NBFC Account Aggregator License

An NBFC Account Aggregator is a financial entity regulated by the Reserve Bank of India (RBI) that acts as a secure digital middleman. It helps consumers aggregate, consolidate, and share their financial data (such as bank statements, insurance policies, and tax data) from one financial institution to another, entirely based on explicit user consent.

No. An Account Aggregator is strictly a “data-blind” pipe. In alignment with India’s Data Empowerment and Protection Architecture (DEPA), the data passing through an AA is heavily encrypted and cannot be read, stored, analyzed, or monetized by the aggregator entity.

No. Unlike traditional Non-Banking Financial Companies (NBFCs), an NBFC-AA is strictly barred from carrying out any lending, asset financing, investment, or traditional non-banking financial operations. Its sole permitted corporate activity is data aggregation and consent management.

The ecosystem functions seamlessly through three main pillars:

• Financial Information Provider (FIP): The institution holding the consumer’s data (e.g., Banks, Mutual Fund Houses, Insurance Companies).

• Financial Information User (FIU): The institution requesting the data to offer a product (e.g., Lenders, Wealth Managers, Credit Card companies).

• Account Aggregator (AA): The licensed consent channel enabling the secure data transfer.

The license is issued and governed exclusively by the Reserve Bank of India (RBI) under the Master Direction – Non-Banking Financial Company – Account Aggregator (Reserve Bank) Directions, 2016.

An applicant company must have a minimum Net Owned Fund (NOF) of ₹2 Crore to be eligible for an RBI Account Aggregator license.

When a company files a satisfactory application, the RBI first issues an In-Principle Approval. This acts as a temporary authorization valid for 12 months, during which the company must set up its technology framework, establish legal agreements, and ensure data security protocols are operationally ready before receiving the final license.

Only an entity incorporated as a Public Limited Company or a Private Limited Company under the Indian Companies Act, 2013, can apply for an NBFC-AA license. Individuals, partnerships, or LLPs are ineligible.

Account Aggregators monetize their infrastructure by charging a per-transaction consent fee or a processing fee to the Financial Information Users (FIUs) every time a consumer utilizes the platform to securely transmit verified documents or data.

Absolutely not. Data transmission cannot occur without a digitally signed, explicit consent artifact generated by the user. The consumer maintains complete control and can specify the exact duration, purpose, and specific data fields to be shared.

Yes. The AA framework gives consumers the power to pause or permanently revoke active data-sharing consents at any point through the Account Aggregator’s mobile application or web portal.

The scope defined by financial regulators includes bank account statements (savings/current), equity shares, mutual fund units, insurance policies, pension funds (PFRDA), tax data (GST/ITR updates), and corporate bonds.

An applicant must demonstrate robust cybersecurity architecture. They are required to obtain extensive Information Technology (IT) certifications, run routine Vulnerability Assessment and Penetration Testing (VAPT), establish a Security Operations Center (SOC), and implement strict end-to-end encryption.

All promoters and proposed directors must clear the RBI’s stringent “Fit and Proper” guidelines. They must maintain clean credit bureau records (CIBIL), hold relevant financial or technology expertise, and have no pending criminal investigations or economic offenses against them.

To maintain corporate stability, the RBI mandates that an NBFC-AA’s total leverage ratio (debt-to-equity ratio) must not exceed 7 times its Net Owned Funds.

If the RBI rejects an application, the company cannot re-apply for an NBFC-AA license for a period of one year from the date of rejection, and it must immediately cease any data-aggregation pilot projects.

The AA ecosystem is supported by India’s four major financial watchdogs: the RBI (banking/NBFCs), SEBI (capital markets), IRDAI (insurance), and PFRDA (pensions), ensuring cross-industry data integration.