RBI Governor Sanjay Malhotra has cautioned fintech companies against treating customer data as a monetizable asset, emphasizing that it must be handled as a fiduciary responsibility. As fintech firms grow to a size that impacts the broader financial system, they will face stricter expectations regarding cybersecurity and operational resilience. This shift signals a more cautious regulatory environment for the sector.
At the Global Fintech Fest in Mumbai on September 10, 2026, Reserve Bank of India (RBI) Governor Sanjay Malhotra issued a clear directive to the fintech industry: customer data should be treated as something held in trust, rather than a commodity to be exploited for profit. The Governor warned that companies prioritizing monetization over their responsibility to customers risk undermining the trust that is essential for long-term financial stability.
Scaling Up and Systemic Responsibility
The central bank's message highlights a growing concern regarding the size and influence of modern fintech firms. Governor Malhotra noted that while early-stage startups often face lighter regulatory requirements to foster innovation, the rules must change as these businesses scale. When a company reaches a point where its operational failure could disrupt the broader financial system, it can no longer be viewed as just another private firm.
He suggested that such companies are becoming "too significant to be careless." This implies that as fintechs grow, their responsibilities extend well beyond their own balance sheets to include broader duties, such as ensuring business continuity and maintaining robust cybersecurity standards. This is a crucial shift for investors, as it suggests that compliance and operational costs may rise significantly for larger fintech players, potentially impacting their future profit margins.
AI, Speed, and Concentration Risks
Adding to the regulatory focus, RBI Deputy Governor Rohit Jain pointed out specific systemic risks tied to the integration of advanced technology. He flagged three key concerns: speed, concentration, and opacity. The rapid pace at which AI makes decisions can lead to unintended outcomes, while the reliance on a small number of cloud and technology providers creates a concentration risk—where a failure in one tech provider could trigger widespread disruptions across many financial institutions.
These concerns extend to the potential for AI to introduce bias, exclusion, and errors in judgment during processes like loan underwriting, fraud detection, and customer onboarding. The RBI is signaling that firms must have strong controls in place before these technologies are deployed, rather than fixing problems after they occur.
Regulatory Expectations
The RBI also advised companies against building business models that rely on loopholes or gaps in current regulations, only to seek clarity after they have reached a large scale. The central bank encouraged firms to use regulatory sandboxes—controlled environments where companies can test products under the RBI's supervision—to resolve compliance issues early.
While the industry has seen significant funding and the emergence of many unicorns, the regulatory direction is becoming clearer. The recent recognition of the United Fintech Forum as a self-regulatory organization (SRO) further underscores the industry's need for better internal oversight. Investors should track how fintech firms manage these rising compliance requirements and whether they can balance aggressive growth with the stricter operational resilience standards now expected by the regulator.