RBI Governor Sanjay Malhotra Tells Fintechs to Treat Customer Data as ‘Fiduciary Responsibility’

Reserve Bank of India (RBI) Governor Sanjay Malhotra has called on India’s rapidly expanding fintech ecosystem to treat customer data as a “fiduciary responsibility” rather than a business asset, warning that companies that prioritise monetising personal information over protecting it risk eroding the consumer trust on which digital finance depends.

Addressing the Global Fintech Fest 2026, Malhotra said every fintech company holds personal data belonging to real people and must handle it like a trustee managing assets for a beneficiary. Data, he said, should be collected for a clear purpose, used strictly within the consent provided and protected as carefully as the firm’s own assets. He warned that when customer data is treated primarily as a monetisable asset, trust erodes and can be difficult to rebuild.

The Governor’s remarks come as data increasingly drives fintech services including digital lending, payments, fraud detection and personalised financial products. India’s Account Aggregator framework already promotes consent-based sharing of financial information between regulated institutions, while the RBI’s Digital Lending Directions, 2025 strengthened requirements around responsible lending and consumer protection.

Malhotra also cautioned fintechs against structuring businesses around regulatory gaps or adopting a “scale first, seek clarity later” approach. He pointed to the RBI’s regulatory sandbox and pilot mechanisms as avenues for testing innovations while engaging regulators transparently. Firms that work with authorities, he said, can gain regulatory goodwill and more durable routes to scale, while attempts to outrun regulation could ultimately carry higher costs and damage customer trust.

He stressed that responsibilities must rise with a fintech’s scale. Although fintechs are kept outside full prudential regulation to avoid burdening early-stage innovation, companies whose payment volumes, lending books or user bases become significant enough to affect the financial system must strengthen operational resilience, business continuity and cybersecurity. Malhotra described the obligation as being not merely “too big to fail” but “too significant to be careless.”

The Governor also flagged risks from artificial intelligence, including opacity, bias and exclusion, concentration and herding, cybersecurity, data privacy and security, and the erosion of human judgment.

At the event, Malhotra announced RBI approval for the Unified Fintech Forum (UFF) as the sector’s second self-regulatory organisation, following the recognition of the Fintech Association for Consumer Empowerment.

The push comes as India’s digital finance ecosystem operates at unprecedented scale. UPI processed 24.51 billion transactions worth ₹29.82 trillion in August 2026, while fintech growth is increasingly expanding into small-ticket credit, savings, insurance and pensions for underserved consumers.

Malhotra’s message is ultimately broader than data privacy: as fintech becomes more deeply embedded in India’s financial system, innovation must be matched by trust, accountability and resilience.