When the RBI finalizes its Model Risk Management Guidance, the institutions that spent the draft phase establishing real oversight will be in a very different position from those waiting for the final circular.  

The draft requires every RBI-regulated institution to govern all analytical models it runs, including AI and ML systems used in lending, underwriting, fraud, and customer decisioning, under a board-approved framework with named accountability.  

With the public comment window now closed, the countdown to final guidance has begun. The obligation it creates is personal in a way most technology programs are not: a Chief Risk Officer becomes answerable for models the risk function never commissioned, reviewed, or ever seen! 

The models you are accountable for are not all in your inventory 

Credit scorecards and underwriting engines sit inside the risk function’s line of sight. Those are governed.  

The exposure sits elsewhere. A spreadsheet-based formula that branch teams use to rank overdue accounts, built locally because central IT requests would have taken six weeks. Fraud rules embedded inside a vendor platform that procurement onboarded as a tool rather than a model. A pricing engine that arrived inside a larger system purchase and was never classified.  

Under the draft, each of these is a model. The CRO owns the consequences of every one of them. Which means the number that matters is one most institutions cannot currently produce: how many models are actually running, and who is accountable for each. Without that baseline, any compliance timeline of budget estimate is built on guesswork. 

Mergen’s initial discovery phase bridges that gap by mapping models across business operations rather than just tech teams, because undocumented models sit where the business built workarounds. It helps CRO know the full extent of their own accountability before an inspector establishes that number for them.  

When the board asks, the answer needs to already exist 

The draft requires board-approved risk appetite thresholds, defined escalation paths, and reporting that keeps the board current on model risk posture.  

In most institutions, answering a board question on model risk means requesting a position from risk, a system inventory from IT, a vendor status from procurement, and a control assessment from compliance. Four functions, four reporting cycles, four formats that weren’t designed to reconcile. The CRO assembles the answer manually and presents it knowing parts of it have gone stale already.  

Producing a single defensible position out of four disconnected functions is the work Mergen does in banking. When a UK bank had to run PPP loan applications under regulatory scrutiny and emergency timelines, the constraint was case-level traceability at volume: knowing the status and exposure of every file, in one place, at any moment. We rebuilt that process into a single tracked workflow and cut the handling burden per case file by 75%. 

The same discipline applies to model governance. Model inventory, intervention history, third-party validation status, and control gaps resolve into one current position on ServiceNow GRC, so that when the board asks about exposure, the CRO answers a live view rather than a reconstruction.   

Override capability is common, override evidence is rare 

The draft requires human override and kill-switch mechanisms for automated decision systems. Most lending institutions already have this capability inside their loan originating platforms.  

The requirement is the ability to demonstrate, under examination, that each intervention was deliberate, documented, and reviewed.  

A loan officer at a housing finance company overrides an underwriting decline because the borrower’s income is seasonal, and the model flagged the debt-to-income ratio without that context. A reasonable decision made hundreds of times a month across the sector.  

Under the draft, the institution needs to produce a complete record of that moment, and complete is defined by what an examiner expects to see rather than what the origination system happens to capture. Across the BFSI environments we have worked in, the override itself is logged. What sits around it usually is not, and the CRO discovers that during the inspection rather than before it.  

Vendor models carry institutional liability 

A vendor’s validation certificate does not transfer accountability. The institution remains responsible for every third-party model in production and must validate each one independently.  

This lands hardest on NBFCs and housing finance companies, where vendor-supplied models often handle credit scoring, fraud detection, and collections. Current practice manages these at the vendor relationship level with an assessment, an annual review, and one file.  

The draft requires validation per model. A single vendor supplying four models means quadrupled validation trails, separate risk tiers, unique review cadences, and mountains of evidence retrievable on demand. For institutions carrying a dozen vendor relationships, the workload multiples fast, and procurement teams are rarely staffed for validation work of this kind.  

The liability, meanwhile, does not sit with procurement.  

Mergen restructures vendor risk on ServiceNow so that validation attaches to the model rather than the contract, with review cadence set by risk tier and evidence retrievable per model on demand. The workload stops depending on how well procurement is staffed, and the CRO stops carrying a liability tracked in a spreadsheet.  

Preventing findings rather than remediating them 

Adverse findings on model governance do not stay contained to the risk function. They surface in supervisory correspondence, they attract follow-up inspection, and they raise questions about whether affected operations continue at their current size while remediation runs. The board answers the regulator’s timeline.  

Our engagements begin with a two-to-three-week risk-mapping assessment across business functions, which produces the two things every subsequent decision depends on: what you are accountable for, and which of it carries regulatory weight. Implementation phases from there by risk tier, credit and fraud models first, built on ServiceNow GRC as one operating structure rather than four that need reconciling later.  

Institutions that establish an accurate inventory and a defensible framework now will be responding to a circular. Those that wait will be responding to a finding. 

If you are the one accountable for AI or ML decisions across lending, fraud, or underwriting, you shouldn't have to guess what your real exposure is. Reach out to Mergen’s BFSI team—we’ll help you map the full scope of your obligation before the regulator does.