Fintechs and financial institutions must treat data as a fiduciary responsibility and not as business assets, Reserve Bank of India Governor Sanjay Malhotra said.

In his keynote address at the Global Fintech Fest 2026,  Malhotra said trust was central to success in the financial system and data should be used strictly within the consent provided by users.

“Every fintech in this room holds something more valuable than capital and that is the data – financial and non-financial – of real people. This data must be treated the way a trustee treats assets held for a beneficiary: collected with clear purpose, used strictly within the consent given, and protected as though it were one’s own,” he said.

Malhotra noted that the Account Aggregator framework was built precisely to formalise consent-based, purpose-limited data sharing, so that no single entity, including the aggregator itself, can see or exploit the underlying data. 

The Governor urged every fintech to internalise this architecture as a value, rather than merely comply with it as a rule. Where a firm treats customer data as a monetisable asset first and a responsibility second, trust erodes and once it does, it does not return easily, he said.

Malhotra emphasized on the risks related to bias, exclusion, cybersecurity, data privacy and erosion of human judgement, among others, while adopting artificial intelligence (AI). 

Financial institutions must take systemic responsibility that scales with size, Malhotra remarked. Many fintechs may be outside the perimeter of prudential regulation - and rightly so, since proportionate regulation should not burden early-stage innovation. 

But as a firm’s payment volumes, lending book, or user base grows to a point where its disruption could meaningfully affect the financial system, that firm acquires a responsibility that goes beyond its balance sheet or its shareholders. 

“I would describe this as the obligation to be not just “too big to fail” but “too significant to be careless.” Operational resilience, business continuity, and cybersecurity are not burdens to be minimised; they are the price of the scale a firm has achieved,” the Governor said.

He cautioned fintechs against a mindset of structuring a business around the gaps between regulatory categories, or of scaling first and seeking clarity or forgiveness later.

“The sandbox and pilot mechanisms we have built exist precisely so that innovators can engage with us early, test assumptions under supervision, and shape rules that are workable for genuine innovation.  A firm that engages transparently not only earns regulatory goodwill but also gains faster, more durable pathways to scale,” he said.

He pointed out that firms which seek to outrun the rules realise that the rules catch up at a much price to themselves and to the trust of consumers.

India’s fintech ecosystem ranks third globally by funding, having attracted $2.4 billion in 2025, and is home to 30 fintech unicorns, Malhotra highlighted. 

Fintech companies, which spent the first decade largely building for India, have an opportunity in the next decade to build for the world. 

“Many emerging economies face challenges similar to those we face in India. “Our solutions for financial inclusion, affordable payments, digital identity, interoperable infrastructure and trusted innovation can be appropriately repurposed for wider global adoption. Our greatest contribution will therefore lie in exporting products, sharing approaches, public digital infrastructure, governance frameworks and institutional experience,” he said.