RBI Unleashes Model Risk Management Guidance: Banks and NBFCs Must Brace for AI Oversight Revolution

RBI Unleashes Model Risk Management Guidance: Banks and NBFCs Must Brace for AI Oversight Revolution​

The Reserve Bank of India (RBI) has released a comprehensive draft 'Guidance on Regulatory Principles for Model Risk Management.' This proactive measure signals a significant focus on strengthening governance frameworks across the financial sector. The guidance aims to establish broad regulatory expectations covering the entire lifecycle of models used by regulated entities, including those incorporating Artificial Intelligence (AI) and Machine Learning (ML).

Mandate Expands: Who Must Comply with RBI's New Model Risk Guidance?​

The scope of the draft is intentionally broad, ensuring comprehensive coverage across nearly all financial institutions. The guidance is applicable to a diverse set of regulated entities. This includes Commercial Banks, Small Finance Banks, and Payments Banks. It also covers specialized institutions such as Non-Banking Financial Companies (NBFCs) and Asset Reconstruction Companies (ARCs).

Furthermore, the RBI has extended this mandate to smaller financial players. Local Area Banks, Regional Rural Banks, Urban Co-operative Banks, and Rural Co-operative Banks are all required to adhere to these principles. Credit Information Companies have also been included in the scope of the draft.

Navigating Risks: Why Regulated Entities Need Model Risk Frameworks​

The issuance of this guidance follows a sustained focus by the Reserve Bank on deepening risk management practices. Prior work, including a draft from August 05, 2024, and review of the Committee's report on AI enablement (August 13, 2025), paved the way for this holistic requirement.

The necessity for the guidance arises from the expanded use of models across various business and decision-making processes. Regulated entities are increasingly leveraging models that incorporate AI and ML. If governance, risk management, and controls are weak, these advanced models could expose institutions to significant financial, operational, compliance, and reputational risks.

Stakeholder Input Invited on Model Risk Principles​

The RBI has actively sought feedback from the industry and public on this critical mandate. Comments and suggestions on the draft Guidance are currently invited from all regulated entities, market stakeholders, and interested members of the public.

Entities wishing to submit their feedback must adhere to a strict timeline. The deadline for comments is set for July 24, 2026. Submissions can be made via the dedicated link on RBI's website or formally submitted to the Chief General Manager, Operational Risk Group at the Department of Regulation, Central Office, Mumbai.