The capability is here. The path to production can be too.
For the India entities of global financial institutions. Kalmi redesigns the process the AI runs in, builds the controls your parent's model risk policy expects, and operates them here, with evidence your second line can test.
If these sound familiar, the model is not what stalled.
The pilot cleared review in India and stopped at the parent's model risk function. Nobody has said no. Nobody has said yes.
Automation was added to a process nobody redesigned: the same handoffs and exception queues, with an agent inserted between them.
Headquarters chose the platform. Nobody here owns the evidence your second line will ask for.
The controls were described in the approval pack. After go-live, nobody in the center operates them.
Indian personal data runs through the workflow, and nobody has mapped what the DPDP Act requires of it.
The framework you are waiting on may not cover what you built.
Model risk frameworks were written for models whose output a person then uses. An agent acts. In April 2026 the US banking agencies replaced their model risk guidance and left generative and agentic AI to each bank's broader governance. Singapore's regulator will consult in 2027 on further agentic guidance.
Approval now rests on the parent's internal AI policy, often written for predictive models. In that gap, review defaults to no, or to a pilot that never ends.
Four process families where AI has to clear the parent's review.
KYC and AML operations
Alert review, periodic refresh and case preparation, where a wrong call becomes a financial crime finding and every action needs a trail.
Reconciliations
Breaks investigated and cleared across systems, where the value is throughput and the risk is a silent error that reaches a ledger.
Servicing operations
Requests handled for customers the center never meets, under the parent's conduct rules and the data rules of each customer's jurisdiction.
Claims operations
Intake, triage and assessment support for insurer parents, where the decision is a policyholder's money and the record has to survive a dispute.
One process at a time, built to the parent's policy.
Triage and value case
Two to three weeks, starting from the pilots you already have: which to back, which to stop, what approval will need, and the metrics each will be judged on.
Workflow redesign
Roles, decision rights, review thresholds and exception queues set before the tool, with controls specified against the parent's model risk policy.
Deploy
On the platform headquarters chose, or from a disclosed shortlist where it chose none. Integrated, and taken through the parent's approval with the evidence it asks for.
Adoption and change
Procedures, an override policy and incentives for the teams running the process, so the change survives the first quarter after go-live.
Measure and operate
Throughput, rework and override rates against the baseline. Operated here under a support window with exit agreed at the start, or handed to your team.
From the parent's frameworks to what runs here.
A center answers to its parent's policy, and the parent answers to its own supervisors. We map one set of controls across the frameworks parents typically sit under, then to your parent's policy during triage.
An inventory of AI in use, with the materiality of each use case assessed.
MAS AI risk management guidelines, October 2026; the parent's model risk policy.
A register entry for each workflow, tiered on the parent's materiality scale.
A register extract your model risk team can reconcile.
Generative and agentic AI left to each bank's broader governance.
US interagency model risk guidance, April 2026.
Decision rights, review thresholds and a kill path designed into the workflow, so the parent's AI policy has controls to point to.
Every override and stop logged with who acted and why.
Model risk managed in proportion to risk, AI models included.
PRA SS1/23, in force since May 2024.
Performance and drift monitoring built in, with the hand-off to your validation team specified at design.
Model documentation in the format your validators use.
Logging, human oversight and documentation for high-risk uses such as credit scoring.
EU AI Act; standalone high-risk obligations from December 2027.
Logging and documentation to that standard where the workflow serves EU customers.
Technical documentation and logs kept for the period required.
Accountability for AI the institution buys stays with the institution.
The parent's third-party risk policy.
Vendor AI checked against the same policies as your own, from your systems and the vendor's.
One decision record across your systems and the vendor's.
Purpose limits, security safeguards, logs and erasure where Indian personal data is processed.
DPDP Act 2023 and Rules 2025; core obligations from May 2027.
Masking before model calls, and retention and erasure that reach agent memory and embeddings.
Logs held separately from personal data, for at least a year.
Designed to map to these frameworks, not certified against them. Your second line validates what we build.
Built for the way a center is governed.
On the platform headquarters chose
Where the parent set the gateway, models or tools, we redesign and deploy on top of them. Use what you own, buy what the market does well, build only what is specific to the workflow.
Through the parent's onboarding
We go through your parent's third-party risk review, with our current security position stated in full. Deployment stays in your tenancy, under your identity management.
First line, next to your second
We build and operate controls. Your model risk function validates them, wherever it sits. We build so that it can.
No vendor money
We take no resale, referral fees, margin or vendor money. You contract with every vendor directly, from a disclosed shortlist with at least two options per category.
Start with the pilots you already have.
A paid triage, two to three weeks, at a fixed fee. We review the pilots in flight and say which to back, which to stop, and what the parent's approval will need. You keep the output whether or not anything follows: the decisions with reasons, a metric baseline and a value case.
If the parent wants a readiness view first, the same work can start from an inventory of the AI in use and the gaps against its framework.
The first conversation is a diagnosis, not a pitch.
Bring a workflow that should be in production and is not, or a deployment whose numbers did not move. We will tell you what we typically see at that stage, specifically enough that you can confirm it or correct it. If an engagement follows, it starts with a paid, fixed-fee triage. We do not run free assessments.
Replies come from Sudip, usually within a working day.