AI in banking risk management and fraud detection: the rules in India

As of November 2026 India has no single binding RBI direction on artificial intelligence. Banks and NBFCs that use AI in risk management or fraud detection work under three things: the FREE-AI committee report of August 2025, RBI's draft guidance on model risk management of June 2026, and existing rules on data protection, outsourcing and technology that already apply to any system.

That is enough to say what a governed use of AI looks like. This guide sets out each piece and its status.

Status at a glance

The FREE-AI report and its seven sutras

RBI set up a committee in December 2024 to develop a Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the financial sector. Its report was published on 13 August 2025. It contains seven "sutras" as guiding principles and 26 recommendations under six pillars.

The seven sutras are:

1. Trust is the foundation
2. People first
3. Innovation over restraint
4. Fairness and equity
5. Accountability
6. Understandable by design
7. Safety, resilience and sustainability

The six pillars are Infrastructure, Policy and Capacity on the enablement side, and Governance, Protection and Assurance on the risk side. Among the recommendations, the report asks regulated entities to adopt a board-approved AI policy and calls for a risk-based AI audit framework that covers the life cycle of an AI system. It also recommends shared data infrastructure, an AI innovation sandbox and capacity building.

The report is a set of recommendations to RBI. It is not enforceable on its own. Supervisors can still be expected to ask how a bank's AI use compares with it, so a gap assessment is sensible.

Model risk management: from credit models to all models

RBI first addressed models in its 2002 guidance note on credit risk management. In August 2024 it published a draft circular on regulatory principles for managing model risks in credit, which asked for a board-approved policy and independent validation of credit models.

On 24 June 2026 RBI went wider with the draft Guidance on Regulatory Principles for Model Risk Management, 2026. Summaries of the draft describe these proposals:

• Scope. All models used by regulated entities, including AI and machine learning models and models bought from vendors. A spreadsheet tool that drives decisions can count as a model.
• Framework. A board-approved model risk management framework, with models tiered by risk. High-risk models need approval from the Risk Management Committee of the Board before use.
• Inventory. A maintained model inventory, including retired models.
• Validation. Independent validation of every model. A vendor's certificate is not a substitute.
• Explainability. Explainability thresholds for AI models. Where a model cannot fully explain its output, the entity compensates with stronger validation, output checks, closer monitoring and limits on use.
• Human oversight. Human-in-the-loop or on-the-loop arrangements, and override, suspension or deactivation mechanisms, including a kill switch.
• Fairness. Assessment of discriminatory outcomes, with recalibration where needed.
• Customer-facing AI. Disclosure that the customer is dealing with AI, and a route to a human.

Once finalised, the guidance is intended to replace the credit risk models chapter of the 2002 guidance note. Check the current text on rbi.org.in before treating any of these points as final.

Data protection and outsourcing rules that already apply

DPDP Act and Rules

Fraud analytics and risk models run on personal data. The Digital Personal Data Protection Act, 2023 is the governing law. The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and commence in phases: the provisions on the Data Protection Board first, consent manager registration after one year, and most operational obligations 18 months after notification, which falls in May 2027.

The Act allows processing for certain legitimate uses without consent, and several regulatory and fraud-related purposes are likely to rely on those provisions or on exemptions. That is a legal question to settle for each use case and to record, not something to assume.

Outsourcing and technology

RBI's Master Direction on Outsourcing of Information Technology Services, issued in April 2023 and effective from 1 October 2023, makes the regulated entity responsible for an outsourced IT service as if it performed the service itself. It asks for due diligence, a written agreement, audit rights and an exit plan. These requirements were carried into the 2025 consolidated directions on managing risks in outsourcing. A hosted AI model or an AI-based fraud scoring service from a vendor falls within this.

The directions on IT governance and cyber security apply to AI systems as they do to any other application: change management, access control, logging and business continuity.

AI fraud detection and transaction monitoring

RBI itself supports AI in financial fraud detection. The Reserve Bank Innovation Hub built MuleHunter.AI to help banks identify mule accounts, and the Digital Payments Intelligence Platform is being built with an AI-based risk-scoring phase. The authentication directions for digital payments, in force since 1 April 2026, allow issuers to use risk-based checks. The fraud risk management directions expect early warning signals and data analytics.

So the regulatory question is not whether to use fraud analytics. It is whether the bank can explain and control it. A model that blocks a payment or flags an account affects a customer directly. From 1 January 2027, the revised customer liability framework places the burden of proving customer negligence on the bank, which makes the record behind each model-driven decision more important.

What a governed AI use looks like

Putting the report, the draft and the existing rules together, a governed AI use case in banking risk management has these features:

• A named business owner and a documented purpose.
• An entry in the model inventory with a risk tier.
• Approval at the right level before deployment, recorded with date and approver.
• Independent validation, including performance on Indian data and on customer segments.
• An explanation method suited to the decision, and reason codes that an investigator can read.
• Human review for decisions that hurt a customer, such as an account restriction.
• Monitoring for drift, false positives and false negatives, with thresholds that trigger review.
• A way to switch the model off and fall back to rules.
• A data map showing what personal data is used and on what legal basis.
• A vendor contract with audit and documentation rights where the model is bought.

How RegIntel Nexus helps

RegIntel Nexus is not a fraud detection or transaction monitoring system and does not build risk models. It helps the teams that govern them stay current. The platform monitors publications from RBI, SEBI, FIU-IND, NPCI, IRDAI, CERT-In and MeitY, classifies them and tracks drafts through to final text and later amendments. Its AI research assistant is source-grounded: each answer cites the document, clause and page. Requirements become clause-level obligations with owners, due dates, status and escalation, mapped to the processes and applications they affect. Source versions, approvals and SHA-256 integrity records are kept as evidence.

This article is general information for compliance and risk professionals. It is not legal advice. Regulations are amended often; check the current text published by the regulator before acting.