RBI Governor Sanjay Malhotra addressed the Global Fintech Fest 2026 in Mumbai with a clear warning for the fintech industry. He told companies to stop looking for gaps in the law to grow their business. The Governor stated that firms should not follow a 'scale first and ask for forgiveness later' strategy. Instead, he urged them to use the RBI’s 'sandbox' (a controlled environment for testing new products) to work with the regulator from the start.

The Governor explained that the RBI prefers 'light-touch' regulation for small, new ideas to avoid stopping innovation. However, once a fintech company grows large in terms of lending or payments, it becomes a 'systemic risk' (a risk that could hurt the entire financial system). He said these large firms have a duty to be 'too significant to be careless.' This means they must invest heavily in cybersecurity and business continuity to protect the banking industry.

A major part of the speech focused on data privacy. Governor Malhotra told fintechs to treat customer data as a 'fiduciary responsibility' (a legal duty to act in someone else's best interest). He said data is not just a business asset to be sold or used for profit. Companies must act as trustees for their customers, collecting only what is needed and using it only with clear consent.

The Governor highlighted the Account Aggregator framework as a good example of how data should be handled. This system allows for consent-based data sharing without the middleman seeing the actual details. He warned that if a firm treats data as something to be monetized first and a responsibility second, it will lose customer trust. Once that trust is gone, it is very hard for a financial brand to get it back.

For Indian bank officers, this means the RBI will likely increase supervision on fintech partners. The regulator is worried about 'opacity' (lack of transparency) and 'bias' in AI models used for lending. Bankers should ensure that any fintech they collaborate with follows the 'trustee' model of data handling. The RBI expects firms to focus on customers who are not yet in the banking system, rather than just competing for the same urban, credit-visible users.

Looking ahead, fintechs and their banking partners should expect the RBI to step in more quickly as they grow. The Governor made it clear that 'regulatory goodwill' is earned through transparency. Firms that try to outrun the rules will eventually be caught, and the cost of non-compliance will be much higher than the cost of following the rules from day one.