RBI's Model Risk Management Draft: What Every Banker Needs to Know (Comment by Jul 24)

What changed

On June 24, 2026, RBI released 'Draft Guidance on Regulatory Principles for Model Risk Management.' This is the first comprehensive, entity-wide framework for managing model risk — covering the entire model lifecycle, including third-party models and AI/ML systems. It builds on the Aug 2024 credit-model draft and the FREE-AI committee report (Aug 2025).

Who it applies to

• Commercial Banks (all scheduled and non-scheduled)
• Small Finance Banks
• Payments Banks
• Local Area Banks
• Regional Rural Banks
• Urban Co-operative Banks
• Rural Co-operative Banks
• All India Financial Institutions (NABARD, NHB, SIDBI, EXIM Bank)
• Non-Banking Financial Companies (NBFCs)
• Asset Reconstruction Companies (ARCs)
• Credit Information Companies (CICs)

Key points

What is Model Risk?

A 'model' in RBI's framework is any quantitative tool used to estimate outcomes or make decisions — from credit scorecards and pricing engines to fraud-detection algorithms and AI/ML-powered underwriting systems. 'Model risk' is the risk of adverse outcomes when these tools are incorrect, misused, or poorly governed. RBI now requires regulated entities to treat this as a formal, board-owned risk category.

Full Lifecycle Coverage — Including AI/ML

The draft covers every stage: model development, validation, approval, deployment, monitoring, and retirement. Critically, AI/ML models — including those from third-party vendors — are explicitly in scope. This means your bank's credit bureau score, NPA prediction model, or KYC verification tool must all be managed under this framework.

Governance Requirements

RBI expects entities to establish a Model Risk Management Policy (approved at Board level), designate clear ownership for every model, maintain a model inventory, and set up independent model validation. Senior management must have visibility into model performance and model-driven decisions.

Third-Party and Vendor Models

Buying a model from a vendor does not transfer the risk. The draft is explicit: regulated entities remain responsible for the model risk of third-party models they use. Due diligence, ongoing monitoring, and validation apply equally to vendor-supplied AI tools.

Why This Matters for Exam Aspirants

Model Risk Management is now a Board-level regulatory expectation, not just an internal audit item. Expect questions in JAIIB, CAIIB, and bank officer promotion exams on MRM frameworks, model lifecycle, AI/ML governance, and the role of independent validation. The RBI FREE-AI committee's August 2025 recommendations feed directly into this guidance.

Context: The Regulatory Journey

RBI first flagged model risk in credit specifically (Aug 2024 draft). The FREE-AI committee (Aug 2025) expanded the lens to AI governance broadly. Today's draft takes the final step: a single, entity-wide MRM framework covering all models across all business functions — credit, treasury, operations, fraud, and beyond.

What you should do

Risk & Compliance Officers

• Read the full draft guidance at rbi.org.in and map your institution's existing model inventory against the proposed requirements.
• Identify gaps in model validation independence and board-level oversight.
• Consider submitting comments by Jul 24 via Connect2Regulate or by email to [email protected].

Exam Aspirants

• Understand the difference between model risk and operational risk — RBI now treats MRM as a distinct governance pillar.
• Know the model lifecycle stages: development → validation → approval → deployment → monitoring → retirement.
• The FREE-AI committee (2025) is the predecessor document — study both together.