IIBF Emerging Technologies key terms

The redesign of a financial institution's products, processes and culture around digital technology so that services are delivered faster, cheaper and with better customer experience rather than simply automating existing paper workflows.

The central ledger and processing platform that holds customer accounts, balances and transactions for a bank. Most digital initiatives integrate with it through APIs because replacing it outright is slow and risky.

A framework in which banks share customer-permitted account data with third parties through standardised APIs, enabling account aggregators, payment initiators and comparison services while the customer retains control over consent.

A regulated entity in India's data-sharing framework that, with explicit customer consent, fetches financial information from providers and passes it to a requesting institution without storing or reading the data itself.

A control layer that sits in front of backend services, authenticating callers, enforcing rate limits, routing requests and logging traffic, so internal systems are exposed to partners and apps through one governed entry point.

Handling a transaction end to end by system rules with no manual re-keying or intervention. It is the main operational payoff of digital transformation because it removes errors, delays and reconciliation effort.

Software bots that mimic human keystrokes and screen actions to perform repetitive rule-based tasks such as data entry or report compilation, typically used as a bridge while underlying systems are modernised.

A digital-only financial services provider with no branch network, delivering accounts and payments mainly through a mobile app. Some operate on a partner bank's licence rather than holding their own.

Computer systems that perform tasks normally requiring human judgement, such as understanding language, recognising images or recommending decisions, by learning patterns from data or following encoded rules.

A branch of AI where algorithms learn relationships from historical data and improve with experience, rather than being programmed with explicit rules, to classify, score or predict outcomes.

A machine learning approach that trains a model on labelled examples, where each input is paired with the known correct output, so the model can predict that output for new, unseen cases such as default or fraud.

The historical dataset used to fit a machine learning model. Its quality, completeness and freedom from bias largely determine how well the model performs and how fair its outputs are.

A failure where a model memorises quirks of its training data and performs well on that data but poorly on new customers or periods, giving a false impression of predictive accuracy.

The gradual decline in a deployed model's accuracy as customer behaviour, economic conditions or data sources change, requiring ongoing monitoring, recalibration or retraining rather than one-time approval.

Techniques that make a model's outputs understandable to humans, such as showing which factors drove a decision. It supports customer grievance handling, fair-lending checks and regulatory scrutiny of automated decisions.

Systematic unfairness in model outputs that disadvantages a group, often because historical training data reflected past discrimination or excluded certain customers, creating legal and reputational risk for lenders.

The risk of loss or harm from decisions based on inaccurate, misapplied or poorly understood models, managed through validation, documentation, independent review, monitoring and clear ownership.

Independent assessment of a model's conceptual soundness, data quality, performance and limitations before use and periodically thereafter, intended to confirm it is fit for the decision it supports.

AI systems that produce new text, images, code or audio from prompts by learning patterns in large datasets. In banking they raise concerns about hallucinated facts, data leakage and unverified output.

A statistical or machine learning tool that estimates a borrower's likelihood of repayment from application, bureau and behavioural data, producing a score used to approve, price or limit credit.

The use of data, statistics and visualisation to understand performance and support management decisions, ranging from descriptive reporting of what happened to predictive and prescriptive analysis of what to do next.

A central repository that consolidates cleaned, structured data from many source systems for reporting and analysis, giving management a single consistent view rather than scattered operational extracts.

A storage repository holding large volumes of raw data in native formats until needed, suited to advanced analytics and machine learning but requiring governance to avoid becoming an unmanaged, unreliable dump.

The set of controls, technologies and practices that protect systems, networks and data from unauthorised access, disruption or theft, including prevention, detection, response and recovery activities.

A security model that assumes no user or device is inherently trusted, verifying identity and context for every access request and granting the minimum privilege needed, even inside the corporate network.

Log-in protection requiring two or more independent proofs of identity, such as a password plus a one-time code or biometric, so a stolen password alone is not enough to access an account.

A social engineering attack that tricks a person into revealing credentials or approving a transaction through a fake message, email or website, often the entry point for larger fraud and data breaches.

Manipulating people into breaking security procedures by exploiting trust, urgency or authority, for example a caller posing as a senior officer or regulator to obtain information or force a transfer.

Malicious software that encrypts an institution's files or systems and demands payment for restoration, often after data has also been stolen and threatened with publication.

A documented, rehearsed procedure setting out how an institution detects, contains, eradicates and recovers from a security incident, and how and when it notifies regulators, customers and law enforcement.

Arrangements that keep critical operations running or restore them within agreed timeframes after disruption, covering alternate sites, backups, staffing and tested recovery of essential systems and data.

The risk of loss from failures or inadequacies in information systems, including outages, processing errors, unauthorised change, obsolescence and dependence on third-party providers.

Protecting the confidentiality, integrity and availability of information through policy, access controls, encryption, monitoring and staff awareness, applied to both digital records and physical media.

The risk that a vendor, cloud provider or outsourced service partner fails, is breached or underperforms, exposing the institution to operational disruption, data loss and regulatory criticism despite the work being outsourced.

Delivery of computing, storage and software as services over a network, giving flexibility and cost benefits while concentrating data with providers and raising concerns about location, access and exit.

Labelling information by sensitivity and business criticality, such as public, internal, confidential or restricted, so that appropriate access, encryption and retention controls are applied to each category.

Origination and servicing of loans largely through digital channels, where data and algorithms support credit assessment and disbursal, often involving lending service providers and platforms alongside regulated lenders.

An entity that performs functions such as customer sourcing, data collection or servicing for a regulated lender under a written agreement, without itself taking credit risk on the loan.

A contractual arrangement where a lending service provider or platform compensates a regulated lender for a defined portion of credit losses on a portfolio, subject to regulatory caps and disclosure conditions.

Non-traditional information used in credit assessment, such as utility payments, mobile usage or transaction patterns, which can widen access to credit but needs careful validation and consent-based collection.

The process of identifying a customer and verifying identity and address using reliable documents or digital means, forming the basis for account opening, monitoring and reporting suspicious activity.

Remote customer identification conducted over a live or recorded video session with liveness checks, document capture and location tagging, allowing onboarding without a physical branch visit.

Under India's data protection law, the entity that alone or with others determines the purpose and means of processing personal data, and is accountable for lawful, consented and purpose-limited use.

The individual to whom personal data relates. The law gives this person rights to notice, consent, correction, erasure and grievance redressal against the entity processing their data.

A machine-readable record of a customer's consent that captures what data, for what purpose, for how long and with whom it may be shared, and can be revoked by the customer.

A requirement to store specified categories of data within the country's borders, sometimes with a mirror copy held locally, so national authorities retain access and control over sensitive information.

Unauthorised access, disclosure, alteration or loss of personal data. It triggers duties to contain the incident, assess harm and notify the regulator and affected individuals within prescribed timelines.

The designated person who advises an institution on data protection obligations, monitors compliance, handles grievances and acts as a point of contact for regulators and data principals.