Indian banks, NBFCs, and fintechs are already using AI for fraud detection, credit underwriting, customer service, and compliance monitoring, with RBI's FREE-AI framework now setting governance expectations around board approval, explainability, and vendor concentration risk. Compliant AI systems must satisfy the DPDP Act and existing RBI cybersecurity rules simultaneously, requiring consent-aware data pipelines, audit-ready logging, and built-in explainability from day one rather than retrofitted later. Prognos Labs builds AI systems for BFSI with DPDP and RBI-aligned compliance engineered into the architecture from the start, covering fraud detection, underwriting automation, and compliance workflows.
India's financial sector has moved past the pilot stage with AI, and regulators have noticed. Banks, NBFCs, insurers, and fintechs are integrating AI into customer service, fraud detection, underwriting, risk management, compliance monitoring, and credit analytics at a pace that has pulled the Reserve Bank of India directly into the conversation. For any Indian financial institution weighing an AI investment in 2026, the question is no longer whether to adopt it, it's how to do so in a way that survives regulatory scrutiny and actually holds up in production.
This is a practical breakdown of where AI is already working in Indian banking and finance, what the RBI's new framework actually requires, and what a compliant implementation looks like in practice.
Where AI Is Already Working in Indian Banking and Finance
AI in BFSI is not a future-tense conversation in India. An RBI survey of banks, NBFCs, fintechs, and technology companies found that around 21% of surveyed entities were already using or developing AI systems, driven mainly by large public and private sector banks and NBFCs deploying models across customer support, sales, credit underwriting, and cybersecurity. The RBI's own FREE-AI Committee estimated that AI could improve banking efficiency by up to 46%, and projected India's generative AI market specifically to exceed $12 billion by 2033.
Fraud Detection and Transaction Monitoring: AI is already deeply embedded in India's digital payments infrastructure, including UPI fraud detection, where models flag anomalous transaction patterns in real time rather than relying on static rule sets that fraudsters learn to route around.
Credit Underwriting and Risk Scoring: Machine learning models analyze a wider set of signals than traditional credit scoring, transaction history, repayment behavior, alternative data, to underwrite borrowers who wouldn't clear a conventional credit check, while flagging the ones a static model would have missed.
See How Creditcure Cut CAC by 32% with AI
A real case study on how Prognos Labs helped a fintech company reduce acquisition costs through custom AI models.
Read the Case StudyCustomer Service and Conversational Banking: AI-powered chatbots and virtual assistants now handle a meaningful share of routine banking interactions, account queries, complaint resolution, card-related requests, freeing human agents for the cases that actually need judgment.
Compliance Monitoring and Regulatory Reporting: AI systems scan transactions and communications for compliance violations, flagging exceptions for human review instead of requiring compliance teams to manually sample a fraction of total activity.
Algorithmic Trading and Portfolio Management: In capital markets, AI-driven models process market signals at a speed and scale no human trading desk can match, though this is also the category regulators are watching most closely for systemic risk.
The RBI's FREE-AI Framework: What It Actually Requires
On August 13, 2025, the RBI released the report of its FREE-AI Committee, "Framework for Responsible and Ethical Enablement of Artificial Intelligence," chaired by Dr. Pushpak Bhattacharyya of IIT Bombay. The committee was constituted in December 2024 to assess AI adoption across financial services, review global regulatory approaches, identify AI-specific risks, and recommend a governance framework tailored to India's financial sector. The RBI is currently assessing the report's recommendations, which are expected to shape more specific guidance for regulated entities going forward.
The report is built around seven guiding principles, called "Sutras," and 26 recommendations across six strategic pillars. It applies to all RBI-regulated entities, including scheduled commercial banks, cooperative banks, NBFCs, payment system operators, and fintechs. The most consequential obligations for regulated entities include:
Board-Approved AI Policy and Governance: Regulated entities are expected to establish a board-approved AI policy and implement structured governance across the entire AI lifecycle, covering model approval, testing, deployment, and change control, with independent validation and periodic review.
A Public Fund to Level the Playing Field: The committee proposed a $575 million public fund to support shared AI infrastructure, datasets, computing resources, and a regulatory sandbox, specifically so smaller lenders aren't left behind as larger institutions scale their AI capabilities faster.
Explicit Risk Flags Around Vendor Concentration: The framework directly names concentration risk, the systemic exposure created when large numbers of fintechs and smaller lenders all depend on the same handful of third-party AI vendors or model providers, as a risk regulators are now watching.
Bias, Opacity, and Explainability Requirements: Given that credit and underwriting decisions directly affect financial inclusion, the framework pushes for AI models that can be explained and audited, not just models that perform well on aggregate accuracy metrics.
For context, globally, financial services firms spent an estimated $35 billion on AI in 2023, with projected investment across banking, insurance, capital markets, and payments expected to reach $97 billion by 2027, according to World Economic Forum figures cited in the FREE-AI report. India's regulatory approach is deliberately trying to keep pace with that spending curve rather than letting adoption outrun oversight.
What This Means for Compliance Architecture
For an Indian bank, NBFC, or fintech building or buying AI systems in 2026, the FREE-AI framework sits alongside two other compliance obligations that any AI implementation now has to satisfy simultaneously:
The Digital Personal Data Protection Act, 2023 (DPDP Act). Together with the DPDP Rules notified in November 2025, this requires explicit, informed consent for collecting and using personal financial data, with blanket or implied consent no longer valid. Customers gain enforceable rights to access, correct, and erase their data, and only data necessary for a stated purpose can be processed.
Existing RBI Cybersecurity and Data Localization Guidelines. AI systems processing financial data still need to meet RBI's existing technology risk and data storage requirements, which predate FREE-AI but remain fully in force alongside it.
In practice, this means an AI system built for an Indian financial institution in 2026 needs, at minimum:
Consent-aware data pipelines, so a model only trains on and processes data it has a valid, current legal basis to touch.
Audit-ready logging, so every credit decision, fraud flag, or automated action has a defensible trail a regulator, auditor, or the RBI itself can review.
Explainability built into model design, not added afterward, so a rejected loan applicant or flagged transaction can be given an actual reason, not a black-box score.
Vendor and model-provider diversification, or at minimum, a documented awareness of concentration risk, in direct response to what the FREE-AI framework flags as a systemic concern.
Board-level governance and sign-off, with a named accountable owner for the AI system's performance and compliance, not a system that quietly runs without institutional oversight.
Common Mistakes Indian Financial Institutions Make
Treating compliance as a post-launch retrofit. The single most common and most expensive mistake is building a working model first and asking "is this DPDP and RBI compliant?" only once it's ready to deploy. Retrofitting consent management, audit logging, and explainability into an already-built system is significantly more expensive than architecting for it from day one.
Over-relying on a single AI vendor: Given that the RBI has explicitly named vendor concentration as a systemic risk, an institution that builds its entire AI stack around one third-party model provider is building in exactly the kind of fragility regulators are now watching for.
Choosing a generalist IT vendor over a firm with financial-sector depth: A team that understands general software engineering but not the specific compliance shape of BFSI data, credit decisioning logic, or RBI reporting requirements will consistently underestimate what a "production-ready" system actually needs to include.
Treating explainability as a nice-to-have: With the FREE-AI framework's explicit focus on bias and opacity, a credit or fraud model that can't explain its own decisions is a compliance liability waiting to surface, not just a technical limitation.
How to Choose an AI Implementation Partner for BFSI
Given the compliance stakes, an Indian bank, NBFC, or fintech evaluating an AI development partner should look for four things specifically:
Regulatory fluency, demonstrated, not claimed: Ask a prospective partner to walk through how their architecture handles DPDP consent management and RBI-aligned audit logging concretely, not just whether they're "aware of" the requirements.
End-to-end ownership: A partner that builds the model but hands off deployment and monitoring to a separate team introduces exactly the kind of accountability gap the FREE-AI framework's governance requirements are designed to close.
Domain-specific engineering, not generic ML wrapped in a finance use case: Fraud detection, credit underwriting, and compliance monitoring each have distinct data patterns and failure modes; a partner without direct BFSI experience will build something that performs well in testing and poorly against real transaction volume.
Active post-launch monitoring: Financial data drifts, fraud patterns evolve, and a model that was accurate at launch can degrade within months without active retraining and drift detection built into the engagement.
Prognos Labs builds AI and machine learning systems specifically for regulated sectors including fintech and BFSI, with DPDP Act and RBI-aligned compliance engineered into the architecture from day one rather than retrofitted after a compliance review. Our engagements span fraud detection, underwriting automation, and agentic claims and compliance workflows, with a single accountable team managing strategy, build, deployment, and ongoing MLOps.