Every large bank today faces a version of the same paradox: the pace of technological change is accelerating, yet the systems that move customers’ money — the ledgers, the payment rails, the loan books — cannot afford to break. Move too cautiously, and a bank cedes ground to nimbler fintechs and AI-native competitors. Move too fast, and it risks the one asset banking cannot survive without: trust.
Kotak Mahindra Bank’s answer has been to treat technology not as a support function but as a core engineering discipline, built the way the world’s best technology companies build — with deep in-house talent, durable platforms, and a disciplined approach to legacy modernization. Three years into that journey, the bank is now layering a sovereign, governed AI capability on top of that foundation, with early results that span frontline service, credit analysis, and document processing.
In a wide-ranging conversation, Nilesh Chaudhari, CTO of Kotak Mahindra Bank, walked through how that transformation was sequenced, the principles guiding its AI rollout, and the security and talent challenges that come with running technology at the scale of one of India’s largest private banks.
Choosing Engineering Talent Over Outsourcing
Three years ago, Kotak made a deliberate strategic choice that shaped everything that followed: rather than lean primarily on service providers or product vendors, the bank invested in hiring deep, in-house engineering talent.
“That is really the fundamental ingredient required to be able to digitally transform, as opposed to the other alternative, which is you could go partner with service providers or product providers to be able to get there. So we chose to go down this particular path,” opines Nilesh Chaudhari, Chief Technology Officer, Kotak Mahindra Bank.
That talent was then pointed at two parallel priorities. The first was clearing the technical debt that accumulates in any large, mature institution — work he describes as unavoidable “heavy lifting.” The second, running concurrently, was building durable platforms: foundational layers that let the bank build customer- and employee-facing “journeys” on top of them more quickly, rather than solving the same problem repeatedly for each new use case.
Four platforms stand out from that effort:
Observability — a system for monitoring application and infrastructure health in real time, designed to let the bank pre-empt failures or react and fix them before customers feel any impact.
A new channel platform — an API-driven backbone behind a newly launched mobile app (already live on the Play Store), built to let the bank ship customer-facing features faster as it migrates users from the legacy app.
Cloud Bank — described as the operating system for branch staff. Where employees once juggled up to ten separate applications for a single task, Cloud Bank consolidates that into one workspace with a unified in-tray and out-tray, improving ticket turnaround and creating the connective tissue needed to plug in AI agents later.
An AI platform — built around data sovereignty as a non-negotiable design principle, ensuring the bank knows precisely where any large language model it uses is hosted and that customer data is never used to train a third party’s generic model.
Modernizing the Core Without a ‘Big Bang’
Core banking systems — the ledgers covering current and savings accounts, trade finance, payments, loan processing and custody operations — present a harder problem than aging servers and network gear. Kotak’s earlier strategy, common across large incumbents, was to license a best-in-market core platform and customize it.
Over time, that approach trapped the bank in what Chaudhari calls a familiar bind: every vendor upgrade required re-applying years of customization, turning each refresh into a nine-month to eighteen-month ordeal.
Rather than rip out and replace the core in one sweep — a path he warns simply resets the same trap with a different vendor five years later — Kotak adopted a “hollow the core” strategy: systematically pulling non-essential workloads out of the core ledger so the core itself is freed to do only what only the core should do.
“Core should be dedicated purely for financial transaction processing — that is the fundamental construct. If somebody is on our website searching for branch locations, that particular interaction need not go to the core,” says Nilesh Chaudhari.
The bank began with read-only queries, then moved end-of-period charge computation and statement generation out of the core ledger. The result has been measurable: the core account-ledger platform now supports roughly 12,000 transactions per second — close to double its prior peak — with further headroom planned. Crucially, this was framed not as an end in itself but as a precondition for strategy: only once the core is hollowed out can the bank make a clear-eyed, ROI-based decision about whether to replace it at all.
“If you are always struggling to support the business, then you have less time to transform — day to day is a fire. Now that we have enough headroom, we can concentrate on actually seeing how we can strategically carve things out”, says Nilesh Chaudhari.
AI as a Third Great Platform Shift — Governed by Design
Chaudhari places the current AI moment in rare company, comparing its disruptive potential to the internet revolution itself — transformational not just for customer service but for how the bank’s own workforce operates. That conviction is balanced by clear-eyed caution about where accountability sits when AI is involved in decisions, and an acknowledgment that a human in the loop remains necessary, particularly in financial services.
Operationally, Kotak’s AI platform rests on a small number of strict principles: data sovereignty, in-country hosting, and a guarantee that customer data is never repurposed to train external models. These guardrails are not framed as constraints on innovation but as its enabler — the mechanism that lets any employee, from engineering to operations to the frontline, experiment without re-litigating governance for every new use case.
“That allows people in the rest of the organization — whether it’s an engineering person, an operations person, an average frontline colleague — to fearlessly use that platform and innovate on it. Otherwise, every new use case you have to go and do these five things again, again and again, if you go vertically everywhere,” says Nilesh Chaudhari.
The guardrails also double as cost and access controls — tracking spend, value generated, budget by user, and identifying power users — which in turn lets the bank federate AI access broadly rather than centralize it. Chaudhari attributes the underlying philosophy to the bank’s MD and CEO directly:
“Let a thousand flowers bloom. We never know where AI is so new that where value will be accrued or had — but guardrails really help us move faster,” says he.
From Personal Productivity to Reimagined Processes
Kotak draws a sharp distinction between two modes of AI value capture. The first is incremental: compressing a task that used to take hours into minutes, without changing the underlying process. The second, more ambitious mode is structural — asking why the task existed in that form at all, and redesigning the process around it.
“You could have fundamentally reimagined the process as well. Maybe somebody takes eight hours to mismatch some Excel sheets — now that activity could be done in five minutes. But when you dig deeper and ask why does this person need to mismatch eight Excel sheets, that’s when you fundamentally start reimagining how you eliminate that,” says the CTO.
On the productivity side, an internally branded assistant called Companion has been rolled out to frontline colleagues across the bank. Its flagship use case: equipping a relationship manager at a small-town branch — who may rarely field a request for, say, NRI banking services — to answer a customer’s question correctly and with full context, without phoning a specialist.
“That branch may not be servicing NRI customers on a regular basis… now he doesn’t need to pick up the phone and call somebody. He could go on to the app, provide the customer’s identifier, and explain this is what I need to do, this is what the customer is asking — how can I help the customer,” states Nilesh Chaudhari.
Companion’s reach extends well beyond NRI queries — mutual fund distribution, investment products, and general process questions are all in scope — with the explicit aim of letting any branch deliver the quality of service typically reserved for the bank’s most sophisticated locations. Kotak tracks adoption against a concrete proxy: call volumes into its internal colleague helpdesk, which Chaudhari expects to fall as Companion usage rises, with business outcomes — including reduced cost of acquisition — following from there.
Beyond Companion, the bank has built roughly 20–25 standalone agents for specific, judgment-heavy tasks. One example: an agent built alongside credit analysts to extract and synthesize a 20-page credit bureau report — mirroring how an experienced analyst already knows exactly what to look for rather than reading start to finish.
“How do you actually create an agent that can mimic that particular [analyst] — can be a digital twin of that credit analyst — because you’re not in a position right now to take the human being out of the loop. But it can definitely save some time, and the analyst can move cases faster,” says Nilesh Chaudhari.
A second category — document intelligence agents, combining OCR with large language models — ranges from reading simple identity documents to extracting structured data from financial statements for downstream credit analysis. The deliberate choice to start with standalone agents, rather than embedding them directly into existing workflows, was strategic: it lets the bank build comfort with an agent in isolation before integrating it into core loan-origination or other systems — systems that, Chaudhari notes, were designed over the last two decades to interact with humans, not machines, and now need re-architecting to serve both. “You’ll focus on UX; the agent doesn’t really need to know UX. It needs a proper model gateway, an API, to be able to feed what it needs and get what it is. And at some point in time, a human will look at it.”
Asked whether this points toward a future network of interacting agents owning entire workflows, Chaudhari pointed to an organic example already underway: a treasury colleague who, entirely on his own initiative, built three personas — an economist, an investor, and a trader — that debate a question to produce a more balanced input for his own client conversations. It is not yet a sanctioned, bank-wide capability, but it illustrates where multi-agent collaboration is heading. “I wouldn’t hazard a guess of saying when the human will not be required — that, at least in financial services, might take longer.”
The Data Foundation Beneath the AI
None of this works, Chaudhari is careful to note, without disciplined data engineering underneath it. Kotak has consolidated disparate sources into a single data lake, on top of which it has built business-specific views — notably a Customer 360 and an RM 360 — giving relationship managers and AI systems alike a complete picture of a customer’s open cases, pending items, and product holdings.
“If you give it bad context, it will give you bad answers — that’s what it will be. As part of our three-year journey we have also invested a lot in our data platform itself,” believes Nilesh Chaudhari.
On model strategy, the bank avoids defaulting to a single large model for every task. Working with its cloud provider, it has gained access to a widening set of both proprietary and open-weight models, and built model selection into the platform itself, so individual users are abstracted from having to choose — or pay for — more model than a given task requires.
Data residency follows the same sovereignty principle described earlier: Kotak operates within a dedicated logical landing zone on its cloud provider’s infrastructure, whitelisting only the specific services it needs rather than allowing data to move freely across a provider’s broader service catalog.
Composability as the Foundation of Customer Trust
Chaudhari’s longer-term architectural vision rests on the idea of composability — building reusable platform capabilities (systems of record, identity and access management, observability, workflow) that functional, business-facing products are then assembled on top of, rather than each business line re-engineering similar capabilities from scratch.
A simple but telling example: once a customer’s passport has been captured and verified for one product, that structured data — and the consent governing its use — should be available to any other product line within the bank without asking the customer to resubmit it.
“If I’m dealing with a customer, if I already have their passport, all I need is their consent to use it for the reason I’m doing it. I don’t have to say, please give it to me once more,” says he.
The payoff, in his framing, is experiential: customers feel banking become faster and far more transparent, with clear visibility into where a request stands, why a charge or credit occurred, and how long a process will take — a kind of real-time tracking analogous to a ride-hailing app, applied to a loan application or service request.
Securing an Agentic Enterprise
Chaudhari is unambiguous that banking is, above all, a business of trust — and that information security and data privacy risk sit at the center of every technology decision, not at its periphery. His central principle is to shift security left: build it into design from the outset, rather than bolting it on after the fact, which he argues only creates friction and resentment among engineers eager to ship. “It has to be built in the design, not as a bolt-on. Because when you put it as a bolt-on, that’s when it becomes a friction point — I’m ready, but now you’re telling me these ten things I need to do because I have to control these things.”
AI introduces a distinctly new risk surface. Where a human employee in HR operations would instinctively decline to disclose, say, a colleague’s salary to an unauthorized caller, an AI agent given system access may not exercise that same judgment unless explicitly guardrailed.
“If an agent has access to the system, unless you build the right guardrail, it may not be able to understand that it’s not supposed to share this information. Those are small things, but those are the kind of risks we’ve been grappling with,” says he.
Kotak’s response is to extend established identity and access management discipline — access recertification, the principle of minimal access — to agents with the same rigor long applied to human users, underpinned by a formal AI governance policy now moving through final approval.
Beyond AI-specific risk, Chaudhari flagged third-party and supply-chain exposure as one of the hardest unresolved problems in enterprise risk management — partly because banks often lack visibility into a vendor’s intellectual property and must rely on audits, assurances, or industry certifications instead of direct inspection. He also pointed to a broader industry shift toward cataloguing software “bills of materials” — SBOMs and emerging equivalents for AI components — as embedded AI calls inside third-party SaaS tools create new, often invisible, data-residency risk. “If that piece of software is making some LLM calls somewhere in a country you don’t want those calls to go, then you have a challenge. Getting that visibility is the other area we need to quickly mature on as an industry.”
His broader ambition is to move risk management from a detective posture — periodic, calendar-driven reviews that catch problems after the fact — to a preventive one, where a risky change is caught the moment it happens.
Build, Buy, or Co-Create
With finite deep-engineering capacity, Kotak applies a pragmatic filter to where it builds versus buys: in-house engineering is reserved for the bank’s hardest, most differentiating problems — the ones where genuine IP and competitive advantage are created — rather than rebuilding capabilities that billion-dollar platform companies have already solved at scale. “I do not want to use that engineering capacity to build a platform that’s already built somewhere else, by companies that are billion dollars or more. What’s the point in trying to compete with them to build it?”
Co-creation with technology vendors and startups occupies the middle ground — particularly useful when a capability is genuinely novel and the resulting IP could eventually be commercialized beyond
Kotak’s own markets, which can also help justify the internal investment case. Startups, in turn, gain access to the scale, data, and real-world use cases that only an institution like Kotak can provide.
“Startups do need access to the wealth of data, the wealth of experience, the real-life use cases that banks at scale have. But startups have a different way of thinking, a different way of solving problems — so co-creation is definitely on the table,” opines Chaudhari.
Winning — and Keeping — Engineering Talent
Competing for engineering talent against global technology firms, multinational banks’ India-based GCCs, and an increasingly vertically focused fintech sector is, in Chaudhari’s words, one of the things that keeps him “awake at night.” His retention thesis centers on autonomy and scale of impact rather than compensation alone.
“If you’re sitting in India [for a global technology company], you’re not taking decisions, you’re just executing. If you have a great idea, by the time it filters to the right people in the global hierarchy, it can take a lot of time,” says he.
By contrast, he argues, an engineer at Kotak can chart their own path, challenge the status quo, and — in his words — “make population-scale impact” by rewriting core parts of a banking platform used by millions. That empowerment is paired with deliberate signaling from the top: a board and senior leadership that treat technology as core to the business rather than a support function, with visibility extended to business heads and the C-suite alike.
Increasingly, Kotak is also recruiting at the earliest career stages — fresh graduates and engineers one to two years into their careers — on the view that this cohort is inherently more “AI-native” than colleagues with a decade or more of experience, and brings fresh thinking as a result.
The Road Ahead
Asked for a two-year horizon rather than the more conventional five, Chaudhari frames Kotak’s destination in terms of platform maturity rather than any single product launch. The vision is a clean separation between technology-native platforms — observability, identity and access management, workflow — and functional platforms, such as a unified payments platform capable of moving value seamlessly regardless of rail (UPI, NEFT, RTGS, cross-border, or eventually tokenized assets and CBDC) or product wrapper built on top.
“The platform model really helps you reduce the time and cost to put a feature into production. A collection of features is really a product. If you give a three-to-five-year time frame, I would see that model really mature,” says he.
Organizationally, that vision is already taking shape: one senior leader owns systems of record, a separate vertical owns AI and data platforms, and line-of-business teams — closest to customers and products — build on top of those platforms while feeding requirements back that help the platforms themselves mature.
On agents specifically, Chaudhari is candid that full convergence — a connected network of agents collaborating across the loan, underwriting, or payments lifecycle — is still emerging, and he resists putting a date on when systems of record themselves might give way to agentic systems; he doesn’t expect that to happen within a short horizon, particularly given the risk profile of financial services. The more durable ambition, in his telling, is structural: not bolting agents onto today’s underwriting process, but reimagining it — moving data collection earlier, exhausting digital sources before ever asking a customer for a document, and using AI as the occasion to rethink workflows rather than merely accelerate the existing ones.
“It is not about just plugging in agents. It is about saying, fundamentally, can I move stuff to the left? If you have to get the true value of it, you really need to reimagine how you’re providing your financial services to customers,” says Chaudhari. That combination — disciplined core modernization, platform-first engineering, sovereign and guardrailed AI, and a security posture built in by design rather than bolted on — is, in effect, Kotak Mahindra Bank’s working answer to the paradox every large financial institution now faces: how to move at the speed of frontier technology without ever placing the trust of its customers at risk.