RBI expectations and training staff who oversee AI agents in Indian banks

The RBI expects Indian banks to stay accountable for every technology they use, to govern IT risk from the board down, to treat customers fairly in lending and recovery, and to resolve grievances properly. For banks running AI agents, each expectation lands on people: boards, operations, recovery and grievance staff must be trained to oversee what the agents do.

What does the RBI expect of people who oversee agents?

The RBI does not have a single rule on AI agents. Its expectations come from several directions, which together describe what competent oversight looks like. In substance:

• IT governance and risk. The RBI expects banks to have board-approved IT strategy and governance, with senior management responsible for IT risk, controls over change and access, and assurance over critical systems.
• Outsourcing. When a bank uses a third party for IT services, including platforms and model providers, the bank remains responsible for the service and for customer data, and must oversee the provider.
• Cyber security. Banks must run cyber security frameworks that include awareness among staff and senior management.
• Fair practices in lending and recovery. Banks must treat borrowers fairly, explain decisions, and ensure recovery conduct does not harass or intimidate borrowers, whether recovery is done in-house or by others acting for the bank.
• Customer service and grievances. Banks must handle complaints fairly and promptly, with escalation within the bank before customers go to the RBI's ombudsman route.

The RBI has also published work on responsible use of AI in the financial sector that emphasises governance, human oversight and building capability among boards and staff. The system view is in RBI and AI agents in Indian banks.

Who does it apply to?

Banks regulated by the RBI, including public and private sector banks, small finance banks, payments banks and foreign banks in India, and in many respects non-bank lenders and payment firms the RBI regulates. The Digital Personal Data Protection Act 2023 adds data protection duties for all of them.

Inside a bank, people who oversee agents include the board and its IT and risk committees, senior management, operations staff releasing agent-prepared actions, credit teams reviewing agent decisions, recovery teams and their supervisors, contact centre staff, and grievance redressal officers.

What competence do these expectations imply when agents act?

Board understanding. Board members must understand enough to approve and oversee: what each critical agent does, at what depth, which actions are held for people, and how incidents are handled. Depth is earned, not configured: the agent's role sets the ceiling, certification evidence on the bank's own cases sets the depth, and the lower wins. Boards should know that, and that agent certificates lapse after 90 days.

Change and access control. Changing an agent's brief or sources is a change to a production system. IT and operations staff must route it through change management, and treat agent credentials as privileged access.

Provider oversight. Vendor managers must know what data reaches the model provider, where it is processed, and how the bank would exit. Customer data crossing to a provider must meet both RBI outsourcing expectations and the DPDP Act.

Fair recovery. Recovery agents drafting reminders and call scripts must stay within fair conduct. Supervisors must recognise drafts that threaten, mislead or contact people outside permitted bounds, and such drafts should be refused by the agent's limits. Escalations such as legal notices are held for a named person.

Payments. India's instant payment rails settle at once. An agent may draft a payment or flag a suspicious one, but releasing money is depth 4 and held for a named person. Reversing a settled payment on the bank's own rail is withheld for every agent.

Grievances. When a customer complains about an agent's action, the grievance officer must read the record, see which bound decided the verdict, and re-decide with authority. Every verdict is filed in an append-only record that makes this possible.

Evidence. Staff must distinguish sealed records from the core banking system, signed information from named parties, declared customer statements, and external documents, and weigh decisions accordingly.

How do banks meet these expectations and show it?

A ready structure for planning this is in the AI agent training plan template for banks.

What will the RBI or an auditor ask?

• Which agents does the bank run, and what can each do?
• What has the board been told and trained on?
• Who approved the last change to this agent?
• How do you oversee your model provider?
• Show us recovery messages drafted by agents and how they were supervised.
• How did grievance officers handle complaints about agent actions?

Banks often ask how to evidence all this; see how banks can prove staff are trained to oversee AI agents.

What do these expectations not cover?

They do not replace the DPDP Act's data protection duties. They do not cover securities or insurance business, which SEBI and IRDAI supervise. They do not prescribe a training curriculum or certificate. And they continue to develop, so banks should track new RBI publications. Nigerian banks face a comparable set of expectations; see CBN expectations and training staff who oversee AI agents. The guide to AI literacy and certification covers the wider model.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where the Academy fits

Pryme Intelligence Academy gives Indian banks a layered path. Board members and executives start with Foundations, about four hours and free. Operations, credit and grievance staff take the Operator track, tested in banking and their own role. Those leading regulated, multi-agent deployments take the Architect track, which ends in a board review with two Pryme assessors.