The rapid digital transformation of India’s banking and financial services sector has fundamentally changed the nature, complexity and interconnectedness of financial risks. Banks, Non-Banking Financial Companies (NBFCs), financial institutions and other regulated entities increasingly depend on third-party service providers, cloud infrastructure, digital platforms, cybersecurity systems, Artificial Intelligence (AI), Machine Learning (ML) and automated decision-making models to conduct critical business operations.
While these developments improve operational efficiency, customer experience and decision-making capabilities, they also introduce significant exposures involving outsourcing failures, vendor concentration, cyberattacks, data breaches, technology disruptions, algorithmic bias, model inaccuracies and inadequate governance. A failure in one area can quickly affect others, making integrated risk management an essential institutional capability.
Recognising these emerging challenges, the Reserve Bank of India (RBI) has continued to strengthen its regulatory and supervisory expectations across three interconnected areas.
1. Third-Party Risk Management and Outsourcing
Financial institutions increasingly outsource critical functions, including IT operations, payment processing, customer servicing, cloud hosting and technology support. Such dependencies create operational, cybersecurity, concentration, contractual, compliance and business continuity risks.
RBI’s Managing Risks in Outsourcing Directions, 2025 underline the importance of governance, risk-based due diligence, effective contractual safeguards, ongoing vendor oversight and institutional accountability for outsourced activities.
2. Cybersecurity and Technology Risk Management
As digital banking ecosystems expand through mobile applications, APIs, cloud platforms and interconnected financial infrastructure, cybersecurity has become a critical component of operational resilience.
RBI’s cybersecurity and technology risk regulatory initiatives emphasise stronger governance, effective risk identification, access controls, data protection, incident management, technology resilience and management oversight. Financial institutions must increasingly demonstrate that cyber risks are being managed through established policies, controls, escalation mechanisms and reporting structures.
3. AI and Model Risk Management
Artificial Intelligence and Machine Learning are increasingly used for credit assessment, fraud detection, product pricing, customer analytics, risk forecasting and automated financial decisions. However, poorly designed, inadequately validated or insufficiently monitored AI models can produce inaccurate, biased, opaque or unreliable outcomes.
In August 2025, RBI released its Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI), followed by draft regulatory guidance on Model Risk Management in June 2026. These developments highlight the growing importance of accountability, fairness, transparency, data privacy, reliability, human oversight and lifecycle governance for AI-driven financial systems.
The draft guidance also brings attention to third-party AI models, model documentation, validation, monitoring, escalation and appropriate mechanisms for intervention when models behave unexpectedly. As the guidance remains a draft, its proposed measures should be distinguished from final binding requirements.
Together, these three risk domains represent a significant shift towards integrated technology, operational and AI risk governance. Institutions need professionals who understand not only the individual risk frameworks but also how vendor dependencies, cyber vulnerabilities and AI model failures can interact and create wider enterprise-level exposures.
To address these professional development needs, the Risk Management Association of India (RMAI), through its eLearning platform Smart Online Course, offers the Certificate Course in Third-Party, Cyber & AI Risk Management.
This comprehensive 30-hour programme brings together four specialised courses across three integrated learning areas. It is designed to equip banking, financial services, risk management, compliance, internal audit, technology and governance professionals with practical frameworks and methodologies to identify, assess, mitigate, monitor and report emerging risks.
The programme combines third-party and vendor risk management, cybersecurity governance, technology risk oversight, responsible AI frameworks and AI-specific risk management. It draws on practical scenarios, recognised industry standards and evolving regulatory expectations to help learners strengthen institutional resilience and risk governance capabilities.
Objective
The objective of this certification programme is to develop an integrated understanding of three increasingly interconnected risk disciplines: Third-Party Risk Management, Cybersecurity and Technology Risk Management, and AI Model Risk Management.
Upon completion, participants should be better equipped to:
- Identify and evaluate operational, financial, cybersecurity, contractual and compliance risks arising from outsourced activities and third-party relationships.
- Apply structured vendor due diligence, risk assessment, contractual mitigation, performance monitoring and exit planning methodologies.
- Understand cybersecurity and technology risk governance within banking and financial services institutions.
- Assess cyber exposures associated with digital platforms, cloud infrastructure, APIs, access controls and data privacy.
- Understand the NIST AI Risk Management Framework and its GOVERN, MAP, MEASURE and MANAGE functions.
- Recognise AI-related risks including bias, lack of explainability, model failure, adversarial manipulation and data security vulnerabilities.
- Understand emerging RBI expectations concerning outsourcing oversight, cyber resilience, responsible AI and model risk governance.
- Strengthen the practical application of risk identification, assessment, mitigation, monitoring, incident escalation and governance reporting.
Programme Structure
The programme consists of three specialised learning areas delivered through four courses.
| Learning area | Course | Duration |
| Third-Party Risk | Third Party Vendor Risk Management | 6 Hours |
| Cyber & Technology Risk | Cyber Security in Banking | 7 Hours |
| AI & Model Risk | Responsible AI Risk Management using NIST AI Framework | 9 Hours |
| AI & Model Risk | Risk Management for Artificial Intelligence | 8 Hours |
| Total | 4 Courses | 30 Hours |
Mode: Self-paced online learning Access Validity: 120 Days Learning Approach: Structured video learning, risk frameworks, practical scenarios and case studies
Course 1: Third Party Vendor Risk Management
Duration: 6 Hours | Mode: Self-Paced Online
Modern organisations increasingly rely on third-party vendors for essential operational, technological and business functions. These relationships can create significant risks involving service disruption, information security, regulatory non-compliance, contractual failures and business continuity.
This course provides a comprehensive understanding of third-party and vendor risk management across the complete vendor relationship lifecycle, from initial risk assessment and due diligence through contract negotiation, ongoing monitoring, incident management and exit planning.
Participants learn how to assess vendor dependencies, strengthen contractual protections, develop risk-based monitoring approaches and support operational resilience.
Modules
1. Understanding Third-Party & Vendor Risks: Introduction to external dependencies and the operational, financial, regulatory and cybersecurity exposures associated with vendors.
2. Vendor Risk Assessment & Due Diligence: Understanding vendor evaluation methods, risk assessment frameworks, due diligence requirements and risk-based vendor selection.
3. Contractual Risk Mitigation: Examining contractual safeguards, accountability, service obligations and mechanisms for managing third-party exposures.
4. Ongoing Vendor Monitoring & Performance Management: Understanding vendor performance oversight, periodic reviews, risk monitoring and the management of changing vendor risk profiles.
5. Cybersecurity & Data Protection in Vendor Ecosystems: Identifying information security, data protection and technology risks introduced by external service providers.
6. Business Continuity, Exit Strategy & Regulatory Compliance: Understanding contingency planning, vendor exit preparedness, continuity arrangements and compliance responsibilities.
Learning Outcome: Participants will develop practical knowledge of vendor risk assessment, due diligence, contractual risk mitigation, vendor performance oversight and business continuity planning.
Course 2: Cyber Security in Banking
Duration: 7 Hours | Mode: Self-Paced Online
The increasing digitalisation of banking services has made cybersecurity and technology risk management essential for protecting financial systems, customer information and institutional trust.
Banks now operate through interconnected digital infrastructures involving payment systems, cloud services, APIs, technology vendors and customer-facing platforms. These environments require strong governance arrangements to manage cyber threats, technology dependencies, access-control weaknesses, data privacy concerns and operational disruptions.
This course focuses on the governance and management of cybersecurity risks within banks and financial institutions, enabling professionals to understand cybersecurity from an organisational risk and supervisory perspective.
Modules
1. Technology Risk Landscape & Governance Responsibility: Understanding the technology risk environment in banking, governance structures, institutional accountability and oversight responsibilities.
2. Vendor, Cloud & API Risk Oversight: Identifying cybersecurity exposures arising from third-party technology providers, cloud environments, digital integrations and API dependencies.
3. Access Control & Data Privacy Governance: Understanding access management, information security responsibilities, sensitive data protection and privacy-related governance.
4. Incident Response & Escalation Governance Model: Examining approaches for incident detection, response coordination, escalation, institutional reporting and risk mitigation.
5. Board Reporting & Cyber Risk Transparency: Understanding how cyber risks can be communicated to senior management and boards through structured governance reporting and risk oversight.
Learning Outcome: Participants will strengthen their understanding of cyber risk governance, technology risk assessment, cloud and vendor oversight, data protection, incident escalation and board-level cybersecurity reporting.
Course 3: Responsible AI Risk Management using NIST AI Framework
Duration: 9 Hours | Mode: Self-Paced Online
The expanding adoption of Artificial Intelligence has created an urgent need for structured governance frameworks that help organisations develop, deploy and manage AI systems responsibly.
The National Institute of Standards and Technology (NIST) AI Risk Management Framework provides a globally recognised, voluntary framework for identifying, assessing, managing and governing risks associated with AI technologies.
This course introduces participants to the NIST AI RMF and its four core functions—GOVERN, MAP, MEASURE and MANAGE. It explains how organisations can understand AI use cases, establish appropriate governance arrangements, evaluate model-related risks and implement proportionate risk responses.
Modules
1. Introduction to Responsible AI and NIST AI RMF: Understanding responsible AI principles, the objectives of AI risk management and the role of the NIST framework.
2. Core Structure of NIST AI RMF: Examining the framework’s key components, functions and integrated risk management approach.
3. MAP Function – Risk Context and AI Use Understanding: Understanding AI system context, intended use, stakeholder considerations and risk identification.
4. MEASURE Function – Assessing and Quantifying AI Risk: Exploring methods for evaluating AI system performance, reliability, fairness and other risk characteristics.
5. MANAGE Function – Mitigating and Responding to AI Risks: Understanding approaches for prioritising, treating, monitoring and responding to identified AI risks.
6. GOVERN Function – Oversight, Policy and Global Standards: Examining the governance structures, policies, responsibilities and oversight practices supporting responsible AI implementation.
7. Industry Use Cases of NIST AI RMF: Exploring the application of AI risk management concepts through industry-oriented scenarios.
8. Toolkits, Glossary and Downloadable Resources: Supporting practical understanding through reference materials and supplementary learning resources.
Learning Outcome: Participants will gain an understanding of how to apply the NIST AI RMF to AI governance, risk identification, assessment, monitoring and management.
Course 4: Risk Management for Artificial Intelligence
Duration: 8 Hours | Mode: Self-Paced Online
Artificial Intelligence introduces a distinct set of risks that extend beyond traditional information technology and operational risk management.
AI systems can generate inaccurate outputs, perpetuate algorithmic bias, expose sensitive information, operate without sufficient transparency, become vulnerable to adversarial attacks or create excessive reliance on automated decisions.
Within banking and financial services, these risks have particular significance because AI models can influence credit decisions, fraud detection, customer interactions, underwriting, financial forecasting and other sensitive activities.
This course examines the practical risk landscape of AI, combining technical, operational, ethical, regulatory and governance considerations.
Modules
1. Understanding AI Risks in Organisations: Identifying operational, strategic, ethical and governance risks associated with AI adoption.
2. Global AI Regulations and Standards: Understanding international developments in AI governance, responsible AI principles and emerging regulatory approaches.
3. Bias, Fairness and Explainability: Examining algorithmic discrimination, fairness considerations, model transparency and the challenges of interpreting AI-generated decisions.
4. Data Security, Privacy and Piracy Threats: Understanding information security exposures, data protection concerns, intellectual property risks and threats to AI systems.
5. Adversarial and Systemic AI Risks: Exploring manipulation, malicious interference, model vulnerabilities and broader risks arising from interconnected or large-scale AI adoption.
6. AI in BFSI and Insurance – Risks and Controls: Understanding AI applications and associated controls across banking, financial services and insurance operations.
7. AI Governance, Audit and Best Practices: Examining governance responsibilities, risk oversight, review processes and approaches to assurance.
8. Future Challenges and Failures in AI: Understanding evolving AI risk scenarios, emerging threats and lessons from AI-related failures.
Learning Outcome: Participants will be able to identify major categories of AI risk, understand relevant governance approaches and evaluate risk management considerations associated with organisational AI applications.
Who Should Enroll?
This programme is designed for professionals involved in risk management, regulatory compliance, technology governance, internal control and operational resilience, particularly within banks, NBFCs and other financial institutions.
It is particularly relevant for:
- Risk Management Professionals: Enterprise Risk Management, Operational Risk, Third-Party Risk, Technology Risk and Model Risk teams.
- Banking and NBFC Professionals: Individuals responsible for digital banking operations, outsourcing arrangements, risk oversight and regulatory compliance.
- Compliance and Regulatory Affairs Professionals: Professionals monitoring evolving RBI requirements and strengthening institutional compliance frameworks.
- Internal Auditors: Professionals assessing vendor controls, cybersecurity governance, technology risks and AI-related control environments.
- IT and Cybersecurity Professionals: Individuals responsible for technology governance, information security, data protection, cloud risks and cyber resilience.
- AI, Analytics and Model Governance Professionals: Professionals working with AI applications, automated decision systems, model oversight and responsible AI implementation.
- Vendor Management and Procurement Teams: Professionals responsible for vendor selection, contracting, due diligence, performance monitoring and third-party relationships.
- Senior Management and Governance Professionals: Executives overseeing operational resilience, risk management and emerging technology risks.
Key Benefits of the Programme
1. Integrated Coverage of Three Critical Risk Domains
The programme combines third-party risk, cybersecurity and AI risk management into one structured learning pathway, helping professionals understand the interconnected nature of emerging financial-sector risks.
2. Alignment with Evolving Regulatory Expectations
Participants develop awareness of RBI’s regulatory direction concerning outsourcing, cybersecurity, technology governance and responsible AI, alongside relevant internationally recognised frameworks.
3. Practical, Application-Oriented Learning
The courses include practical scenarios, structured methodologies, industry-oriented examples and case-study-based learning to strengthen the application of risk management principles.
4. Professional Capability Development
The programme develops knowledge relevant to risk assessment, vendor oversight, cyber governance, responsible AI, internal audit, regulatory compliance and enterprise risk management.
5. Flexible Learning for Working Professionals
All four courses are delivered online through a self-paced learning format, with 30 hours of learning content and a 120-day access period.
Certification and Assessment
Upon successful completion of the programme and assessment, participants will receive Dual Certification under the combined Certificate Course in Third-Party, Cyber & AI Risk Management.
The dual certification will comprise:
1. Certificate of Completion jointly issued by the Risk Management Association of India (RMAI) and Smart Online Course.
2. Certification from the BFSI Sector Skill Council of India (BFSI SSC).
The programme will include a remote-proctored online assessment, allowing participants to appear for the examination from their own location under supervised examination conditions. This dual certification will provide formal recognition of participants’ learning and assessment across three important areas of risk management in the banking and financial services sector.
Enrolment in Individual Programs
Participants may enrol in any of the following three specialised programmes independently:
1. Third-Party & Vendor Risk Management (6 Hours)
Focused on outsourcing risks, vendor due diligence, contractual safeguards, ongoing monitoring, regulatory compliance and business continuity.
2. Cyber Security & Technology Risk Management (7 Hours)
Focused on cybersecurity governance, technology risk oversight, vendor and cloud security, access controls, data protection, incident response and board-level reporting.
3. AI & Model Risk Management (17 Hours)
Comprising two complementary courses, Responsible AI Risk Management using NIST AI Framework and Risk Management for Artificial Intelligence—covering responsible AI governance, NIST AI RMF, model-related risks, fairness, explainability, data security and AI risk controls.
Alternatively, participants can opt for the comprehensive 30-hour Certificate Course in Third-Party, Cyber & AI Risk Management, which integrates all three specialisations into a single structured programme.
The comprehensive programme is particularly suitable for Enterprise Risk Management professionals, senior risk executives, internal auditors, compliance officers and individuals seeking a broader understanding of interconnected operational, technology and emerging AI risks.
Participants can therefore choose one specialised programme based on their functional responsibilities or complete all three to develop an integrated perspective on risk governance.
About the Organisation
Risk Management Association of India (RMAI)
The Risk Management Association of India is a professional body dedicated to advancing research, education, professional development and best practices in risk management. Through its training initiatives, publications, conferences and industry engagement activities, RMAI supports the development of risk management capabilities across financial institutions and other sectors.
Smart Online Course
Smart Online Course is a professional learning and capability-building platform specialising in Banking, Insurance, Risk Management, and AI & Technology. As the training arm of RMAI, it provides structured, industry-oriented learning designed to help professionals develop practical knowledge and role-relevant competencies.
Programme at a Glance
| Particular | Details |
| Programme Name | Certificate Course in Third-Party, Cyber & AI Risk Management |
| Specialised Learning Areas | 3 |
| Courses Included | 4 |
| Total Duration | 30 Hours |
| Learning Mode | Self-Paced Online |
| Access Validity | 120 Days |
| Primary Audience | Banking, NBFC, Risk, Compliance, Audit, IT and AI Professionals |
| Learning Approach | Practical and Case-Study-Based |
| Certification | Subject to confirmation for the combined programme |
Enrolment: The programme can be positioned as a single learning pathway for professionals seeking to strengthen their understanding of outsourcing risk, cyber resilience and responsible AI governance.
