UPI processed about 242 billion transactions worth ₹314 lakh crore in FY2025-26. No bank built that alone. It runs on a rail that public and private banks agreed once, with the competition left to everything built on top. Public sector banks were among its founders, and they are well placed to help do something similar for AI.
How the rails were built
The National Payments Corporation of India was set up in 2008 as an initiative of the Reserve Bank and the Indian Banks' Association, with ten promoter banks. Six were public sector (SBI, PNB, Canara, Bank of Baroda, Union Bank and Bank of India) and four were private or foreign (ICICI Bank, HDFC Bank, Citi and HSBC). UPI was launched in April 2016. The number of banks live on it went from 44 in FY2016-17 to 703 in FY2025-26.
The Account Aggregator framework follows the same logic for data. Sahamati announced on September 2, 2026 that the network had passed 500 million fulfilled consents, with more than 1,100 regulated entities live. AA-enabled lending reached ₹3.82 lakh crore in FY26, about 8.4 percent of retail and MSME lending by value, and in June the RBI recognised Sahamati as the self-regulatory organisation for the network. Nandan Nilekani has asked, in the subhead of a Financial Express op-ed in February, how India can do for AI adoption what UPI did for payments.
What a rail is
A rail is not a shared database or a shared vendor. It is an agreement on the standard every participant must meet, held by a neutral body, with banks keeping their own customers and their own data. Competition moves up a level. Banks do not compete on how a payment is routed. They compete on what the customer does with the app that sends it.
The pattern recurs: a neutral convenor, a common standard, data that stays where it is, and products on top that differ. It is also why banks of every size could take part from the first year.
Bank AI before the rail
Today, AI in banks is built bank by bank. Each of the twelve public sector banks is writing consent logic, model validation procedures, decision logs and test suites, and the lessons of the first mover stay inside its walls. That is a natural stage, and the instinct to share is already visible. The Reserve Bank's Deputy Governor told public sector bank chiefs at PSB Manthan in September 2025 that they should consider "shared technology platforms and joint development of digital infrastructure" to gain economies of scale, lower costs and a more consistent customer experience.
It followed in practice in April. After a meeting with bank chiefs, the RBI, NPCI and CERT-In on the risks of advanced AI, the Finance Minister said banks had been asked to work together under a coordinated mechanism led by the IBA, with the SBI chairman, as IBA head, in the lead. She was careful to say it was not a new committee but an IBA-led process to identify vulnerabilities and review vendor dependencies. Banks were also advised to build a real-time threat-intelligence sharing mechanism with CERT-In. The meeting covered the chiefs of scheduled commercial banks, public and private, which is the right scope, because a rail for AI risk is only as strong as its weakest participant.
It is an early step toward a shared approach to AI risk, and the idea is not new to the IBA. A 2025 report by BCG, FICCI and the IBA, Charting New Frontiers, credited NPCI and the credit bureaus with raising standards across the system and recommended similar shared utilities for areas such as climate finance, fraud detection and cyber monitoring.
→ The evidence side of the same opportunity: EASE 9.0: Showing the Work on AI.
The regulator is already reaching for the pattern
The Reserve Bank's FREE-AI report goes beyond encouragement. It proposes shared AI "landing zones" where smaller institutions could buy compute on a pay-per-use basis, modelled on the cloud that the RBI's IT subsidiary IFTAS provides, and initially drawing on GPUs made available under the IndiaAI Mission. It points to the RBI's Payment Infrastructure Development Fund as a model for incentives, and suggests the RBI may consider an initial corpus of ₹5,000 crore for shared data and compute infrastructure as public goods. It also says that associations such as the IBA could develop a Responsible AI Adoption Score or Index for the financial sector.
These are committee recommendations, not decisions, and the landing zones are aimed at smaller entities rather than the twelve public sector banks. But they show that the regulator already thinks in rails, and that the IBA is one of the bodies it has in mind to convene them.
Why the economics point the same way
The same report found that the banking industry's operating-expense-to-assets ratio had risen by 26 basis points, against the global trend, and that Indian banking would need to grow three to three and a half percentage points faster than nominal GDP to support the national goal for 2047. Neither figure is about duplication, or about public sector banks specifically. But a sector that needs to grow faster while its cost ratio rises has reason to avoid paying twelve times for the same plumbing.
AI adds to the arithmetic. Twelve banks writing the same consent record, decision log and assurance test twelve times is expensive, and the output is twelve slightly different standards that a regulator, a ministry and a customer must each interpret separately.
What belongs on the rail
The test is simple: nobody picks a bank for how it logs consent. Anything a customer would never choose a bank for, and that every bank must get right anyway, is a candidate for the rail. That includes the format of a consent record, the schema of an AI decision log, shared assurance tests and a risk checklist for models, and signals about mule accounts and fraud. The RBI Innovation Hub's MuleHunter.AI already shows the pattern for the last of these.
What stays competitive is everything the customer feels: propositions, journeys, pricing, models trained on the bank's own data, the relationship itself. And customer data is never shared. What banks would share is the standard and the pattern.
Banks never competed on the rail. They competed on what ran on it.
A first step small enough to start
The sensible sequence starts with the least competitive and most reusable item. A common format for a consent record and a common schema for an AI decision log are dull, technical, and useful to everyone. The previous article sketched what one entry in such a log might hold. Two or three volunteer banks could write them against real use cases, publish the result as an open specification, and let the rest adopt it at their own pace. Shared model assurance tests and fraud signals can follow once the first standards have been tried in production.
None of this requires a bank to hand over data, pick a vendor or wait for a mandate. It requires an agreement on what a good record looks like, and a convenor to hold the pen.
What to get right
Shared standards have costs worth planning for. They can be slow to agree, and they can settle on the lowest common denominator. A standard can also exist before it works: observers of the Account Aggregator network note that the share of consents that lead to a successful data fetch can still improve. And a single shared system concentrates risk, which is why the lesson from UPI is open standards, not one shared model that every bank depends on. Governance matters too. Whoever holds the pen decides what gets standardised, and a rail that banks trust will be used.
What to watch
Three signals. Whether the IBA's AI-risk work becomes something banks are expected to meet, or stays guidance. Whether the first reference patterns come from early-mover banks and are published for the rest. And whether the regulator and the Finance Ministry's measurement programme begin to refer to common standards, so that a bank can show it meets one instead of inventing its own.
India has done this more than once in financial infrastructure, and each time the rail came first and the competition came after. Bank AI is another chance. One design choice will matter. As with UPI, the rail for AI should be industry-wide: the IBA's remit covers public and private banks, while EASE measures only the public sector ones. EASE can be one of the places where the standards are adopted and shown. The public sector banks, with their history in NPCI and the scale of their customer base, are among the natural ones to help lead it, alongside their private peers.
Working with Appice on EASE. How Appice works with public sector banks on EASE 9.0, and where it does not. Read more.