundamentally as liberalization did in the 1990s and digitalization did in the 2010s, and urged institutions to adopt the technology with deliberate governance rather than let it evolve without oversight.

Delivering the inaugural address at the FIBAC 2026 conference in Mumbai, Malhotra said AI is not a technology to be procured or a project to be completed, but a shift in how banks evaluate risk, serve customers, price capital and organize themselves. "The only question is whether you shape the AI journey with intent, or you let it shape you by default," he said.

Five reasons banks can't sit on the sidelines

Malhotra laid out five arguments for why Indian banks need to actively pursue AI adoption. He said AI can extend credit to borrowers who lack formal financial histories, such as gig workers and small enterprises, by drawing on alternative data including cash flows, GST filings and utility payments, at a fraction of the cost of manual underwriting.

He also pointed to earlier detection of financial stress through AI-enhanced risk models, better customer service when AI augments rather than replaces human judgment, and gains in operational efficiency across document processing, reconciliation and regulatory reporting. On fraud, Malhotra said only machine-learning systems that continuously adapt can keep pace with fraud that "moves at the speed of an API call," arguing that static, rules-based fraud engines are structurally unable to keep up.

AI's inclusion potential was central to his remarks. Voice interfaces in Indian languages and predictive models that flag borrowers at risk of default early, he said, could make AI one of the most powerful accelerants to financial inclusion India has seen.

 

Seven risks the RBI says banks must not ignore

Malhotra devoted equal weight to risk, listing seven concerns he said banks need to treat as design requirements rather than compliance afterthoughts. He named the "black box" problem of unexplainable model decisions, algorithmic bias against certain geographies or communities, and systemic concentration risk if a small number of foundation models or vendors come to underpin credit and trading decisions across much of the banking system.

He also flagged third-party vendor dependence, warning that outsourcing agreements need AI-specific accountability, including audit rights and exit plans, since most Indian banks will consume AI capability from external providers rather than build it in-house. Data privacy under the Digital Personal Data Protection Act, adversarial vulnerabilities such as data poisoning, and erosion of human accountability rounded out his list. "The model decided" can never be an acceptable answer to a customer, auditor or regulator, Malhotra said.

 

RBI expects inventories and board sign-off, not distant compliance

Malhotra said the central bank's approach, shaped by its FREE-AI Committee recommendations and draft Model Risk Management guidelines, favors a principles-based, proportionate framework over rigid rules, since AI risk looks different for a large bank running proprietary models than for a small bank using off-the-shelf vendor tools.

He nonetheless set out expectations he said banks should treat as immediate priorities: maintaining a complete inventory of every AI system in use, including those embedded in vendor products; establishing board-approved governance policies with clear accountability for outcomes; building the capacity to explain AI-driven decisions that materially affect customers; red-teaming and stress-testing AI systems before and after deployment; and preserving meaningful human oversight wherever an AI error could cause material harm.

Malhotra said the RBI would continue to make its regulatory sandbox available for testing AI use cases and would keep building shared fraud-detection utilities such as MuleHunter and the proposed Digital Payments Intelligence Platform.

 

Progress since last year's conference

Malhotra also reviewed regulatory changes since FIBAC 2025, when he outlined three priorities: strengthening financial stability, easing the burden of doing business, and expanding credit while lowering intermediation costs. He cited the finalized standardized approach for credit risk capital, progress toward Basel III implementation by April 2027, and continued work on public digital credit rails including the Account Aggregator ecosystem and Unified Lending Interface.

The banks that succeed, Malhotra said, will not necessarily be those that adopt AI fastest or most extensively, but those with the deepest understanding of what they deploy, the clearest accountability for outcomes, and the strongest commitment to preserving customer trust.