TL;DR

  • RBI’s June 2026 draft guidance assigns the Risk Management Committee of the Board (RMCB) specific approval and review functions, but does not define what a model risk report to the board should contain.
  • The RMCB’s assigned functions: approve deployment of high-risk models, review model risk tiering reports at least annually, maintain standing oversight of exception-approved, third-party, and AI models, and review reports of breaches or material concerns.
  • The Board itself, separately, is expected to set risk appetite and approve the institution’s Model Risk Management Framework (MRMF).
  • RBI’s draft does not specify RMCB composition, meeting frequency, report contents, or quantitative escalation thresholds. These are left to each institution’s own MRMF.
  • A defensible board report typically covers model inventory summary, validation status, tier distribution and re-tiering activity, exceptions and overrides, remediation aging, vendor model status, and AI/ML models flagged separately. RBI prescribes none of this. Sound practice recommends all of it.

Most Model Risk Committees Are Reporting Against a Standard That Doesn’t Exist Yet

Ask a Model Risk Management Committee chair at an Indian bank or NBFC what their board report should contain, and you will get a confident answer built on habit rather than rule. That reflects where the current regulatory landscape actually stands.

RBI’s June 2026 draft guidance assigns real, specific duties to the Risk Management Committee of the Board. It tells the RMCB what to approve and what to review. It does not tell anyone what a model risk report should look like, how often the board itself should see one, or what triggers an escalation outside the scheduled cycle. Institutions are filling that gap with whatever format they already had, often inherited from credit risk or operational risk reporting, neither of which was built for model inventories, tiering, or AI-specific oversight.

That gap is the subject of this post: what RBI’s draft actually assigns to the RMCB, what it leaves open, and what a defensible board report covers in the absence of a prescribed template.

RBI’s Draft Guidance Assigns the RMCB Four Specific Functions, Not a Reporting Template

RBI released draft guidance on model risk management on June 24, 2026 (prid=63006). The comment period closed July 24, 2026. It remains a draft today. It has not been finalized, and it has not been issued as a Master Direction. The RMCB-function descriptions below are drawn from secondary legal and advisory analysis of the draft, not from an independent line-by-line reading of RBI’s own primary text, so no section number is cited for any of them.

Four functions are assigned to the RMCB:

Approval authority for high-risk models. The RMCB approves deployment of models classified as high risk. Approval for lower-tier models can be delegated further down, per the entity’s own MRMF. The draft assigns the authority; it leaves the delegation mechanics to each institution.

Periodic review of model risk tiering reports. The RMCB reviews these at least annually. This connects directly to the annual re-tiering cycle we covered in an earlier post in this series: every model gets reassessed and re-tiered on a defined cadence, and the RMCB is where that output surfaces for board-level oversight. We are not re-explaining the tiering criteria here; that work is covered elsewhere in this series.

Standing oversight of three special categories. Regardless of a model’s assigned tier, the RMCB maintains ongoing oversight of exception-approved models, third-party and vendor models, and AI models. Tier alone does not exempt these categories from board committee visibility.

Review of breach and material-concern reports. This is the closest thing in the draft to an escalation trigger. The RMCB reviews reports of breaches and other material concerns as they arise. No quantitative threshold defines what qualifies as material.

That is the full list of what the draft assigns: a set of duties. Report format and content remain undefined.

RBI draft guidance outlining four Risk Management Committee of the Board (RMCB) functions: high-risk model approval, annual tiering review, oversight of exceptions and vendor/AI models, and breach reporting.

The Board Sets Risk Appetite and Approves the MRMF. The RMCB Executes Review Within It

Two bodies, two jobs, both defined at different altitudes.

The Board of Directors sets the institution’s overall risk appetite and approves the Model Risk Management Framework itself. That is a policy-setting function: it establishes the rules the rest of the model risk program operates under.

The RMCB operates within that framework. It approves high-risk model deployments, reviews tiering reports, watches the three standing-oversight categories, and reviews breach reports. It executes the review cadence the Board’s approved MRMF calls for.

Put simply: the Board writes the framework, and the RMCB runs the review inside it. Each function feeds the other. The Board cannot set a meaningful risk appetite without visibility into what the RMCB is finding, and the RMCB cannot review anything without a framework the Board has already approved.

Three Categories Get Standing RMCB Oversight Regardless of Model Tier

A model’s risk tier normally determines how much scrutiny it gets and how often. These three categories break that pattern:

Exception-approved models. Any model deployed outside the normal approval path, by definition, already represents a departure from standard governance. Standing RMCB oversight keeps that exception visible on an ongoing basis rather than treating the initial approval as the end of the review.

Third-party and vendor models. The institution did not build these models, which limits how much of the development process it can directly validate. Standing oversight compensates for that reduced visibility with continuous board-committee attention rather than a one-time onboarding check.

AI models. These models retrain, adapt, and shift behavior over time in ways static regression models do not. A model that passed validation six months ago may have drifted since. Standing oversight treats AI models as a distinct, ongoing watch item rather than something reviewed once at deployment and left alone.

The common thread: each category carries a form of uncertainty that a single tier rating does not fully capture, whether that uncertainty comes from bypassing standard approval, reduced internal visibility, or model behavior that changes after deployment.

Breach and Material-Concern Reporting Is the Closest Thing to an Escalation Trigger, and It Has No Defined Threshold

Separate from standing oversight, RBI’s draft gives the RMCB a review function for reports of breaches and material concerns. This is meant to function as an escalation path: something goes wrong with a model, and it reaches the committee.

The honest gap here is that the draft does not define what qualifies as material. There is no stated performance-degradation percentage, no defined breach severity level, no quantitative or qualitative line separating an issue that stays at the model owner or validation-team level from one that must reach the RMCB.

That ambiguity puts the burden on each institution to define its own threshold and write it into the MRMF, before an actual incident forces the question to be answered under pressure.

What the Draft Leaves to Each Institution’s Own MRMF

Several operational questions remain genuinely open in the draft:

  • RMCB composition and required expertise
  • Meeting frequency beyond the annual tiering-report minimum
  • Prescribed contents of a model risk report
  • Quantitative or qualitative escalation thresholds for breaches and material concerns
  • Delegation protocols for lower-tier model approvals

All of it is deferred to each entity’s own board-approved MRMF.

The decision this creates is whether to build a report standard now or wait for RBI to specify one later. Board members need model literacy now, and a structured report is the mechanism that builds it. Institutions that define their own report standard today will be the ones whose boards can actually ask informed questions about model risk. Institutions that wait will be building that literacy for the first time under regulatory or market pressure, which is the wrong moment to start.

What a Defensible Model Risk Report to the Board Typically Covers

None of the following is prescribed by RBI. This is industry and vendor convention, drawn from established model risk practice. It is worth building anyway, because a board that cannot see these seven things cannot meaningfully exercise the oversight the draft guidance assumes it has.

  • Model inventory summary. Total models in production, counts by tier, and models newly added or retired in the reporting period.
  • Validation status. Validations completed versus overdue, broken out by tier.
  • Risk tier distribution and re-tiering activity. How the inventory is distributed across tiers, and which models moved tiers since the last report.
  • Exceptions and overrides in production. Every model or decision currently running outside standard approval, with the reason and expiry.
  • Remediation status. Open findings with aging, an assigned owner, and a target close date.
  • Third-party and vendor model status. Where each vendor model stands on validation, monitoring, and contractual review.
  • AI/ML models flagged separately. A distinct section for AI models given their retraining and drift behavior, rather than folding them into the general inventory.

For comparison only, the US Federal Reserve and OCC’s SR 11-7 guidance requires a comprehensive model inventory and ongoing monitoring, and it is also not prescriptive about specific board report contents. SR 11-7 does not apply to Indian NBFCs and is referenced here purely as comparative precedent, consistent with how this series has used it previously. Both regimes leave the report format to the institution.

Model risk report checklist for board reporting, covering model inventory, validation status, tier distribution, exceptions, remediation aging, vendor model status, and separate AI/ML model tracking.

How Model Governance Turns These Report Components Into a Standing Board Artifact

Each report component above maps to a specific capability rather than a generic platform claim.

Model inventory produces the inventory summary and the tier distribution. Every model in production is tracked in one place, with tier assignment and re-tiering history attached, so the report’s first two sections come directly from the system of record rather than a manually assembled spreadsheet.

Maker-checker approval produces the exceptions and overrides trail, and the vendor model tracking. Every deployment, override, and exception carries a recorded approval chain, so the report section on what is running outside standard process comes from querying that record directly.

Immutable audit trail produces the auditability of the report itself, and supports the breach and material-concern review the RMCB is assigned. Because every change is logged and cannot be altered after the fact, the board report is defensible under examiner or auditor scrutiny, and any breach investigation has a verifiable record to work from rather than a rebuilt timeline.

Institutions running this governance layer have gone live 97% faster to production, a speed gain that comes directly from not having to manually assemble approval chains and inventory records for every model launch. That same underlying architecture is backed by SOC 2 Type II and ISO 27001 certification, which matters when the board report itself becomes an artifact examiners may ask to see.

What This Looks Like in Production

16 banks and insurers are live on this governance model today, running 200 or more use cases in production across collections, credit decisioning, deposit retention, and fraud detection. Each of those use cases carries its own model inventory record, its own approval chain, and its own audit trail, which is what makes a consolidated RMCB report possible in the first place rather than a manual assembly exercise repeated every quarter.