Speaking at the fifth Kautilya Economic Conclave on 3 October 2026, Reserve Bank of India Governor Sanjay Malhotra delivered a message that is easy to quote and harder to act on: “today’s resilience may not necessarily imply tomorrow’s immunity.” As reported by Business Standard and Business Today, he also said the next financial crisis may not necessarily originate in a bank or even within the financial system.
Our Crest.Digital News Bite covers the speech in a few minutes. Watch it below, then read on for what the warning means for risk, finance and audit teams.
A note on sources: press coverage of the speech differs slightly in which risks it emphasises, and the full text of the remarks sits on the RBI’s own channels at rbi.org.in. This article reflects the reporting available at the time of writing, and readers should rely on the Governor’s published remarks for exact wording.
Crest.Digital’s Agentic GRC builds configurable AI agents for continuous controls monitoring, evidence collection and remediation tracking, with human-in-the-loop review and an audit trail on every action.
Explore Agentic GRCWhat the Governor Actually Said
The reported themes were consistent even where emphasis differed. Global public debt has risen and bond yields have hardened. Valuations across the AI investment value chain look stretched, and a slowdown in earnings could trigger sharp repricing of financial assets. Long periods of stability, he noted, can themselves encourage risk-taking and leverage. Cyberattacks and technology failures sit alongside these as sources of disruption that are, in his words as reported, exogenous, cross-border and interconnected.
The domestic picture he painted was reassuring. Reports cite banks holding comfortable capital under adverse scenarios, NBFCs with average capital adequacy of about 24.6% against a 15% requirement as of 31 March 2026, orderly equity market corrections, and June 2026 stress tests that confirmed resilience. On private credit, coverage suggests he judged the domestic segment to be relatively small and not a current risk, while still listing it among the areas to watch. No new policy measures were announced.
Five Risks, Five Questions for Your Next Risk Committee
A regulator’s list is most useful when it becomes a set of questions your own organisation can answer. The list below translates each theme into something a CRO, CFO or Chief Audit Executive can test.
The Risk Themes and What to Ask
- Elevated global debt: How sensitive are our funding costs, portfolio valuations and counterparties to a further rise in yields, and do our limits reflect it?
- Stretched AI-linked valuations: Where are we exposed, directly or through collateral, clients and suppliers, to a repricing in AI-related assets?
- Leverage built in calm periods: Which exposures have grown quietly while conditions were benign, and when were their assumptions last challenged?
- Private credit: What non-bank funding, fund or lending relationships do we rely on, and how transparent is their underlying risk?
- Cyber and technology failure: Which critical processes depend on a provider whose outage or compromise would stop us, and have we tested recovery?
If any of those questions takes weeks to answer, that is itself the finding. The gap between a strong reported position and a slow-to-answer risk question is where surprises hide.
Why Strength Today Is Not Immunity
Capital ratios and stress tests are essential, and the reported results are good news. But they describe known shocks at a point in time. The Governor’s argument is that the next one may arrive through a door nobody is watching: a technology failure, a cyber event at a shared provider, or a valuation correction in a market far from banking. When stability lasts, memory of past crises fades and leverage creeps up, so the same calm that supports confidence can erode the margin for error.
For enterprises outside banking the lesson is the same. A healthy balance sheet does not protect a manufacturer from a supplier’s ransomware attack or a pharma company from a data provider’s outage. Resilience is a property of the whole network of dependencies, not only of the institution at its centre.
The Common Thread: Interconnection Through Third Parties
Look across the list and a pattern emerges. Cyber threats often enter through vendors. AI valuation risk reaches a business through the AI providers it depends on, a concentration issue we explored in AI as a new category of critical third party. Leverage and private credit sit in counterparty relationships. Technology failures usually trace to a provider, a platform or a change nobody tested.
That is why the response to this warning belongs partly in third-party risk management. Continuous monitoring of critical providers, concentration analysis and tested exit plans turn invisible dependence into a managed exposure. For regulated entities in India the link is explicit, and our pieces on continuous vendor monitoring for BFSI in India and operational resilience and TPRM set out how to build it. On the financial side, cyber risk quantification and vendor financial impact shows how to express these exposures in terms a CFO can use.
From Annual Resilience to a Continuous Monitoring Cadence
Stress tests run periodically, but risks move daily. The practical answer is to add a continuous layer between tests, built from six steps that work for a bank, an NBFC or a global enterprise.
Name the Risks
List the stability risks that matter to your institution, for example global debt and yields, AI-linked valuations, leverage, private credit and cyber or technology failure, and tie each to concrete exposures.
Assign Owners
Give every risk a named executive owner and a second-line reviewer so that nothing sits between functions.
Set Early-Warning Indicators
Choose a small set of indicators per risk, such as concentration levels, counterparty leverage, valuation-sensitive exposures or vendor incident signals, with thresholds that trigger review.
Collect Evidence Continuously
Replace point-in-time evidence with scheduled collection, so that control status and exposure data are never months old when a shock arrives.
Run Scenarios Beyond Finance
Include shocks that originate outside the financial system, such as a provider outage or a cyber event, and trace their impact through critical third parties.
Escalate and Remediate
Route breaches of thresholds to the right owner, track remediation to closure and report coverage and open issues to the board or risk committee.
This is where agentic AI earns its place. Collecting evidence, watching indicators against thresholds, comparing exposures to limits and chasing remediation are repetitive tasks that agents handle well, freeing people for judgement. Agents should never set risk appetite or certify their own controls, and every action needs a log. Our article on why AI agents need audit trails explains that discipline, and why an AI policy is not an internal control until someone tests it shows how internal audit can verify it. For the audit profession’s own guidance on risk and control assurance, see the Institute of Internal Auditors.
Crest.Digital’s platform gives banks, NBFCs and global enterprises continuous third-party intelligence, AI-assisted due diligence and evidence capture in one place. See the industries we cover.
Five Moves for Boards, CROs, CFOs and Internal Audit
A Short Playbook for the Next Quarter
- Boards: Ask management to show how each named risk maps to your exposures, and how quickly the answer updates.
- CROs: Add scenarios that start outside finance, such as a provider outage or cyber event, to the stress-testing agenda.
- CFOs: Quantify sensitivity to yields, valuations and counterparty leverage, and link it to liquidity and capital planning.
- Internal audit: Test whether monitoring operates between cycles, with fresh evidence, and report coverage to the audit committee.
- Everyone: Treat third-party and technology dependence as part of financial resilience, not a separate IT topic.
A closing note on proportion. The Governor’s remarks were a call for vigilance, not an alarm, and reports describe the Indian system as strong. The point is to keep it that way by testing assumptions while conditions are calm. For how organisations measure the impact of this kind of programme, see our business impact page and the overview of end-to-end vendor risk governance.
Your Turn: Which Risk Is Most Underestimated Today?
- Cyber: Attacks on shared providers that stop many firms at once.
- Private credit: Opaque non-bank lending and funding links.
- AI valuations: A repricing that spreads through collateral and clients.
- Geopolitical shocks: Conflict that disrupts commodities, supply chains and funding.
Tell us which you think is most underestimated, and why, in the comments when you share this article on LinkedIn.
Crest Perspective
Banking regulators globally have moved from principles-based guidance to prescriptive expectations on third-party risk. DORA in Europe, OSFI B-10 in Canada, the 2023 US Interagency Guidance, and the RBI Master Directions each specify what a board-level third-party risk programme must contain. For regulated institutions, the question is no longer whether to have a TPRM programme but whether the programme’s documentation is sufficient to withstand a regulatory examination.
Frequently Asked Questions
Speaking at the fifth Kautilya Economic Conclave on 3 October 2026, RBI Governor Sanjay Malhotra said that today’s resilience may not necessarily imply tomorrow’s immunity. Coverage of the speech describes a set of emerging stability risks that includes elevated global debt, stretched valuations linked to AI, leverage that builds during long periods of calm, private credit, and cyber and technology failures. He also said the next financial crisis may not originate in a bank or even within the financial system. Reports note that he described India’s banks and NBFCs as well capitalised and that no specific new policy actions were announced in the remarks.
The central argument is that long periods of stability can themselves encourage risk-taking and leverage, and that new risks tend to be external, cross-border and interconnected rather than rooted in a single institution’s balance sheet. Capital ratios and stress tests measure known shocks. They are less able to capture shocks that arrive through technology failure, a cyberattack on a shared provider, or a repricing in a market far from banking. The practical conclusion for risk teams is to complement periodic resilience testing with continuous monitoring of the dependencies and signals that sit outside the balance sheet.
Start by mapping each named risk to the specific exposures your organisation has: lending and investment concentrations linked to AI valuations, leverage in counterparties and portfolios, private credit or non-bank funding relationships, and cyber and technology dependence on third parties. Then assign owners, define early-warning indicators and review thresholds, and run scenario analysis that includes shocks originating outside finance. Finally, make sure the evidence behind each control is current rather than annual. Internal audit can then test whether the monitoring operates as designed, not only whether a policy exists.
Financial institutions and large enterprises depend on shared infrastructure: cloud and AI providers, payment and core-banking vendors, data providers and outsourced operations. A failure or compromise at one provider can affect many institutions at once, which is why cyber risk is increasingly treated as a systemic and third-party issue rather than a purely internal one. Continuous third-party monitoring, concentration analysis and tested exit and recovery plans for critical providers help turn that dependence into a managed exposure.
Agents are well suited to continuous, repetitive work: collecting control evidence, watching early-warning indicators, comparing exposures to limits, tracking remediation and drafting summaries for review. Humans remain accountable for setting risk appetite, interpreting ambiguous signals, approving exceptions and deciding what to escalate to the board. Every agent action should be logged so that a reviewer can reconstruct what was monitored, what was flagged and who decided. That combination gives faster signal without giving up accountability.