Learn / Regulation
RBI's draft model risk rules: what they mean for your credit models
RBI has published a draft asking banks, NBFCs and credit bureaus to manage model risk formally, because a wrong scorecard, provisioning model or collections model makes wrong decisions at scale. It is not final yet, but it shows what examiners are likely to expect, and much of the work falls on the credit risk team.
What does model risk mean?
Model risk is the loss you take because a model is wrong, or is used for something it was not built for. A scorecard trained on salaried customers and then used on self-employed customers is a model risk. So is a provisioning spreadsheet nobody has checked since the person who built it left.
RBI defines a model broadly: a system, built in-house or bought from a vendor, that processes inputs and produces results used in decisions. Its own example is a spreadsheet calculator. If you use it to work out lending rates, customer margins or credit terms, it is a model, even if nobody calls it one.
Where does the draft stand?
- RBI released it on 24 June 2026 and asked for comments by 24 July 2026. That window has closed. As far as we could find, no final version or effective date has been published, so nothing is binding yet. Check RBI's website for the latest.
- When final, it replaces the chapter on credit risk models in RBI's 2002 Guidance Note on Credit Risk Management.
- It covers banks of all types, NBFCs in every layer, All-India Financial Institutions, asset reconstruction companies and credit information companies.
- If another RBI Direction says something different, that Direction wins.
What would you need to have?
The draft asks for seven things. Each one is something an examiner can ask to see.
| What | In plain terms |
|---|---|
| A Board-approved framework | One document, approved by the Board, that sets out how every model is built, approved, used and retired, and how much model risk the institution will accept. |
| A model inventory | A single list of every model: in use, not in use, in development and retired. A model that is not on the list cannot be used. |
| Risk tiers | Each model is rated by how much damage it could do. The tier decides how closely it is validated, who approves it and how often it is monitored. |
| Independent validation | Someone who did not build the model checks it before it goes live, after changes and on a regular cycle. This applies to models you buy from a vendor too, whatever the vendor certifies. |
| Monitoring and change control | Live models are monitored. Any change gets a written impact check, and you define what counts as a material change that triggers validation again. |
| Reporting to the Board's risk committee | Validation reports reach the Board's risk committee, or someone it delegates to, within three months of the validation finishing. |
| Records | Full documentation, a log of changes and approvals, and a retained entry for retired models for at least ten years. |
What changes for AI and machine learning models?
Models that learn from data get extra rules. The more a decision affects a customer, the more you must be able to explain it.
- Set explainability standards for every AI model, and hold models relied on for important decisions to a higher standard. In lending, a model that decides who gets a loan is a clear example. If a model cannot be fully explained, add other controls.
- Test for biased or discriminatory outputs, for models that fit noise rather than real patterns, and for results that swing between runs.
- Watch for drift: the data changing (data drift), or the link between the data and the outcome changing (concept drift).
- Keep human oversight, with a way to override, suspend or switch the model off (a kill-switch).
- For chatbots and other customer-facing AI: tell people it is AI, say what it cannot do, and let them reach a human on request.
What can a credit risk team do now?
- List every model and every spreadsheet that drives a decision, including vendor scores.
- Give each one an owner, a builder, a validator and an approver. If one person holds all four roles, write that down.
- Draft your tiering rule: how important is the decision, and how hard is the model to understand?
- Check vendor contracts for the right to receive documentation and to audit.
- Write down what a material change means for your models, so an update does not skip validation.
What mistakes should you avoid?
- Listing only the main scorecards. Spreadsheets and vendor scores count too.
- Tiering a simple model low because it is simple. A basic model that drives a large decision is still high-impact.
- Treating a vendor's certificate as validation. The draft asks you to validate independently.
- Deleting retired models from your records.
Try it on your own tables
The free tools give you the prompt, the checks and how to present the result. You enter table names only.
See the free toolsFrequently asked questions
Is RBI's model risk guidance law today?
No. It is a draft. Comments closed on 24 July 2026 and, as far as we could find, no final version has been issued. Watch RBI's website for it and for its effective date.
Does it apply to NBFCs?
Yes. The draft covers NBFCs in the Base, Middle, Upper and Top layers, as well as banks, credit bureaus and other regulated entities.
Do I have to validate models I buy from a vendor?
The draft says yes, independently, whatever certification the vendor gives you. Your contract should also give you documentation and audit rights.
Does a credit scorecard count as a model?
Yes. A scorecard is a system that processes inputs and produces a result used in a decision, which is how the draft describes a model. Provisioning, collections and pricing tools fit the same description.
Keep reading
What is a model inventory, and what should it hold?
A model inventory is the single list of every model your institution uses. RBI's draft says no model may be used unless it is on it. Fields to include, with an example.
RegulationHow to tier your credit models by risk
Model tiering ranks each model by how much harm a wrong result could do. A simple two-factor method, a worked example for lenders, and the mistake that gets models tiered too low.
ModelsHow to validate a credit scorecard: Gini, KS and PSI explained
Gini, KS and PSI explained with one worked table and tested SQL. What each measure tells you about a scorecard, and the checks that catch what they miss.