The RBI’s August 2024 credit-model document and June 2026 model-risk guidance are drafts, not final instruments. NBFCs should use them as preparation benchmarks: build a complete model inventory, define independent validation, introduce risk-based controls, and document how models are monitored and governed.
Regulatory status note: This article discusses the RBI’s August 2024 draft circular on model risks in credit and its June 2026 draft Guidance on Regulatory Principles for Model Risk Management. Draft provisions should not be presented as final regulatory requirements. NBFCs should review any final RBI directions and their own applicable obligations before making compliance decisions.
Key takeaways
- The RBI’s August 2024 credit‑model document and June 2026 model‑risk document are drafts, not final rules. Use them as preparation benchmarks, not as binding law.
- NBFCs should build a complete model inventory, define independent validation, introduce risk‑based controls, and document how models are monitored and governed.
- Validation should cover assumptions, data and lineage, regulatory compliance, documentation, performance/backtesting & limitations. Including bias and discrimination where relevant.
- The 2026 draft moves from “validate every credit model yearly” to a risk‑tiered approach: higher‑impact models receive deeper and more frequent review, with additional triggers for material changes or performance drift.
- Third‑party and AI/ML models remain the NBFC’s responsibility. Vendor certificates do not replace the need for the NBFC’s own independent validation, oversight and exit arrangements.
Why should NBFCs prepare for model risk management RBI guidance?
Models increasingly influence who receives credit, the price of a loan, how much provision is held, and which accounts enter collections. A model is simply a method that converts data into a decision or recommendation. It can be a scorecard, an AI system, a rules engine, or, in some cases, a spreadsheet-based calculator that materially affects lending decisions.
The RBI’s regulatory direction is moving from model-by-model checks towards documented governance across the model lifecycle. The August 2024 draft focuses on credit models. The June 2026 draft guidance proposes a wider framework covering models used across regulated entities, including AI/ML and third-party models.
This guide explains what has changed, what the drafts propose, and what NBFCs can build now. It covers model inventories, independent validation, credit scoring model validation, risk tiering, monitoring, change management, AI/ML controls, and board reporting.
For NBFCs using automated scoring, Fintly’s machine learning scoring capability can form part of the decisioning workflow. It does not, however, replace the NBFC’s own governance, validation, or regulatory assessment.
What changed between the 2024 and 2026 RBI drafts?
The two documents should not be treated as one framework. They have different scope and different levels of detail.
| RBI document | Status | Focus | What an NBFC should take from it |
| Regulatory Principles for Management of Model Risks in Credit, August 2024 | Draft circular | Credit models used for scoring, borrower selection, pricing, risk analysis, provisions and economic capital | Prepare for independent validation, model documentation, a model inventory, backtesting and board-level oversight |
| Guidance on Regulatory Principles for Model Risk Management, June 2026 | Draft guidance | Enterprise-wide model risk management, including lifecycle controls, risk tiering, third-party models and AI/ML | Build a broader framework covering every material model, its owner, risk tier, validation, monitoring and decommissioning |
| Final RBI model-risk requirements | Final status must be verified separately | The final legal and supervisory position | Do not describe draft proposals as final requirements |
The 2024 draft says credit models should be validated before deployment, after material amendments, and during periodic reviews at least yearly. It also lists the areas that validation should cover, including assumptions, data, regulatory compliance, documentation, backtesting, limitations, bias and discrimination.
The 2026 draft takes a lifecycle view. It addresses model inventory, development or selection, validation, approval, deployment, monitoring, changes, business continuity, third-party arrangements and decommissioning. It also proposes risk-based validation intensity and specific controls for AI/ML models.
This distinction is the central point for any NBFC preparing for model risk management RBI expectations: the 2024 draft explains credit-model validation in detail, while the 2026 draft proposes a broader operating framework.
Who does the 2026 draft apply to?
The June 2026 draft is designed for specified Regulated Entities, including NBFCs across the Base, Middle, Upper and Top Layers. It is not limited to banks or to traditional credit scorecards.
The proposed framework can cover models used for –
- Credit scoring and borrower selection.
- Loan pricing and exposure limits.
- Provisioning and capital calculations.
- Collections and recovery prioritisation.
- Fraud detection and transaction monitoring.
- Customer-facing eligibility or recommendation decisions.
- Automated decision rules.
- Artificial intelligence and machine-learning systems.
- Models bought from vendors or used through a third party.
- Material spreadsheet-based tools that influence decisions.
This does not mean every spreadsheet or rule automatically becomes an RBI model. The relevant question is whether the tool materially affects a regulated entity’s decision, risk exposure, customer outcome or control process.
What does independent model validation involve?
Independent validation means assessing a model separately from the team that developed, selected or operates it. External experts can support the work, but outsourcing the review does not remove the NBFC’s accountability.
The proposed three-lines structure is clearer than simply saying “second line or external expert” –
- First line: Model owners and business teams responsible for the model’s purpose, use and performance.
- Second line: Independent model risk management and validation.
- Third line: Independent internal audit, which evaluates whether the overall control framework operates as intended.
For a credit model, the 2024 draft proposes validation before deployment, after material amendments, and during periodic reviews at least once a year. The 2026 draft moves toward a risk-based approach. It proposes that a model’s risk tier should influence the intensity, frequency and method of validation.
What should credit model validation cover?
The 2024 draft identifies the following areas –
| RBI draft expectation | Practical validation activity | Example evidence |
| Review assumptions | Test whether assumptions fit the portfolio, product and intended use | Assumption review memo |
| Verify data accuracy and sources | Check data quality, transformations and source reliability | Data lineage map and data quality analysis |
| Check regulatory compliance | Map model use to applicable RBI directions and internal policy | Regulatory assessment |
| Review documentation | Confirm that the model can be understood, reproduced and governed | Model document, version history and change log |
| Assess model outcomes through backtesting | Compare predicted and observed outcomes using suitable tests | Backtesting report with relevant performance and stability analysis |
| Review limitations, bias and discrimination | Identify weaknesses and unequal outcomes where relevant | Limitation register, bias assessment and remediation plan |
AUC, KS, calibration analysis and PSI can be useful tools, but the RBI draft does not prescribe one universal metric or threshold in the source cited here. Select measures based on the model’s purpose, portfolio, data, risk tier and internal policy.
When should an NBFC validate a model?
The answer depends on which draft you are applying as a preparation reference.
Under the 2024 credit-model draft –
- New credit models should follow the proposed guidelines before adoption after the stated effective period.
- Existing models should be validated within the proposed six-month transition period.
- Models should be validated before deployment.
- Material amendments should trigger validation.
- Periodic review should occur at least yearly.
Under the 2026 draft guidance, validation frequency is expected to follow the entity’s Model Risk Management Framework (MRMF) and the model’s risk tier. A high-impact model that drives automated approvals should receive more frequent and deeper review than a low-impact internal reporting tool.
A practical validation calendar should therefore record –
- Planned deployment date.
- Last validation date.
- Next scheduled review.
- Material changes since the last review.
- Performance or data-drift triggers.
- Internal audit or supervisory triggers.
- Open remediation actions.
How should an NBFC build its model inventory?
Treat the model inventory as the authoritative register of models and their governance status. Do not limit it to production credit scorecards. Include models under development, models acquired from vendors, and retired models where the applicable retention rule requires them to remain recorded.
A useful inventory should capture –
- Model name and unique ID.
- Intended use and business decision supported.
- Model owner.
- Developer or development team.
- Independent validator.
- Approver or approval committee.
- Risk tier and materiality.
- Key data sources.
- Upstream and downstream dependencies.
- Third-party involvement.
- Current model version.
- Deployment status.
- Last validation and next review.
- Monitoring status.
- Open findings and remediation owners.
- Change history.
- Decommissioning status.
- Retention information.
The 2026 draft is reported to propose retaining decommissioned model records for at least 10 years. Treat that as a draft proposal until confirmed in a final RBI instrument.
Fintly’s guide to model risk management and AI in lending provides useful context for connecting model development with governance, explainability and monitoring.
How should NBFCs risk-tier models?
Risk tiering means grouping models according to their potential impact. It helps an NBFC apply stronger controls where a model can cause greater financial, customer or prudential harm.
A model’s tier could consider –
- Whether it approves, declines, prices or limits credit.
- The number of customers affected.
- Financial exposure.
- Model complexity.
- Use of sensitive or personal data.
- Degree of human review.
- Reliance on a third-party provider.
- Consequences if the model fails.
- Difficulty of explaining or reproducing its output.
For example, an internal dashboard that only helps an analyst review accounts might receive lighter controls. If the same dashboard automatically reduces a customer’s credit limit, its risk and governance requirements change.
This is why the 2026 draft’s risk-tiering approach matters. Validation should be proportionate, but “proportionate” does not mean optional for high-impact models.
How should NBFCs perform credit model backtesting?
Backtesting compares model predictions with observed outcomes. It helps answer whether the model continues to work for the customers and portfolio where it is being used.
For credit scoring model validation, an NBFC should consider –
- Discriminatory power: Whether the model separates lower-risk and higher-risk accounts.
- Calibration: Whether predicted probabilities are reasonably aligned with observed outcomes.
- Stability: Whether the customer population and input patterns have changed.
- Segment performance: Whether the model performs differently across products, regions or customer groups.
- Override analysis: Whether manual decisions regularly change model outcomes.
- Stress and sensitivity testing: How results change under adverse conditions.
Metrics such as AUC-ROC, KS, calibration error and PSI can support this work. The NBFC should define internal benchmarks according to its portfolio, model purpose, risk tier and historical performance. These are internal governance thresholds, not universal RBI benchmarks.
Illustrative example: Suppose an NBFC notices that a scorecard performs well overall but poorly for thin-file applicants. The validation team could run segment-level performance tests, review the data used for that segment, assess calibration & recommend a documented remediation plan. The result should show the issue, its customer and portfolio impact, the proposed action, the owner and the date for retesting. No unsupported performance improvement should be claimed.
What should NBFCs monitor after deployment?
Validation is not the same as monitoring.
- Validation is an independent assessment of whether the model is conceptually sound, appropriately developed and fit for its intended use.
- Monitoring is the ongoing process of checking whether the model continues to perform as expected in production.
Post-deployment monitoring can cover –
- Changes in input-data quality.
- Population or data drift.
- Prediction and outcome trends.
- Default or fraud rates.
- Segment-level performance.
- Override rates.
- Customer complaints and adverse outcomes.
- System availability and data-pipeline failures.
- Unusual output patterns.
Monitoring results should feed the validation calendar and change-management process. A model that shows sustained drift may need early revalidation even if its scheduled review date has not arrived.
How should NBFCs manage third-party models?
The 2026 draft guidance explicitly proposes that third-party models remain subject to independent validation by the Regulated Entity, even where the provider supplies certification, assurance or its own validation.
The NBFC should remain able to understand and govern the model. Vendor due diligence and contracts should address –
- Model purpose, methodology and limitations.
- Data sources and dependencies.
- Technical documentation.
- Configuration and operating controls.
- Version and change notifications.
- Performance-monitoring responsibilities.
- Provider update and retraining policy.
- Access for internal audit and supervisors.
- Subcontractors and material dependencies.
- Incident and breach notification.
- Business continuity arrangements.
- Exit, portability and transition support.
- Rights to review relevant evidence.
A vendor certificate can be useful evidence. It should not be treated as a substitute for the NBFC’s own risk assessment, approval, monitoring and independent validation.
What changes for AI and machine-learning models?
The 2026 draft’s AI/ML provisions create a major opportunity for NBFCs to improve their readiness beyond traditional scorecards. The controls should address technical performance, customer impact and the ability of people to intervene.
| Risk area | What the NBFC should assess |
| Explainability | Can the organisation explain material decisions to internal reviewers and affected customers where required? |
| Bias and discrimination | Do outcomes differ unfairly across customer groups or segments? |
| Data drift | Has the distribution of model inputs changed? |
| Concept drift | Has the relationship between inputs and outcomes changed? |
| Hallucination | Can a generative system produce unsupported or inaccurate information? |
| Overfitting and spurious correlation | Is the model relying on patterns that do not hold outside development data? |
| Output variability | Do similar inputs produce unexplained differences? |
| Adversarial behaviour | Can users or external actors manipulate inputs to obtain unsafe results? |
| Traceability and reproducibility | Can the NBFC reconstruct the model, data and version that produced an output? |
| Human oversight | Can an authorised person review, override, suspend or deactivate the model? |
| Cybersecurity | Are interfaces, APIs, access controls and deployment environments protected? |
The draft also discusses safeguards such as human assistance, human-in-command arrangements, override mechanisms, suspension or deactivation controls and kill-switch mechanisms. These should be treated as proposed guidance until final RBI directions are available.
What should a validation report and RMCB summary contain?
A validation report should be understandable to both technical reviewers and senior decision-makers. It should normally include –
- Scope and intended use.
- Model version and data period.
- Validation methods.
- Assumptions and limitations.
- Data-quality observations.
- Performance and stability results.
- Bias or discrimination observations where relevant.
- Findings and severity.
- Remediation actions.
- Owners and deadlines.
- Validator conclusion.
- Model owner response.
- Approval and escalation route.
A practical board or RMCB summary might be three to five pages, but that page count is Fintly’s suggested format, not an RBI requirement. The summary can include –
- Model risk tier.
- Key findings.
- Exceptions and their business or customer impact.
- Recommended controls.
- Remediation status.
- Action owners and deadlines.
- Approval or review required.
Under the 2024 draft, validation results should be placed before the RMCB or a Board-designated sub-committee. Under the 2026 draft, governance is more risk-tiered: high-risk models receive stronger RMCB oversight, while other decisions can be delegated according to the RE’s approved MRMF.
What should an NBFC do now?
Use the following readiness framework –
Model inventory → Risk tiering → Development or selection → Independent validation → Approval → Deployment → Monitoring → Change management → Revalidation and remediation → Decommissioning
A practical readiness checklist includes –
- Board-approved or formally documented model-risk policy.
- Complete model inventory.
- Assigned model owners, developers, validators and approvers.
- Risk-tiering methodology.
- Independent validation process.
- Model documentation standards.
- Data lineage and quality controls.
- Backtesting and performance-monitoring framework.
- Change-management process.
- Third-party due diligence and contractual controls.
- AI/ML-specific controls where relevant.
- Human oversight and override procedures.
- Decommissioning and retention process.
- Governance reporting route for model findings.
Also consider assigning a dedicated Model Risk Officer or clearly defined model-risk responsibility, depending on the NBFC’s size, complexity and governance structure. The role title itself should not be presented as an RBI requirement unless a final direction says so.
Conclusion
The most important change in model risk management RBI preparation is to separate what is proposed from what is final. The August 2024 draft gives NBFCs a detailed credit-model validation reference. The June 2026 draft proposes a wider framework covering model inventories, risk tiers, lifecycle controls, third-party models and AI/ML.
NBFCs should start with the basics: identify every material model, assign ownership, define independent validation, document data and assumptions, monitor outcomes and route findings through the right governance forum. These steps improve readiness without treating draft guidance as final law.
If you want to review your model inventory, validation evidence and monitoring workflow, contact Fintly to discuss a practical starting point.
QUICK ANSWERSFrequently Asked Questions
Your most common questions, answered with precision and insight
No, the June 2026 document was issued as draft guidance for consultation. It should be treated as a preparation reference rather than a final regulatory requirement. NBFCs should monitor RBI notifications and review the final version, if issued, before making formal compliance conclusions. The same caution applies to the August 2024 document, which is titled a draft circular on regulatory principles for model risks in credit.
The June 2026 draft is intended to cover NBFCs across the Base, Middle, Upper and Top Layers, along with other specified Regulated Entities. Its proposed scope is broader than credit scoring and includes material models used for pricing, fraud, collections, provisioning, customer decisions, AI/ML and third-party services. The final scope should be confirmed against the final RBI document.
Independent model validation is an assessment performed separately from the team that developed or selected the model. The reviewer tests the model’s assumptions, data, documentation, intended use, performance and limitations. An external expert can support the work, but the NBFC remains responsible for ensuring that the process is independent and properly governed.
The 2024 credit-model draft proposes validation before deployment, after material amendments and at least yearly during periodic reviews. The 2026 draft moves toward risk-based frequency under the entity’s MRMF. High-impact models should generally receive deeper and more frequent review than low-impact tools, with additional reviews triggered by performance drift, major data changes or other material events.
A model inventory should record each material model and its governance status. Useful fields include model ID, intended use, owner, developer, validator, approver, risk tier, data sources, dependencies, version, third-party involvement, validation dates, monitoring status, open findings, remediation and decommissioning information. The 2026 draft is also reported to propose retaining records of decommissioned models for at least 10 years.
Yes, the 2026 draft proposes that third-party models remain subject to independent validation by the RE. A vendor’s certificate or assurance report can support due diligence but does not remove the NBFC’s responsibility. The NBFC should retain access to documentation, testing evidence, change information, monitoring results, audit rights and suitable exit arrangements.
The draft proposes additional controls for explainability, bias, drift, output variability, adversarial behaviour, traceability, reproducibility, cybersecurity and human intervention. NBFCs using AI/ML should be able to monitor the model, investigate unusual outputs and suspend or override it when necessary. These provisions remain draft proposals until confirmed in a final RBI instrument.
Validation is an independent assessment of whether a model is fit for its intended use, while monitoring checks whether it continues to perform properly after deployment. Validation is performed at defined points in the lifecycle. Monitoring is ongoing and can identify data drift, performance deterioration, unusual overrides, customer-impact issues or operational failures that trigger early revalidation.
Author
Subject Matter Expert (Lending) Fintly.co
Vijay Mali is a results-driven professional with deep expertise in HFC/NBFC startups, compliance, and underwriting. He specializes in delivering end-to-end solutions for financial institutions, focusing on Business Rule Engines (BRE), workflow automation, and AI-driven credit decision-making. He is passionate about leveraging Machine Learning (ML) scorecards and AI-powered risk assessment to optimize lending processes and drive digital transformation in the financial sector.
