Indian retail banks' compliance teams can use AI agents to track periodic KYC updation, check that loans carry a correct key fact statement, test collections calls against conduct rules and follow unclaimed deposits through each required step. RBI supervises all of this and the DPDP Act 2023 governs the data, so account restrictions, complaint outcomes and reports to RBI stay with people.
What do retail banking compliance teams in India spend their time on?
India's retail banks, public sector, private, small finance and payments banks, serve very large customer bases through branches, business correspondents and digital channels. RBI issues detailed directions on customer treatment, and compliance teams spend much of their time proving those directions are followed at scale.
Periodic KYC updation. Customer due diligence must be refreshed at intervals set by risk category. With hundreds of thousands or millions of accounts, banks need to track who is due, contact them and restrict accounts appropriately when updation lapses, without cutting off customers unfairly.
Loan disclosures. Retail and digital loans must come with a key fact statement setting out the all-in cost and key terms in a standard form, before the customer signs. Errors in the stated cost are a conduct failure.
Collections conduct. Banks and their recovery agents must not harass borrowers, must call only at permitted times and must follow fair practices. Many complaints concern collections.
Unclaimed deposits. Banks must identify inoperative accounts, try to trace holders, and after a set period transfer unclaimed balances to a fund run by RBI, while keeping customers able to claim them later.
Grievances. Customers can escalate unresolved complaints to RBI's ombudsman.
Where do AI agents help?
The depth of each use sets how far an agent may act: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.
| Use | What the agent does | Depth |
|---|---|---|
| KYC updation tracking | Tracks updation due dates by risk category and sends reminders to customers through approved templates | 3 |
| Key fact statement checks | Recomputes the all-in cost from the loan terms and compares it with the statement issued, listing mismatches | 1 |
| Collections call review | Checks recorded collections calls for permitted timing, prohibited language and required disclosures, across languages | 1 |
| Unclaimed deposit testing | Checks each inoperative account against the tracing and transfer steps, listing missed or late steps | 1 |
| Ombudsman case files | Assembles the complaint history and drafts the bank's response for the grievance officer | 2 |
KYC reminders run at depth 3 because sending a reminder through an approved template is routine and reversible. Restricting the account is not, and the agent cannot do it. The key fact statement check is the most India-specific use: the rule is precise, every retail and digital loan needs one, and a recomputation catches errors that a visual check misses.
What stays with people?
Restricting accounts. When updation lapses, partially freezing an account can stop a customer from receiving wages or benefits. A person decides, following RBI's directions on how restrictions must be applied.
Loan repricing and refunds. If a statement understated the cost, the remedy for the customer is decided by people and executed by operations.
Action on recovery agents. Suspending an agency or an individual collector is a decision for management, on evidence a person has reviewed.
Ombudsman responses. The bank's position in a case is decided and signed by the grievance redressal officer.
Reporting to RBI. Returns, breach reports and responses to inspection are made by responsible officers.
Which rules apply in India?
India has no AI-specific law in force. Retail banks' use of agents is governed by RBI directions and data protection law. The broader picture is in how AI agents are regulated in India.
RBI. Supervises banks, with directions on KYC, fair practices in lending, digital lending, key fact statements, recovery agents, inoperative accounts and unclaimed deposits, customer service and grievance redressal, and outsourcing of financial services. Banks remain responsible for any process an agent supports and for outsourced service providers, including the provider of an agent.
Digital Personal Data Protection Act 2023. Applies to digital personal data: notice, consent or another permitted ground, purpose limitation, security safeguards, breach notification and individuals' rights. Call recordings, KYC documents and loan files all fall within it. See DPDP Act and AI agents in India.
AML law, consistent with FATF standards, sets due diligence, monitoring and reporting duties that KYC updation supports.
SEBI and IRDAI apply where branches distribute investment and insurance products.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How do you start in the first 90 days?
Month one. Confirm the agent's processing location and outsourcing treatment. Start with key fact statement checks on new personal loans, which need loan terms and issued statements only.
Month two. Replay the agent against a quarter of issued loans. Investigate every mismatch it finds, since each may be a customer who was told the wrong cost.
Month three. Run on every new loan before disbursement, with credit operations correcting errors. Pilot collections call review in two languages. Banks in Singapore operate under a principles-led regulator with a different emphasis; see compliance agents in Singapore retail banking. The guide to AI compliance agents explains the second-line approach.
Questions people ask
Can an AI agent freeze accounts when KYC updation lapses?
No. It can track due dates and send reminders. Applying restrictions follows RBI's directions and requires a person's decision, because it affects the customer's access to money.
Can an agent generate the key fact statement itself?
Generating the statement is a first-line task. The compliance agent should check statements independently, so the check is not marking its own work.
Is reviewing collections calls allowed under the DPDP Act?
Monitoring calls for conduct compliance generally serves a legitimate purpose, but the bank must give notice, limit use and protect the recordings. Confirm the basis with your data protection lead.