NBFC Account Aggregator registration enables secure, consent-based financial data sharing under RBI regulation. Applicants must meet ₹2 crore NOF, IT, governance and compliance requirements.
What Is an NBFC Account Aggregator Licence?
An NBFC Account Aggregator Licence is the Certificate of Registration granted by the Reserve Bank of India to an eligible company that intends to operate as an Account Aggregator. An Account Aggregator acts as a regulated consent manager that helps customers securely access and share their financial information with authorised Financial Information Users.
The Account Aggregator does not lend money, provide investment advice, execute transactions or use customer financial data for its own commercial purposes. Its role is limited to collecting financial information from approved Financial Information Providers and transmitting it to authorised users only after obtaining valid customer consent.
For registration, the applicant must satisfy RBI requirements relating to company structure, minimum Net Owned Fund of ₹2 crore, promoters and management, governance standards, technology infrastructure, information security, customer protection and operational readiness. The application is submitted through RBI’s PRAVAAH portal along with the prescribed business plan, policies, financial information and supporting documents.
RBI may first grant an in-principle approval, generally valid for 12 months, during which the applicant must complete the required technology platform, agreements, security controls and operational arrangements. After RBI is satisfied that all conditions have been met, the final Certificate of Registration may be issued, allowing the company to commence Account Aggregator operations subject to continuing regulatory compliance.
Who Needs an Account Aggregator Licence?
A business that proposes to provide account aggregation as defined by RBI must generally be incorporated as a company and obtain RBI registration before commencing the activity. The licence is not a general fintech registration: it is activity-specific. The applicant’s objects, business model, technology architecture and commercial arrangements should all reflect the restricted role of an Account Aggregator.
- Only a company can undertake the regulated business of an Account Aggregator.
- The company cannot commence or carry on the business without RBI Certificate of Registration.
- An entity regulated by another financial-sector regulator that aggregates only accounts within that regulator’s sector may fall within the specific exclusion stated in the RBI Directions; the exact model should be reviewed before relying on the exclusion.
- An NBFC-AA must not undertake another business, except permitted deployment of investible surplus in non-trading instruments.
- It must not support customer transactions and must not use customer financial information for purposes outside the consent artefact.
Account Aggregator Licence Eligibility Requirements
1. Company structure
The applicant must be a company registered under the Companies Act. The constitutional documents should contain objects aligned with the proposed Account Aggregator activity and should not create an operational conflict with RBI’s restriction on undertaking other business. Where the promoters already operate technology, lending or financial-service entities, group relationships and proposed inter-company arrangements should be mapped carefully.
2. Minimum Net Owned Fund of ₹2 crore
The current minimum Net Owned Fund (NOF) requirement for an NBFC-AA is ₹2 crore, or such higher amount as RBI may prescribe. The 2025 Directions permit an applicant that does not have the full ₹2 crore at the initial application stage to meet the requirement within the validity period of the in-principle approval. From a practical filing perspective, the funding source, share capital trail and NOF computation should be transparent and capable of professional verification.
3. Promoters and management must be fit and proper
RBI assesses the promoters and proposed management, including their integrity, competence, financial soundness, regulatory history and overall suitability. The company should be ready with promoter profiles, source-of-funds records, declarations, directorship details, litigation or regulatory disclosures and supporting information. Concealing an adverse fact is generally more damaging than explaining it with evidence.
4. Adequate resources and capital structure
RBI must be satisfied that the applicant has the resources and wherewithal to operate the business. The business plan should therefore connect projected customer volumes, technology spending, staffing, cybersecurity, compliance, audit, infrastructure and revenue assumptions with the available capital. A generic fintech pitch deck is not a substitute for a regulator-ready operating plan.
5. Robust IT system and operational architecture
Account aggregation is entirely IT-driven. The applicant needs a credible plan for secure APIs, consent handling, encryption, access controls, logging, auditability, disaster recovery, business continuity, incident management and scalable integration with Financial Information Providers and Financial Information Users. RBI also expects adoption of ReBIT technical specifications as updated from time to time.
6. Leverage ratio not more than 7
At the registration stage, the company must satisfy the RBI requirement that the leverage ratio does not exceed seven. Under the AA Directions, leverage ratio is the ratio of outside liabilities, excluding borrowings or loans from group entities, to owned funds. Capital and liability planning should therefore be reviewed before filing and during the in-principle approval period.
Account Aggregator Licence: 2026 Technology Standards
A 2026–27 application should not treat technical readiness as a post-licence issue. ReBIT published standards on 30 April 2026 to enhance customer protection and user experience, including requirements around onboarding, account discovery and linking, consent management, customer-facing design, notifications, two-factor authentication, SIM/device binding, and secure AA–FIU integration. The stated implementation deadline for NBFC-AAs and FI-Us was 31 October 2026.
ReBIT also published interoperability API specifications on 14 October 2026. The interoperability model is intended to reduce one-to-one integration dependencies across AAs, FIPs and FIUs. ReBIT subsequently announced that the interoperability adoption deadline was revised to 1 December 2026. For a new applicant, these developments should be built into the technology roadmap, vendor scope, testing plan and compliance evidence rather than added after the product has been developed.
What an NBFC-AA Can and Cannot Do
| Permitted / Core Role | Restricted / Prohibited |
|---|---|
| Obtain, submit and manage customer consent | Cannot retrieve/share data without explicit customer consent |
| Retrieve specified financial information from FIPs | Cannot own or use customer financial information for another purpose |
| Consolidate, organise and present information | Cannot support customer transactions |
| Securely transmit information to authorised FIUs | Cannot access or store customer authentication credentials such as passwords, PINs or private keys |
| Maintain consent records and enable revocation | Customer financial information accessed from FIPs must not reside with the AA |
| Deploy investible surplus in permitted non-trading instruments | Cannot undertake another business outside account aggregation |
Consent Architecture and Customer Rights
The consent framework is central to the AA model. No financial information can be retrieved, shared or transferred without the customer’s explicit consent. The consent artefact must contain prescribed elements such as customer identity, nature of information requested, purpose, recipient identity, notification address, creation and expiry details, and the identity/signature or digital signature of the NBFC-AA. The electronic consent artefact must be capable of being logged, audited and verified.
- The customer must be informed about the attributes of the consent artefact and grievance rights.
- The AA must provide functionality to revoke consent, including revocation for parts of the information.
- The customer must be able to access a record of consents and the FIUs with whom information has been shared.
- Information may be used only for the purpose covered by the consent artefact.
- FIPs must verify consent, dates/usage and AA credentials before securely transmitting digitally signed information.
- FIP responses under the RBI framework are required to be in real time.
Financial Information Covered by the AA Framework
The RBI Directions define financial information broadly. The present list includes bank deposits, NBFC deposits, structured investment products, commercial paper, certificates of deposit, tradable government securities, shares, bonds, debentures, mutual funds, exchange-traded funds, Indian Depository Receipts, collective investment schemes, alternate investment funds, insurance policies, NPS balances, InvIT units, REIT units and specified GST returns such as GSTR-1 and GSTR-3B, along with any additional information RBI may specify in future.
Step-by-Step Account Aggregator Licence Process
- Business-model review: confirm that the proposed activity falls within the AA framework and that the revenue model does not conflict with RBI restrictions.
- Company and object-clause review: incorporate or restructure the applicant company with suitable objects, shareholding and governance.
- Promoter and director due diligence: prepare fit-and-proper records, declarations, experience profiles, financial records and regulatory disclosures.
- Capital and NOF planning: establish the capital path to the prescribed ₹2 crore NOF and verify leverage and funding sources.
- Regulator-ready business plan: prepare customer segments, operating model, pricing, financial projections, technology plan, risk framework and implementation milestones.
- Board-approved framework: draft core policies including grievance handling, pricing, fit-and-proper assessment, information security, business continuity and risk management.
- PRAVAAH application: submit the prescribed RBI application with supporting documents to the Department of Regulation, Mumbai through the PRAVAAH portal.
- RBI scrutiny and queries: respond to information requests, clarifications and document gaps in a consistent and evidence-backed manner.
- In-principle approval: where RBI is satisfied with the applicant’s eligibility, it may issue an in-principle approval valid for 12 months.
- Technology build and legal documentation: within the 12-month period, put the technology platform and operational legal arrangements in place and complete compliance with the approval conditions.
- Readiness demonstration: report compliance to RBI and be prepared to demonstrate platform, security, governance, audit and operational readiness.
- Certificate of Registration: RBI may issue the final CoR once satisfied that the company is ready to commence operations and meets the applicable requirements.
Documents Required for Account Aggregator Licence
RBI can seek additional information depending on the applicant, shareholding and business model.
A well-prepared file normally includes the following categories:
- Certificate of incorporation, memorandum and articles of association, PAN and corporate registrations.
- Board and shareholder records relevant to the proposed NBFC-AA activity.
- Director/promoter KYC, DIN details, professional experience, declarations and fit-and-proper material.
- Shareholding pattern, ultimate beneficial ownership chart and group-company structure.
- Source-of-funds evidence, bank statements, audited financial statements and NOF computation/certification as applicable.
- Detailed business plan, revenue model, financial projections and capital deployment plan.
- Organisation chart, staffing plan and key management profiles.
- Technology architecture, information-security framework, API/integration approach, access-control design and audit/logging plan.
- Disaster recovery, business continuity and operational resilience documentation.
- Draft customer terms, consent flow, privacy/customer-protection documentation and Citizen’s Charter.
- Board-approved or draft policies for grievance redressal, pricing, fit-and-proper assessment and risk management.
- Declarations regarding regulatory history, litigation, related parties, foreign investment and FATF-linked jurisdiction exposure, where applicable.
Compliance After Account Aggregator Licence
Receiving the CoR is the beginning of the regulatory lifecycle, not the end. The 2025 Directions require internal mechanisms for reviewing controls, systems and safeguards, together with specific governance committees and reporting obligations.
- Nomination Committee: not less than three Board members to ensure continuing fit-and-proper status of proposed and existing directors.
- Risk Management Committee: at Board or executive level, with not less than three Board members, to oversee integrated risk and technology risk.
- Information System Audit: internal systems and processes must be audited at least once every two years by CISA-certified external auditors; the external auditor’s report must be submitted to the jurisdictional RBI Department of Supervision Regional Office within one month of submission by the auditor.
- Grievance redressal: complaints must be handled under a Board-approved policy and in any case not beyond one month from receipt.
- Pricing: services require a Board-approved pricing policy, with internal pricing guidelines transparent and available in the public domain.
- Fit-and-proper annual statement: the required annual statement on changes in directors/MD/CEO, certified by statutory auditors, must reach the RBI Regional Office within 15 days of the close of the year.
- RBI returns and inspection: the company must submit such returns as RBI prescribes and remain ready for supervisory inspection.
- Change in control/shareholding/management: specified changes require prior RBI approval and related public notice or reporting as applicable.
Data Security and Information-System Expectations
Because the AA is a trusted data intermediary, the security model should be designed around least privilege, consent verification and end-to-end traceability. RBI expressly prohibits the AA from requesting or storing customer credentials such as passwords, PINs and private keys. Financial information accessed from a FIP must not reside with the AA. The company should implement safeguards against unauthorised access, alteration, destruction, disclosure or dissemination, and maintain disaster-risk management and business continuity measures.
A practical readiness pack should include architecture diagrams, data-flow maps, threat modelling, encryption standards, key management, access roles, log retention, incident response, vulnerability management, third-party dependency mapping, recovery objectives and test evidence. These documents should match the actual production design; a policy that describes controls which the product does not implement creates regulatory risk.
Account Aggregator Licence Timeline
There is no single guaranteed RBI approval timeline because the outcome depends on application quality, promoter profile, regulatory queries and technology readiness. The clearest statutory-operational milestone in the current AA Directions is that an in-principle approval, once issued, is valid for 12 months. Within that period the applicant must put the technology platform and required legal documentation in place and report compliance with the approval conditions. Applicants should therefore treat the project as a licensing-plus-technology programme, not merely a filing assignment.
Account Aggregator Licence Fees and Charges
The professional fee depends on whether the engagement covers only regulatory documentation or also company structuring, business plan, financial model, policy suite, technology-readiness review, PRAVAAH filing, RBI query handling and post-registration compliance setup. RBI or other statutory charges, professional certifications, cybersecurity testing, software development, external audit, DSC and incorporation-related fees, if applicable, are separate. Vakilkaro should issue a written scope and quote after reviewing the promoter structure and proposed technology model.
Common Reasons an NBFC-AA Application Becomes Weak
- Using the old 2016 Directions as the primary current framework and missing the consolidated 2025 Directions.
- Filing a generic NBFC application without showing how the AA model differs from lending, payment aggregation or data analytics.
- Insufficient promoter disclosures or unexplained source of capital.
- Business projections that are not linked to technology and compliance costs.
- Object clauses that permit conflicting activities despite the restriction on other business.
- Treating the technology platform as a future vendor problem rather than a core RBI eligibility issue.
- Consent screens or privacy documents that do not match the prescribed consent architecture.
- No credible disaster recovery, information-security audit or operational-resilience framework.
- Ignoring ReBIT technical specifications and 2026 customer-protection/interoperability releases.
- Inconsistent names, shareholding, financial figures or group-company information across documents.
- Overpromising an approval timeline or presenting an in-principle approval as the final licence.
- Failing to plan post-CoR committees, grievance handling, pricing transparency, RBI reporting and change-control approvals.
Why Choose Vakilkaro for Account Aggregator Licence?
NBFC-AA licensing sits at the intersection of company law, RBI regulation, financial-sector governance and technology architecture. Vakilkaro’s role is to coordinate these workstreams so the application tells one consistent story—from promoters and capital to consent design, security controls, business economics and post-registration governance. Clients receive a clear checklist, document tracker, policy roadmap and filing support instead of a generic licence package.
- 2026–27 regulatory framework, not outdated AA rules
- RBI PRAVAAH filing support
- CA/CS/legal coordination
- Technology and ReBIT readiness checklist
- Transparent scope and milestone tracking
- Pan-India digital assistance
