The Reserve Bank of India (RBI) has warned banks and other financial institutions against weakening internal controls as they adopt artificial intelligence (AI), automate lending decisions and accelerate digital services. Deputy Governor Swaminathan J said financial institutions must ensure that efforts to reduce costs and improve customer convenience do not compromise risk management, consumer protection or trust. Speaking at the FE Modern BFSI Summit 2026 in Mumbai on October 15, he highlighted mis-selling, inappropriate use of customer data and poor grievance handling as areas requiring greater attention.
The remarks come as financial institutions increasingly rely on automated processes, fintech partnerships and data-driven personalisation to expand their reach. Swaminathan said technology can make services faster and more efficient, but safeguards must evolve alongside those changes. He also emphasised that banks remain accountable for activities carried out through third-party providers. His message is that sustainable financial-sector growth depends not only on business expansion, but also on strong governance, fair customer treatment and the ability to identify emerging risks before they become serious problems.
Key Takeaways
- RBI warns against control dilution: Banks should not remove important checks simply to make services faster.
- AI does not eliminate risk: Automated lending and decision-making still require appropriate safeguards.
- Mis-selling remains a concern: Sales incentives should not override customers’ financial needs.
- Customer data requires responsible use: Obtaining consent is not enough if data is used in ways customers would not reasonably expect.
- Banks remain accountable for outsourcing: Using fintechs or external technology providers does not transfer a regulated institution’s responsibility.
- Complaints can reveal deeper problems: Repeated grievances may expose weaknesses in products, incentives or digital services.
- Resilience requires rapid responses: Financial institutions must detect problems, escalate concerns and restore services quickly.
Why the RBI Is Warning Banks About Internal Controls
Banks are under pressure to deliver financial services more quickly, reduce operating costs and expand digital access. Automated onboarding, instant credit decisions and AI-powered underwriting can help achieve those goals.
However, the RBI’s concern is that financial institutions may treat every additional check as an unnecessary obstacle. In his address, Swaminathan argued that some procedural steps exist for a reason: they help prevent errors, fraud and unsuitable lending.
For example, independent verification can catch incorrect information before a loan is approved. A maker-checker arrangement requires one person to initiate an action and another to verify it. A cooling-off period can give customers time to reconsider certain financial decisions.
Removing these steps without assessing their purpose can create vulnerabilities.
Swaminathan said that when a manual check is replaced by an algorithm, the underlying risk does not disappear. Instead, the institution must ensure that the new process includes an effective alternative control.
This distinction is important for banks adopting AI. Automation can improve consistency and speed, but it can also reproduce errors at scale if the underlying model, data or decision process is flawed.
The RBI’s message is not that banks should avoid technology. It is that operational efficiency must not come at the expense of effective risk management.
AI Lending and Fintech Partnerships Do Not Remove Bank Accountability
AI-led underwriting allows financial institutions to assess applications using data-driven models rather than relying entirely on traditional manual reviews. Fintech partnerships can also help banks reach customers through digital platforms and distribute financial products more efficiently.
These arrangements introduce additional risks. An external model could produce unreliable decisions, a fintech could collect inaccurate customer information, or a technology provider could experience a security incident.
Swaminathan stressed that responsibility associated with a bank’s regulatory licence remains with the regulated institution even when activities are performed by third parties.
| Business practice | Potential risk | What banks need to ensure |
|---|---|---|
| AI-based loan approvals | Incorrect or unsuitable credit decisions | Appropriate model oversight and validation |
| Fintech-sourced loans | Weak customer checks or unclear accountability | Effective oversight of partners and sourcing practices |
| Automated customer onboarding | Identity errors or fraud | Reliable verification and monitoring |
| Digital financial-product sales | Customers purchasing unsuitable products | Clear disclosures and needs-based recommendations |
| Data-driven personalisation | Unexpected or inappropriate data use | Responsible data governance and appropriate safeguards |
| Automated complaint handling | Repeated problems going unnoticed | Analysis of complaint patterns and escalation procedures |
This table summarises the risks discussed in the Deputy Governor’s address; it is not a separate list of newly announced RBI regulations.
For banks, this means vendor selection and outsourcing agreements cannot replace ongoing supervision. Institutions need to understand how third-party systems work, what risks they introduce and who is responsible for addressing failures.
RBI Flags Mis-Selling and Sales Incentives
Mis-selling occurs when a financial product is sold in a way that does not adequately reflect a customer’s needs, circumstances or understanding. It can involve unsuitable recommendations, incomplete explanations of costs and risks, or pressure to purchase a product that is not appropriate.
Swaminathan highlighted the tension between sales targets and customer interests. If employees are rewarded primarily for completing transactions, they may face incentives to prioritise volume over suitability.
This problem can become more pronounced when digital systems allow financial products to be offered to large numbers of customers through personalised recommendations and frequent notifications.
A product may be technically available to a customer without necessarily being appropriate for that person. Banks therefore need to ensure that their sales processes support informed decisions rather than simply maximise conversions.
Mis-selling can damage more than an individual customer’s finances. It can lead to complaints, legal disputes, regulatory penalties, customer attrition and reputational damage.
For financial institutions, stronger sales practices are therefore both a consumer-protection responsibility and a long-term business consideration.
Customer Data Use Must Match Customer Expectations
Banks increasingly use customer information to personalise offers, assess creditworthiness, detect fraud and improve digital services. Data analytics can make financial products more relevant, but they also increase the consequences of inappropriate data use.
Swaminathan said institutions must look beyond whether a customer has formally provided consent. They must also consider whether the use of that information is consistent with what the customer would reasonably expect.
For example, a customer may provide information to apply for a loan but not expect it to be used in an unrelated context without an appropriate basis. The specific rules governing any use depend on applicable law, consent, the purpose of collection and other relevant requirements.
The Deputy Governor’s remarks reinforce the importance of responsible data governance as financial institutions become more capable of analysing and acting on customer information in real time.
Banks must consider how information is collected, accessed, shared, protected and used. Stronger analytical capabilities make these safeguards more important, not less.
Customer Complaints Should Be Treated as Early-Warning Signals
Swaminathan also urged financial institutions to look beyond closing individual complaints. Repeated grievances can reveal wider weaknesses in business processes.
For example, a cluster of complaints about a particular financial product could indicate unclear disclosures or unsuitable sales practices. Similar complaints about a digital application could point to a design problem, while repeated disputes involving an external partner could signal inadequate oversight.
Treating every complaint as an isolated service issue can prevent institutions from identifying these patterns.
A stronger approach involves analysing complaints by product, channel, partner and type of problem. Banks can then investigate recurring issues, identify root causes and change processes before more customers are affected.
The RBI Deputy Governor also highlighted the system-wide effects of fraud. Customers may not distinguish between the institution where fraud originated, the bank through which money moved and the institution that hosted a mule account.
From the customer’s perspective, a failure anywhere in that chain can undermine confidence in the financial system.
This makes coordination, fraud detection and effective escalation important beyond the boundaries of any single institution.
Why Operational Resilience Matters in Digital Banking
Traditional measures of financial resilience include capital, liquidity and provisioning. Swaminathan said these remain fundamental, but a more digital and interconnected financial system also requires institutions to respond to problems quickly.
A risk can spread rapidly when transactions and communications take place electronically. Delays in identifying an incident, escalating it to senior management or restoring a critical service can make the consequences worse.
Banks therefore need reliable internal information flows and clear responsibilities for responding to emerging risks.
Audit, compliance and risk teams must be able to raise concerns, and those concerns must reach people with the authority to act. The quality of governance depends partly on whether bad news can travel through an institution quickly enough for corrective action to be taken.
This principle applies to technology failures, fraud, customer-data incidents and weaknesses in product distribution.
The Bigger Picture
Swaminathan’s warning highlights a central challenge for India’s financial sector: banks must expand digital access and improve efficiency without undermining the safeguards that make financial services trustworthy. AI, automated underwriting and fintech partnerships can improve service delivery, but they also create new operational and consumer-protection risks that require effective oversight.
The message is also relevant to customers. Clear product explanations, responsible data use and effective complaint resolution are essential to maintaining confidence in banks. For financial institutions, the long-term test is not simply how quickly they can grow, but whether their controls, governance and ability to respond to problems can keep pace with that growth.
FAQs
1. What did RBI Deputy Governor Swaminathan warn banks about?
He warned financial institutions against weakening internal controls in the pursuit of faster digital services and business growth. He specifically highlighted mis-selling, customer-data use, third-party risks and the need to learn from complaints.
2. Does the RBI oppose AI in banking?
No. Swaminathan acknowledged that technology and AI can reduce costs, improve customer experiences and expand access to financial services. His concern is that appropriate safeguards must evolve alongside automation.
3. Why is mis-selling a problem for banks?
Mis-selling can cause customers to purchase products that do not suit their needs or that they do not fully understand. It can result in financial harm, complaints, litigation, regulatory penalties and reputational damage.
4. Are banks responsible for services provided through fintech partners?
Swaminathan said that outsourcing a process does not transfer the responsibility associated with a regulated institution’s licence. Banks must maintain appropriate oversight of activities carried out by external providers.
5. Why does the RBI want banks to analyse customer complaints?
Recurring complaints can reveal deeper problems with product design, sales incentives, digital processes or third-party arrangements. Analysing these patterns can help banks identify and address risks earlier.
Looking Ahead
Banks are likely to face growing pressure to demonstrate that their digital transformation strategies are supported by effective governance, responsible data practices and reliable risk controls. As AI becomes more deeply integrated into lending, customer service and product distribution, financial institutions will need to show that automated systems remain subject to appropriate oversight and that customer interests are not subordinated to sales targets.
Swaminathan’s remarks reinforce that sustainable growth requires more than technology investment and expanding transaction volumes. Institutions must also build systems that detect problems early, resolve complaints meaningfully and maintain accountability across their operations and external partnerships. The strength of these safeguards will help determine whether digital innovation translates into lasting customer trust.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
