Desible.ai founders on building compliant voice AI for Indian banking: product, regulatory, and scaling lessons

This article is for informational purposes only and does not constitute financial, tax, or legal advice. Consult a qualified professional for guidance specific to your situation.

Editorial note: Reviewed for accuracy by the Startup Finance Guide editorial team. Our editors cross-reference all claims against platform documentation, regulatory publications, and vendor disclosures. Last reviewed: 2026-11-02.

Desible.ai, an Indian voice AI startup selling agentic calling agents to banks, insurers, and non-banking financial companies (NBFCs), went public with its product and compliance playbook on the Prime Venture Partners Podcast, published 1 November 2026, at a moment when the Reserve Bank of India (RBI) is actively tightening rules on automated customer outreach in the financial sector.

Founders Uttam and Omkar spoke with podcast host Gaurav Ranjan about what it actually takes to build and sell conversational AI inside Indian BFSI, a sector where procurement is slow, compliance requirements are non-negotiable, and a single mis-step on customer consent can end a vendor relationship. The conversation is worth attention from any compliance officer or fintech founder deploying voice or chat AI in India, because the founders describe tradeoffs that vendor marketing materials rarely surface.

What changed and why it matters now

The RBI has spent the past two years tightening guardrails on digital lending and automated customer communication. Its Digital Lending Guidelines, issued in September 2022 and updated in 2023, require explicit borrower consent before any third-party or automated system contacts a customer, mandate that all loan-related communication identify the regulated entity (not just the technology vendor), and place the compliance burden squarely on the bank or NBFC, not the software provider. That last point is the one Desible's founders say shapes every product decision they make.

Separately, the Telecom Regulatory Authority of India (TRAI) has been enforcing its Unsolicited Commercial Communication (UCC) framework, which caps call frequency and requires prior consent registration for commercial calls. Voice AI agents that autodial customers without a registered consent record can trigger TRAI complaints that land on the bank's regulatory file, not the AI vendor's. For a startup trying to close its first five enterprise accounts, that liability asymmetry is a real sales obstacle.

The Indian BFSI voice AI space now includes several players beyond Desible: Floatbot, a Ahmedabad-based conversational AI platform with BFSI clients across India and Southeast Asia; Vodex, which focuses on AI-powered outbound calling for collections and lead qualification; and Retell AI, a US-based voice agent infrastructure provider that Indian fintechs have begun evaluating for cross-border deployments. Each takes a different position on where compliance responsibility sits.

What this means for compliance officers and founders

If you are a compliance officer at a bank or NBFC evaluating voice AI vendors, the Desible founders' framing points to four questions worth asking any vendor before signing:

First, who holds the consent record? Under RBI's Digital Lending Guidelines and TRAI's UCC framework, the regulated entity (your bank or NBFC) is responsible for proving that a customer consented to automated contact. Ask the vendor how consent data is stored, who owns it contractually, and what happens to it if you terminate the contract.

Second, how does the agent identify itself? RBI guidelines require that automated communications make clear which regulated entity is contacting the customer. A voice agent that opens with a generic greeting or obscures the lender's identity creates regulatory exposure for the bank, not the vendor.

Third, what is the call-frequency logic? TRAI's UCC rules and the RBI's Fair Practices Code for lenders both constrain how often a borrower can be contacted about a loan. Ask vendors to show you the frequency-cap configuration and confirm it is adjustable to match your internal policy, not just a fixed default.

Fourth, what audit trail does the platform produce? Regulators increasingly ask for call logs, sentiment flags, and escalation records during audits. A vendor that cannot export structured call data in a format your compliance team can read is a liability.

For founders building in this space, the Desible conversation highlights a less obvious point: enterprise sales cycles in Indian BFSI routinely run six to twelve months, and the bottleneck is rarely the technology. It is the bank's internal legal and compliance sign-off process. Founders who treat compliance documentation as a sales asset, rather than a post-contract obligation, close faster.

Limitations and open questions

Several things remain unsettled in this space, and the Desible podcast episode does not resolve them.

The RBI has not yet issued specific guidance on agentic AI, meaning AI systems that take multi-step actions autonomously rather than following a fixed script. The Digital Lending Guidelines address automated communication but were written before large language model (LLM)-based agents became commercially viable. It is not clear whether an LLM agent that dynamically generates call scripts falls under the same disclosure requirements as a rule-based interactive voice response (IVR) system. The RBI has not published formal guidance on this distinction as of November 2026.

TRAI's consent framework was also designed for human-initiated commercial calls. Whether an AI agent that calls a customer in response to the customer's own prior digital action (say, submitting a loan application) requires the same pre-registered consent as a cold outbound call is a question that TRAI has not answered publicly.

Data localisation is a third open area. India's Digital Personal Data Protection Act (DPDPA), passed in 2023 and still being implemented through subordinate rules, will govern where voice call recordings and transcripts can be stored. The Ministry of Electronics and Information Technology (MeitY) has not yet finalised the cross-border data transfer rules under DPDPA, which matters for any voice AI vendor using cloud infrastructure outside India.

Finally, the Desible founders' claims about their compliance architecture are self-reported in a podcast format. Independent audits or regulator acknowledgments of their approach are not publicly available. Compliance officers should treat vendor self-descriptions as a starting point for due diligence, not a conclusion.

This article is for informational purposes only and does not constitute financial, tax, or legal advice. Consult a qualified professional for guidance specific to your situation.