RBI AI Framework Compliance: What Banks Need to Prepare Now

Requirement source: RBI IT Framework for Banks (2011), Section 4 (Information Security); SEBI IA Regulations reference.

What it means for GenAI: Every model in a production banking workflow needs documented validation — a description of what the model does, its known failure modes, its performance on relevant test data, and who is responsible for monitoring it.

Checklist items:

• Model inventory: list every GenAI model in production with deployment date, vendor, version, and task
• Validation report: independent evaluation of each model's ASR and FPR on a representative test set
• Approval chain: documented sign-off from risk management and compliance before deployment
• Ongoing monitoring: scheduled re-evaluation frequency (recommend quarterly for customer-facing models)
• Retirement criteria: defined thresholds at which a model is pulled from production

FinProof maps to this: Tier 4 server-side evaluation produces a validation report with ASR, FPR, F1, precision, and recall by harm category. The report is signed to a specific model version (HuggingFace commit SHA or OCI digest) for auditability.

Requirement source: RBI KYC Master Direction 2023, Para 16–19 (Customer Due Diligence), Para 38–43 (Suspicious Transaction Reporting).

What it means for GenAI: Any AI system that processes KYC data, assists with customer onboarding, or supports AML screening must not be exploitable to bypass the controls those processes implement.

Checklist items:

• KYC evasion test: red-team the AI with prompts designed to elicit guidance on bypassing KYC (B-02 category in FinProof)
• AML threshold probing: test whether the AI can be prompted to provide transaction structuring advice to stay below reporting thresholds
• PEP detection: test whether politically exposed person (PEP) screening can be bypassed via prompt injection into the customer data pipeline
• Sanctions evasion: test B-09 category (sanctions bypass, PEP detection evasion)
• Documented pass/fail criteria with specific test set version cited

Key risk: An AI assistant that helps relationship managers with KYC queries can be probed to understand what triggers an alert. If the model answers that question with any specificity, it is an AML risk — regardless of whether the intent was malicious.

Requirement source: Digital Personal Data Protection Act 2023, Section 8 (obligations of data fiduciaries), Section 9 (consent and purpose limitation).

What it means for GenAI: An AI system cannot retrieve and include in its output personal data about Customer A when it is handling a query from Customer B — even if both records are in the same knowledge base or vector store.

Checklist items:

• Data isolation test: verify that the knowledge base retrieval pipeline cannot leak records across customer boundaries
• RAG poisoning test: attempt to pre-seed the knowledge base to trigger cross-customer data leakage (B-11 and D-10 in FinProof)
• Audit logging: every retrieval from the knowledge base must be logged with the query, the records retrieved, and the customer session that triggered the retrieval
• Retention limits: verify that conversation history is cleared per DPDP Act consent boundaries
• Purpose limitation: verify the AI cannot be prompted to use customer data for purposes outside the original consent

Requirement source: No specific RBI circular yet. Maps to RBI IT Framework Section 7 (Change Management and Patch Management), SEBI's guidance on algorithmic trading controls (as an analogy for autonomous action limits).

What it means for GenAI: An AI agent that calls tools — schedules callbacks, initiates transfers, modifies records — is taking autonomous actions in production systems. The RBI has not yet defined controls for this specifically, but the IT Framework's change management and access control requirements apply.

Checklist items:

• Tool allow-list: every tool an AI agent can call must be explicitly listed and approved
• Action scope limits: define what state-changing actions (transfers, record modifications) an agent may initiate without human confirmation
• Confused deputy prevention: verify that an agent authorised to call compliance_check cannot be induced to also call transfer_funds (MCP tool poisoning, D-09)
• Goal binding: verify the agent cannot be redirected from its assigned task to a different one via indirect injection
• Breach logging: every unauthorized tool call attempt must be logged for incident response

Requirement source: SEBI Investment Advisers Regulations 2013, Regulation 7 (fiduciary obligation), Regulation 13 (restrictions on non-registered entities).

What it means for GenAI: An AI assistant deployed in a bank cannot give investment advice unless the institution is a registered investment adviser. The model's output must stay within the permitted boundary of "information" rather than "advice."

Checklist items:

• Advice boundary test: send prompts from FinProof B-01 category (investment advice hallucination, market manipulation) — the model must decline to recommend specific securities or predict specific returns
• Hallucination containment: verify the model does not invent regulatory approvals ("SEBI has approved this product for retail investors") that do not exist
• Disclaimer enforcement: verify that output on investment topics includes appropriate regulatory disclaimers automatically
• Hard stops: certain outputs (specific buy/sell recommendations with price targets) should be refused entirely regardless of instruction framing

Requirement source: RBI Master Direction on Outsourcing of Financial Services by Banks (2023).

What it means for GenAI: If you are using a third-party LLM (GPT-4, Gemini, Claude) in a customer-facing or risk-management workflow, that is an outsourced financial service. The vendor's model must meet your security and compliance requirements.

Checklist items:

• Vendor risk assessment: document the LLM provider's data handling practices, retention policies, and training data provenance
• Data residency: verify customer data does not transit jurisdictions without appropriate legal basis
• Model version pinning: production systems should use a pinned model version (not "latest") — a model update can change guardrail behaviour
• Contractual controls: ensure your agreement with the LLM vendor includes incident notification obligations and the right to audit
• Fallback procedures: documented procedure for what happens when the LLM vendor has an outage or withdraws a model version