“Inherently, model outputs are exposed to uncertainties as they are based on assumptions which may not manifest in the envisaged ways and may take different forms in a real-world scenario,” the RBI said.
“This potentially exposes the regulated entities to model risk, which has implications on prudential aspects of credit risk management, compliance and reputational risk.”
The RBI said a regulated entity will have to draft a board-approved policy for all the risk management model frameworks it uses, including the reason for adopting a third-party model and covering any model’s entire life cycle.
The central bank had recently cautioned non-bank finance companies (NBFCs) against becoming over-reliant on algorithm-based credit models, while also urging them to avoid over-lending in certain segments.
All individual credit model deployment and subsequent changes would be based on the approval of the risk management committee of the entity’s board, the central bank said. Each model should be validated before deployment as well as after any amendments due to material events or periodic reviews, the RBI said. These models, whether built in-house or a third-party one, should be reviewed at least once a year and each entity should set up a vetting, or validation, process that is independent of the process of selecting the model, it added.
“The models deployed by the REs shall be subjected to supervisory review,” the release said, adding that the circular would come into force three months from issuance.