Key Details
RBI Deputy Governor Rohit Jain Jain’s 24 September 2026 address set out expectations for managing technology risk as digital banking grows; it did not announce a new regulation.
Scale: UPI processed 24.9 billion transactions worth about ₹30.15 lakh crore in August 2026.
Risk ownership: Jain said technology risk should be treated as a core bank-wide risk, with boards and senior management responsible for oversight.
External providers: Banks may outsource technology, but retain accountability for its security, reliability and recoverability.
AI: Uses in credit decisions, fraud detection and customer service require validation, monitoring, human oversight and clear accountability.
Operational test: His ten requirements covered vulnerabilities, access controls, third-party dependencies, incident learning and realistic testing of recovery arrangements.
A System Failure Can Become a Banking Failure
Digital services have reduced costs and widened access, but they have also made technology essential to everyday banking. At UPI’s scale, an outage or compromised payment interface can prevent customers from accessing money and affect institutions connected to the service. Financial strength alone cannot keep a bank operating if a critical system is unavailable.
Jain pointed to a 2018 cyberattack on a cooperative bank as an example of weaknesses in connected payment systems, and the 2024 CrowdStrike outage as a reminder that a faulty update from a shared provider can disrupt services without any cyberattack. His emphasis was on preventing avoidable failures, containing incidents and restoring critical services quickly.
Banks Must Understand the Risks They Outsource
A bank’s technology now extends across payment applications, software suppliers, cloud services, data centres and connected fintech firms. Jain argued that a bank remains responsible for understanding those dependencies even when another company operates the system.
This also creates a system-wide concern: several banks may depend on the same provider. An arrangement that appears manageable to each bank separately could become a concentrated risk for the financial sector.
AI Governance Must Keep Pace With Its Use
Jain described AI as a tool for productivity, customer service and fraud detection—and as a means for criminals to scale impersonation and other attacks. Where AI influences credit, pricing or customer access, errors can spread quickly. He therefore placed model validation, reliable data and human judgement alongside cybersecurity controls, with boards expected to understand and question how these systems are used.
Policy Relevance
The address shifts the measure of technology governance from whether a bank has controls on paper to whether it can keep essential services available and recover them under stress.
For bank boards: Realistic recovery tests should show what happens when a payment channel or major supplier fails, how long customers lose access, and whether fallback arrangements work.
For sector-wide oversight: Shared providers and connected payment systems require visibility beyond any one bank’s risk register. Coordinated threat information can help identify incidents before they spread.
For AI use: Banks need evidence that automated decisions remain accurate, explainable to those responsible for them, and subject to effective human review where customers may be harmed.
Relevant Question for Policy Stakeholders: Can banks demonstrate that customers will retain or quickly regain access to essential services when a critical technology provider or connected system fails?
Follow the Full Speech Here: From Digital Banking to Resilient Banking – Technology, Cyber Security and AI as Pillars of Trust