S1 - The Opening Brief: 64 Paragraphs in Six Ideas

The Examiner’s Question - RBI’s MRMF 2026, read like evidence.

By Dr. Anandkumar Prakasam

On 24 June 2026 the Reserve Bank of India issued its draft Guidance on Regulatory Principles for Model Risk Management. Sixty four paragraphs. The comment window closed on 24th July, and my own submission is already public on this site. Now the real work begins, because whatever changes at finalisation, the architecture of this document is set, and every regulated entity in India, and every institution elsewhere watching where supervisory practice is heading, needs to understand what it actually demands.

That is what this series does. Over the coming sixteen weeks, The Examiner’s Question will read all sixty four paragraphs the way a forensic examiner reads evidence. Each Monday episode takes a cluster of clauses and asks five things of it. What the clause says. What it operationally demands, which is rarely the same thing. The real, verified incident that shows the cost of not having the control. The way institutions will paper over it. And the pattern that satisfies it. Every episode closes with one question you can put to your own team before Friday, and a running tracker shows which paragraphs are closed and which remain, until the answer is sixty four of sixty four.

Before the clause work starts, here is the whole draft in six ideas.

One - A model is what a model does

The draft defines model by use, not by technology. If a quantitative method informs or drives a decision, it is a model, and the draft itself says a spreadsheet can qualify. This single definition redraws the perimeter of model risk around the decision rather than the artifact, and most institutions have no idea how many things they run that meet the test. The census this forces is the foundation everything else stands on. Episode one opens here.

Two - Accountability runs to the top, and it is for outcomes

The Board approves the framework and a model risk appetite. The risk committee of the Board gets a named working agenda. And the entity is accountable for the outcomes of its models, not for the diligence of its processes. Outcomes - The word does the work of a whole enforcement philosophy, and the institutions that read it early will build very different reporting chains from the ones that read it after their first breach.

Three - The tier prices everything, and nothing offsets

Every model gets a risk tier weighing materiality, complexity and explainability, and the factors may not offset each other into a comfortable average. The tier then drives validation depth, approval level, monitoring intensity and documentation. Tiering is where frameworks will quietly succeed or quietly fail, because a mis-tiered model makes every downstream control wrong in proportion, defensibly, on paper.

Four - The lifecycle now has a memory

Rationale before development. Assumptions recorded at birth. Approval as a bounded, documented act. Change controlled, logged and impact-assessed, with material change triggering revalidation. And an inventory that holds every model, including dead ones, for at least ten years. The draft is quietly specifying institutional memory, and records that must answer questions a decade out are a different engineering problem from records that satisfy this year’s audit.

Five - Buying a model is not outsourcing its risk

Third party models get the full framework, the entity’s own validation regardless of vendor assurance, contractual audit rights, due diligence, concentration awareness and usage limits where vendors disclose too little. The vendor shield is gone. Whatever a provider accepted on your behalf, disclosed or not, was yours from the day you deployed it.

Six - AI is governed as behaviour, with a human in command

The AI chapter adds reliance and autonomy to tiering, demands behavioural testing including red teaming, controls for silent provider updates, documentation built for traceability and audit, and human oversight with real machinery, override, suspension, deactivation, a kill switch, and measured attention to automation bias. The chapter’s premise is the one the incident record supports. AI fails as behaviour, not just as statistics, and oversight fails as psychology, not just as structure.

Six ideas, sixty four paragraphs, sixteen weeks. The first episode lands next Monday, and it starts where the draft starts, with a spreadsheet that became a model and cost a government a franchise competition.

One housekeeping note. This series comments on a draft under consultation. Paragraph numbers may shift at finalisation, and when the final Guidance lands, every episode gets a same-week reconciliation, which is a promise the tracker will hold me to.

The question the series will keep asking, in sixty four variations, is the question every examiner eventually asks. Not whether you have the document. Whether you can prove the control behind it exists.

The annotated submission is already live in the Research Publications tab. Episode 1 - The Spreadsheet That Became a Model, publishes next Monday on 07-September, 2026.

Commentary on a draft under consultation, not legal advice. Paragraph numbers may change at finalisation.