As the Indian financial landscape accelerates into an artificial intelligence (AI) era, the Reserve Bank of India’s (RBI’s) deputy governor Rohit Jain on Thursday laid out 10 key requirements for banks to manage technology and cyber risks.
Speaking at the State Bank of India Banking & Economic Conclave in Mumbai, Jain called for stronger governance, greater visibility into technology infrastructure, tighter controls and regular testing of operational resilience as financial institutions increasingly adopt.
He also said that technology can no longer be treated merely as an enabler of banking but is becoming part of a bank’s risk architecture.
His 10-point framework includes ensuring that technology governance translates into outcomes, maintaining visibility across complex technology environments, addressing vulnerabilities and legacy systems, strengthening identity and access controls, and ensuring that security controls actually work as intended.
He also called on to keep risk controls aligned with the pace of technological change, manage third-party and external dependencies, strengthen post-incident analysis, regularly test recovery and operational resilience, and address underlying architecture and capacity constraints.
“The important test of governance is ultimately how effectively the framework translates into outcomes,” Jain said, while stressing that identifying vulnerabilities alone was not sufficient and material exposures needed to be addressed based on their severity and potential impact.
Jain’s comments come as banks increasingly rely on cloud infrastructure, application programming interface (APIs), providers and AI models alongside traditional banking systems.
He warned that such interconnectedness can create risks beyond an individual institution.
“Technology may be outsourced, but not the accountability,” he said, adding that banks must understand risks arising from external dependencies, including access controls, concentration, recoverability, data protection and exit options.
On AI specifically, Jain said the technology could improve customer service, fraud detection, risk assessment and productivity, but could also amplify errors. AI-driven outputs can influence credit decisions, fraud alerts, customer access, pricing and service delivery, making validation, monitoring, human oversight and clear accountability essential, he said.
“AI is expected to fundamentally change financial services, but governance must precede scale,” Jain said.
He also warned that AI is increasingly being used by attackers to scale phishing, impersonation and other cyberattacks, while banks can deploy the same technology for threat detection, behavioural analysis and automated incident response.
He said that boards and senior management must ultimately own technology governance, with clear responsibilities across the business risk, compliance, operations, and technology functions.
“In the AI era, governance must provide the discipline that enables innovation to be adopted with confidence, while ensuring that the resilience and trustworthiness of the financial system remain paramount,” he said.
