The Reserve Bank of India (RBI) has been steadily working towards creating a secure, consent-based digital financial ecosystem. A key pillar of this reform is the Account Aggregator (AA) framework. It is an innovative, technology-driven system that enables individuals and businesses to share their financial data safely across institutions. As financial services become increasingly digital, understanding the legal, regulatory, and operational requirements around Account Aggregators is essential for fintech companies, NBFCs, financial institutions, and legal practitioners.
An Account Aggregator is a Non-Banking Financial Company (NBFC) authorised by the RBI to act as a digital intermediary for secure financial data sharing. Under Section 45-I of the RBI Act, an NBFC-AA undertakes the business of:
Importantly:
Consumers are free to choose whether they want to register with an AA. As of September 2025, the ecosystem has grown rapidly, with over 2.6 billion enabled accounts and more than 223 million users linked to the AA network.
Rated at 4.6/5 By 200+ Happy Clients
The AA framework involves three key players:
| Financial Information Providers (FIPs) |
Financial Information Users (FIUs) |
Account Aggregators |
|---|---|---|
| These include banks, NBFCs, asset management companies, insurance companies, depositories, GSTN, and other regulated entities that hold customer financial information. | These are regulated financial entities such as lenders who request customer data through the AA to offer services like loans, insurance, investments, or financial planning. | They act as the secure consent managers facilitating this data flow. |
To operate as an AA, a company must obtain a Certificate of Registration (CoR) from the RBI. Key eligibility conditions include:
Before granting the CoR, the RBI issues an in-principle approval valid for 12 months, during which the applicant must set up its technology platform, execute legal documentation, and demonstrate compliance readiness.
The 2025 RBI Directions clearly outline the obligations of NBFC-AAs, ensuring customer protection, data privacy, and operational transparency.
AAs must:
Every AA must maintain high governance standards, including:
AAs must adopt a Board-approved pricing policy, which must:
The RBI also retains the power to inspect AA operations, grant exemptions, or issue further clarifications as needed.
Additional obligations include:
The RBI also retains the power to inspect AA operations, grant exemptions, or issue further clarifications as needed.
The Account Aggregator framework represents a significant leap toward a transparent, customer-centric financial ecosystem. It not only empowers individuals with control over their financial data but also enhances efficiency for lenders, insurers, and investment platforms. However, the system’s integrity depends on stringent compliance with RBI’s regulatory and technological mandates.
For companies seeking to operate as Account Aggregators or financial institutions wishing to join the AA network – understanding and adhering to these regulatory requirements is critical. With robust governance, secure technology, and transparent operations, AAs can play a pivotal role in shaping the future of India’s digital finance landscape.
An Account Aggregator is an RBI-regulated platform that allows you to securely collect and share your financial information with your explicit consent.
Yes. AAs cannot store, read, or misuse your data. They only transfer it securely using strong encryption and RBI-mandated safeguards.
No. Registration is fully voluntary. You choose whether to link your accounts and when to share your information.
Bank statements, deposits, insurance policies, investments, mutual funds, GST returns, pension (NPS) details, and more only with your permission.
Your data is provided by Financial Information Providers (FIPs) such as banks, NBFCs, insurers, and mutual fund companies.
It is received by Financial Information Users (FIUs) such as lenders, insurers, and financial service providers with your consent.
No. AAs are prohibited from accessing or storing your passwords, PINs, or authentication details.
No. AAs do not lend money, sell financial products, or provide advice. They only facilitate secure data sharing.
Yes. Your data can only be shared after you approve a consent artefact that clearly states what data is needed, why, and for how long.
Absolutely. You may revoke or change your consent at any time, and the AA must stop accessing your information immediately.
It saves time, reduces paperwork, and speeds up processes like loan approvals, insurance onboarding, and investment services through secure, digital, real-time data sharing.
