RBI Warns Digital Banking Risks Need Faster, Smarter Supervision

Speaking at the Third Annual Global Conference of the College of Supervisors in Mumbai, RBI Deputy Governor Swaminathan J said that traditional indicators such as capital adequacy and liquidity are no longer sufficient to assess the health of banks in a technology-driven environment.

"Many jurisdictions are navigating similar challenges: rapid digitalisation, first-time customers, platform-based delivery, and fast-changing threat landscapes. Sharing practical experience on what works and what does not is one of the quickest ways to raise supervisory effectiveness," he said.

The Deputy Governor highlighted that risks in the digital era evolve at much greater speed, with customer growth, misinformation and liquidity stress capable of materialising within hours.

"In the digital world, both growth and stress can travel faster. Customer acquisition can be exponential, but so can misinformation, panic, and outflows. Risks that used to take weeks to build can now crystallise in hours. This means supervisory feedback loops must tighten, with early triggers, faster follow-up, and clear escalation," he said.

Many institutions may rely on the same core service providers, cloud platforms, payment rails, data vendors, and cybersecurity tools. This creates a new form of common exposure. It is not always visible in traditional financial ratios, but it is very real, the RBI DG said.

For supervision, we need to map dependencies more actively and assess concentration risk at the ecosystem level, not only at the individual institution level, he added.

Further, he said AI and machine learning are entering credit underwriting, fraud detection, customer service, treasury, and even internal control functions. This improves efficiency but also raises new questions of accountability, explainability, and fairness. "Supervisors need to be able to ask, and entities need to be able to answer, a simple question: who owns the outcome when a model drives a decision?"

"Digital banking increases points of entry, and the adversary is no longer a random hacker. It is often organised, well-funded, and persistent. Even when a bank's internal controls are strong, a weakness at a vendor, a partner, or a common technology component can spill over. Resilience and recovery must be treated as core capabilities," he said.

Digital lending, embedded finance, and platform-based distribution have significantly improved access and convenience. But we have also seen risks of mis-selling, opaque charges, aggressive recovery practices, and data misuse. In a digital environment, customer harm can quickly become a confidence issue, which can then transform into a liquidity issue.

Swaminathan J said supervision in the digital age must become more vigilant, ecosystem-aware and outcome-focused. "The objective is not to slow innovation, but to ensure it is built on trust, resilience and fairness," he said.

- ANI