Monitoring must shift from periodic snapshots to continuous awareness: RBI Dy Guv Swaminathan

If banking becomes “always-on”, supervision cannot remain episodic even as the focus shifts from “industry and product” to “pipes and code,” said RBI Deputy Governor Swaminathan J.

In the context where banking is becoming increasingly digital, connected and complex, there is a need for on-site and off-site (supervisory) teams to work more closely, pick up early signals and get quicker follow-up, Swaminathan said at the third annual global conference of the College of Supervisors, RBI, Mumbai.

“SupTech can help regulators identify patterns early, spot anomalies and focus attention where it matters most. But data quality and data management remain critical. With better data quality and the right analytics, regulators can increasingly connect the dots across silos,” he says.

Swaminathan emphasized that surveillance must shift from periodic snapshots to continuous awareness. It also needs to go beyond a single institution and gain a clearer picture of its ecosystem.

“…we need to get rid of the question ‘Have you complied?’ to also ask: “Can you withstand stress, recover quickly and protect customers when something goes wrong?” he said.

He noted that four areas of surveillance focus are becoming central in the digital age: operational resilience and cyber readiness; dependencies on ecosystems and third parties; management of data, models and AI; and technology-enabled, continuous monitoring, including better use of SupTech and analytics.

The deputy governor notes that supervisors have been trained for decades to read balance sheets and inspect processes.

“We still do that. But today, a bank can look perfectly healthy on paper and still be one incident away from a major disruption. The reason for this is that the focus is shifting from the ‘industry and product’ to the ‘pipes and code’. In other words, stability now depends as much on operational resilience, data integrity and third-party dependencies as it does on capital and liquidity,” he said.

Swaminathan reflected on the changing risk landscape in the digital age, noting that both growth and stress can move faster.

“Business acquisition can be exponential, but so can disinformation, panic and attrition. Risks that used to take weeks can now crystallize in hours. This means tightening surveillance feedback loops, with early triggers, faster follow-up and clear escalation,” he said.

The Deputy Governor highlighted the risk of concentration and interdependency, noting that many institutions may rely on the same core service providers, cloud platforms, payment rails, data providers and cybersecurity tools.

“This creates a new form of common exposure. It is not always visible in traditional financial ratios, but it is very real. For supervision, we need to more actively identify dependencies and assess concentration risk at the ecosystem level, and not just at the level of individual institutions,” he said.

Referring to the growing role of algorithms, Swaminathan highlighted that AI and machine learning are making inroads into credit underwriting, fraud detection, customer service, treasury and even internal audit functions. This improves efficiency, but also raises new questions about responsibility, explainability and fairness.

So supervisors need to be able to ask a simple question, and entities need to be able to answer it: Who owns the outcome when a model drives a decision?

The deputy governor warned that digital banking is expanding entry points and the adversary is no longer a random hacker. It is often organized, well-funded and persistent.

“Even if a bank’s internal controls are strong, a weakness in a supplier, a partner or a common technology component can spill over. Resilience and recovery must be treated as core capabilities,” he said.

Referring to bearing risk in a ‘digital wrapper’, Swaminathan said digital lending, integrated financing and platform-based distribution have significantly improved access and convenience.

“But we have also seen risks of mis-selling, opaque charges, aggressive recovery practices and data misuse. In a digital environment, customer harm can quickly become a trust issue, which can quickly turn into a liquidity issue,” he warned.

Published on January 12, 2026