RBI Wants Banks to Scale AI. But Does It Have a Risk Blind Spot?

The Reserve Bank of India (RBI) is pushing AI deeper into financial services, from fraud detection and borrower-risk monitoring to customer service and operational efficiency. But as banks move toward more autonomous AI systems, the central bank faces a harder regulatory problem—controlling a machine that doesn’t just make a recommendation, but can act on it.

In its September 2026 Bulletin, the RBI warned that while AI could fundamentally change financial services, “governance must precede scale.” 

"The banking ecosystem should, therefore, move towards the coordinated and responsible adoption of AI-enabled cybersecurity capabilities, including centralised threat intelligence and automated detection and response mechanisms," RBI Deputy Governor Rohit Jain said at the SBI Banking and Economic Conclave.

The central bank has already laid out the blueprint for responsible and ethical adoption of AI in its FREE-AI framework, recommending actions such as establishing AI innovation sandboxes and indigenous financial AI models to implementing robust governance, audit, and incident reporting mechanisms. 

However, the financial institutions are still catching up to risks posed by agentic AI. According to a recent survey by fintech cybersecurity firm BioCatch, 90% of Indian banking and financial crime leaders said fraud attempts at financial institutions have increased over the previous year.

“The challenge is no longer only whether AI can make the right recommendation; it is whether an autonomous system can be trusted with the authority to act. RBI will therefore increasingly need to regulate not just intelligence, but delegated machine authority,” Abhay Johorey, Managing Director of consulting firm Protiviti, tells AIM. 

From Detecting Fraud to Taking Action

The RBI is already encouraging financial institutions to use AI in areas where it can materially improve risk management.

Its MuleHunter.AI initiative uses AI and machine learning to identify mule accounts engaged in money laundering. The central bank is also developing a Digital Payments Intelligence Platform through the Reserve Bank Innovation Hub to strengthen fraud prevention across the payments ecosystem.

AI is also being pushed closer to the lending function. The RBI has called for greater use of AI and machine learning to identify early signs of borrower stress, alongside stress testing, early-warning systems, and dynamic provisioning.

But agentic AI could take this one step further.

“A model scores a loan and a person still has to act on it. An agent doesn't wait for that. It can approve, disburse, even flag something for recovery—all without a human anywhere in that chain,” comments Rohit Arora, CEO and Co-founder of SME-focused Biz2X and Biz2Credit. 

“That’s the part that needs tighter rules, fast.”

Risk-Based Autonomy

Traditional AI governance has largely focused on whether a model is accurate, explainable, unbiased, and appropriately monitored. Agentic systems introduce authority.

For instance, beyond recommending loan approval, agentic systems can also disburse it. Similarly, an agent can not just identify a suspicious transaction, but also freeze an account and trigger a recovery workflow.

Johorey argues that this requires a new governance architecture built around identity, authority, boundaries, observability, and accountability. “Every material AI agent operating within a regulated financial institution should have a verifiable digital identity and explicitly scoped permissions,” he says.

More importantly, he argues that authorisation should be enforced at the point of execution. An agent attempting to move money, change customer data, approve a transaction, or trigger another agent should only be able to act within predefined policy, value, and risk thresholds.

This points towards a risk-based approach to autonomy.

“Low-risk agents could operate relatively independently; higher-risk activities involving payments, credit, investments, customer money, or compliance decisions would require stronger human oversight,” Johorey states.

‘Kill Switch’ is Critical

For financial institutions, the biggest concern may not be whether an AI agent makes an isolated mistake, but whether it can be allowed to continue.

Arora argues that two controls should become central to agentic AI governance—risk-based tiering on what an agent is actually allowed to do, and a genuine kill switch.

“An agent that can move money deserves a much higher bar than one that just makes a recommendation,” he states. “And you need a real kill switch which has the ability to stop or reverse an action instantly, not review it next quarter, because when an agent gets it wrong, it gets it wrong fast and keeps going unless someone pulls the plug.”

Johorey similarly argues that autonomy must be treated as something that can be restricted or revoked. “Autonomy must be earned, bound, and revocable.”

The requirement becomes even more important when a bank’s infrastructure relies on common AI models, cloud infrastructure, and interconnected agents. A problem in one system could potentially trigger a chain of automated decisions across several systems before a human notices.

The Security Question

The security challenge is equally significant.

Chandra Prakash Suryawanshi, MD and India Global Cyber Risk Services Practice Leader, Alvarez & Marsal, notes that agentic AI expands the attack surface because these systems can autonomously plan tasks, select tools, and execute actions across multiple systems.

The risks include prompt injection, excessive privileges, identity sprawl, data poisoning, model manipulation, and weak auditability.

Prompt injection is particularly concerning when an agent consumes untrusted information. Malicious instructions hidden inside an email, document, website, or other data source could potentially alter an agent’s behaviour, particularly if that agent has access to sensitive systems.

The problem is compounded by the credentials agents require to operate.

“Agents rely on credentials, API keys, and tokens to function. If AI agents are over-permissioned or inadequately tracked, they can become prime targets for attackers seeking lateral movement or data access,” Suryawanshi says.

Data poisoning is another risk. Corrupted or manipulated information introduced during training, fine-tuning, or retrieval could influence an agent's decisions without immediately appearing as a conventional cyberattack.

Banks Cannot Outsource Accountability

The growing reliance on third-party foundation models, cloud platforms, and AI vendors creates another regulatory question of who is responsible when an externally supplied agent makes a mistake?

Arora argues that the answer cannot simply be the technology provider.

“One thing people keep missing is that accountability doesn't disappear just because a bank bought the agent instead of building it. Most of these will be vendor tools. You can't hand off the liability along with the software," he says. 

The governance challenge therefore extends beyond approving an AI system before deployment.

Suryawanshi recommends board-approved AI policies, a named owner for every agent, and an inventory documenting each agent’s purpose, data access, and permissions. Technical controls should include least-privilege access, human oversight, prompt-injection protections, input and output guardrails, encryption, masking, and tokenisation.

There also needs to be continuous monitoring.

Logging, incident response, regular testing, red teaming, and adversarial simulations would allow banks to identify how agents behave under hostile or unexpected conditions rather than relying solely on pre-deployment testing.

It’s All About Speed

The RBI’s position is not anti-AI. In fact, its September Bulletin describes AI as an “unspent force” for India and sees the technology as potentially important to productivity, financial inclusion, and the broader investment cycle.

The central bank is simultaneously building guardrails through the FREE-AI framework and its evolving model-risk approach.

But agentic AI changes the regulatory equation because the consequences of failure can move as fast as the technology itself.

The question for regulators and banks is whether an institution can control what happens when an AI system is given the authority to act—and whether it can stop that authority before a mistake turns into a financial incident.