NBFC Account Aggregator (NBFC-AA) — RBI Licence, Consent Framework & Data Compliance

Q: What is the minimum NOF for NBFC-AA registration?

₹2 crore — lower than most NBFC categories since AAs take no credit risk. Robust technology infrastructure and data security frameworks are required.

Q: Can an NBFC-AA store or process the financial data it aggregates?

No. AAs are prohibited from storing, processing, or using financial data. They only store consent artefacts and metadata. Data flows encrypted between FIP and FIU.

Q: What types of financial data can be shared through the AA network?

Bank statements, tax data, GST returns, insurance policies, pension accounts, mutual fund holdings, and securities/demat holdings. Scope is progressively expanded by the RBI.

Q: What is the difference between an AA, FIP, and FIU?

AA: consent-based data intermediary. FIP: entity holding customer data (e.g. bank). FIU: entity requesting data (e.g. lender). An entity can be both FIP and FIU simultaneously.

Q: How does the consent artefact work in the AA framework?

A digitally signed document capturing explicit customer consent — specifying purpose, data scope, duration, frequency, and parties. Revocable at any time. No data flows without a valid consent artefact.

Specialist advisory for NBFC Account Aggregator licence from the RBI — covering AA registration, Account Aggregator ecosystem integration, consent artefact framework, Financial Information Provider (FIP) and Financial Information User (FIU) onboarding, and data privacy compliance.

NBFC-AA Registration

End-to-end advisory for NBFC Account Aggregator registration with the RBI — minimum NOF of ₹2 crore, technology infrastructure requirements, data security framework, and application filing on the COSMOS portal.

AA Ecosystem Integration

Advisory on joining the Sahamati/ReBIT Account Aggregator ecosystem — technical integration with the AA network, TSP (Technology Service Provider) engagement, API standardisation, and FIP and FIU onboarding.

Consent Artefact Framework

Design and implementation of the consent artefact framework — ensuring all financial data flows through the AA are governed by customer consent with specified purpose, duration, frequency, and revocability as required by RBI directions.

Data Security & Privacy

Advisory on data security obligations for NBFC-AAs — encryption requirements, data minimisation, prohibition on data storage beyond consent parameters, and compliance with Digital Personal Data Protection Act (DPDPA) obligations.

FIP & FIU Agreement Structuring

Drafting and review of agreements between the NBFC-AA and Financial Information Providers (banks, NBFCs, mutual funds) and Financial Information Users (lenders, wealth managers) — covering liability, SLAs, and data handling obligations.

NBFC-AA Annual Compliance

Management of all RBI periodic returns, technology audit compliance, consent framework audit, and annual regulatory submissions for NBFC-AA entities. Connects with broader NBFC annual compliance services.

What is an NBFC Account Aggregator?

An NBFC Account Aggregator is a specialised NBFC licenced by the RBI to provide a consent-based data sharing platform — aggregating and sharing financial data of customers across regulated financial entities with the customer's explicit consent. The AA does not see, store, or process the financial data — it only facilitates the encrypted, consent-governed flow of financial information between Financial Information Providers (FIPs) and Financial Information Users (FIUs).

The Account Aggregator framework, operational since 2021, is a transformative financial infrastructure that enables lenders to access verified financial data (bank statements, tax data, insurance, mutual fund holdings) directly from source systems — dramatically accelerating credit assessment and reducing fraud. NBFCs, banks, and fintechs use the AA network to streamline lending decisions, wealth management onboarding, and financial planning services.

Frequently Asked Questions

What is the minimum NOF for NBFC-AA registration? +

The minimum Net Owned Fund for NBFC Account Aggregator registration is ₹2 crore — significantly lower than most NBFC categories, reflecting the fact that NBFC-AAs do not take credit risk. However, NBFC-AAs must demonstrate robust technology infrastructure, data security frameworks, and operational capabilities to meet RBI's technology and data governance requirements.

Can an NBFC-AA store or process the financial data it aggregates? +

No. The RBI's NBFC-AA Master Directions explicitly prohibit AAs from storing, processing, or using the financial information they handle. The AA acts purely as a data blind relay — data flows encrypted from FIP to FIU through the AA platform without the AA being able to read or retain it. AAs can only store consent artefacts and metadata related to the data sharing flow.

What types of financial data can be shared through the AA network? +

The AA network currently supports sharing of: bank account statements; tax data (from CBDT); GST returns; insurance policy information; pension account data; mutual fund holdings; and securities/demat account holdings. The RBI progressively expands the scope of financial data eligible for AA-facilitated sharing as more FIPs join the ecosystem.

What is the difference between an AA, FIP, and FIU? +

An Account Aggregator (AA) is the consent-based data intermediary that facilitates data flow. A Financial Information Provider (FIP) is the entity that holds the customer's financial data and shares it through the AA — typically a bank or NBFC. A Financial Information User (FIU) is the entity that requests and receives the data for a specified purpose — typically a lender, wealth manager, or financial planner. An entity can be both an FIP and an FIU simultaneously.

How does the consent artefact work in the AA framework? +

A consent artefact is a digitally signed electronic document that captures the customer's explicit consent for a specific data sharing request. It specifies the purpose of sharing, the data to be shared, the duration of the consent, the frequency of access, and the identities of the FIP and FIU. The customer can revoke consent at any time. No data flows without a valid, customer-authorised consent artefact — this is the foundational principle of the AA framework.

Build India's Financial Data Infrastructure with an NBFC-AA Licence

End-to-end NBFC Account Aggregator registration, ecosystem integration, consent framework, and compliance advisory.

F.A.Q.

What is GSTR-9 and why is it required?

GSTR-9 is an annual GST return that summarizes all transactions reported during the financial year. It is required to ensure proper reconciliation and compliance with GST laws.

Who is required to file GSTR-9?

All regular GST-registered taxpayers are required to file GSTR-9, except composition dealers, casual taxable persons, and non-resident taxpayers.

What is the due date for filing GSTR-9?

The due date is generally 31st December following the end of the relevant financial year, unless extended by the government.

What details are included in GSTR-9?

It includes details of outward supplies, inward supplies, input tax credit claimed, taxes paid, and adjustments made during the year.

Is GSTR-9 mandatory for all taxpayers?

GSTR-9 is mandatory for most regular taxpayers, but certain small taxpayers may get exemptions based on turnover thresholds notified by the government.

What happens if GSTR-9 is not filed on time?

Late filing may result in penalties and late fees, along with potential compliance issues or notices from GST authorities.