Find the best UK casinos that accept bank transfer in 2026. We rank licensed operators, compare bonus types, withdrawal speeds, and explain how bank transfer deposits and payouts actually work. read our ranking of UK casinos that accept bank transfer in 2026
The Account Aggregator (AA) framework is India’s pioneering consent-based financial data sharing architecture, created by the Reserve Bank of India to give customers clear control over their financial information. An NBFC-AA is a specialized, data-blind intermediary — it does not lend, does not hold customer money, and does not see customer data. Its only role is to securely transport a customer’s consented financial information from a Financial Information Provider (FIP) like a bank or NBFC, to a Financial Information User (FIU) like a lender, insurer, or wealth manager.
NBFC-AAs sit at the heart of the emerging Digital Public Infrastructure (DPI) for finance. Strong AA compliance is not optional — it is a continuous blend of RBI NBFC-AA Directions, ReBIT technical standards, Sahamati ecosystem rules, Digital Personal Data Protection (DPDP) obligations, information security norms, and PMLA / AML discipline, all wrapped around a single core principle: no data flows without a valid, granular, revocable consent.
We offer end-to-end NBFC-AA compliance services — from CoR support and operating model design to consent framework implementation, ReBIT-aligned tech review, DPDP alignment, IS audit, RBI returns, ecosystem integration, and day-to-day compliance — so your AA stays regulator-ready, auditor-ready, and Sahamati-ready at all times.
₹2 Cr
Minimum Net Owned Funds
Consent
Only basis for data flow
Data-Blind
AA cannot read customer data
RBI
NBFC-AA Master Directions
Regulations & Frameworks We Align With
RBI Act, 1934
NBFC-AA Master Directions
ReBIT Technical Specifications
Sahamati Rulebook
DPDP Act, 2023
IT Act & CERT-In
PMLA & FIU-IND
SBR Framework
The AA Ecosystem at a Glance
FIP
Financial Information Provider
Banks, NBFCs, mutual funds, insurers, and pension funds that hold the customer’s financial data.
AA
Account Aggregator
The data-blind NBFC-AA that moves consented data from the FIP to the FIU, without seeing the content.
FIU
Financial Information User
Regulated entities — lenders, insurers, wealth managers, advisors — that consume data to serve the customer.
Our NBFC-AA Compliance Services
CoR & Structure Advisory
Advisory on NBFC-AA registration, in-principle / final CoR, and operating model design.
Consent Framework
Design and review of consent artefacts, dashboards, revocation flows, and audit trails.
ReBIT Tech Alignment
Gap assessment of AA stack vs ReBIT technical specifications and API schemas.
Sahamati Readiness
Alignment with Sahamati onboarding, certification, and operational rulebook.
DPDP & Privacy
DPDP Act, 2023 alignment — notice, consent, rights, grievance redressal, and DPO setup.
IS & Cyber Security
IS policy, CERT-In reporting, cyber resilience, and periodic IS audit coordination.
RBI Returns & Reporting
Periodic AA-specific returns, CoR conditions, event disclosures, and SBR compliance.
Audit & Inspection Support
Statutory audit, internal audit, IS audit, and responses to RBI & supervisory reviews.
Core Principles Every NBFC-AA Must Honour
Consent
Explicit, Granular Consent
No data flow without explicit, purpose-bound, and revocable customer consent.
Data-Blind
No Access to Data
AA only transports encrypted data between FIP and FIU; it cannot read or store payload.
Purpose
Purpose Limitation
Data can be used only for the specific purpose disclosed to the customer in the consent.
Minimization
Data Minimization
Only information strictly needed for the stated purpose is requested and shared.
Revocation
Consent Revocation
Customers can view, manage, and revoke consent at any time via the AA app or dashboard.
Audit
End-to-End Audit Trail
Every consent, fetch, and data flow is logged to support regulator and customer audit.
No Lending
No Lending or Own Products
NBFC-AAs cannot lend, invest, advise, or sell financial products on their own account.
Security
Security & Encryption
Strong encryption, key management, and cyber resilience across every layer of the stack.
Documents & Artefacts We Review
Regulatory & Corporate
- NBFC-AA Certificate of Registration
- MOA & AOA with AA objects
- Board & committee charters
- CoR conditions & undertakings
- Fit & Proper declarations
- RBI & supervisory correspondence
Tech & Consent Artefacts
- ReBIT API implementation docs
- Consent artefact templates
- Revocation & dashboard flows
- Encryption & key management design
- Audit logs & data flow diagrams
- IS & cyber security policy
- Business continuity & DR plan
Policy & Compliance
- Privacy & DPDP policy
- Grievance redressal framework
- KYC / AML / PMLA policy
- Outsourcing & vendor policy
- FIP / FIU onboarding SOPs
- Customer charter
- Sahamati-related undertakings
Our NBFC-AA Compliance Approach
1
Diagnostic
Review current AA model, CoR conditions, policies, and tech stack against RBI & ReBIT norms.
2
Gap Assessment
Identify gaps in consent framework, data flows, DPDP readiness, IS controls, and reporting.
3
Remediation
Build the remediation plan — policies, flows, contractual changes, tech fixes, and training.
4
Implementation
Hands-on support for policy rollout, process changes, artefact updates, and user training.
5
Monitoring
Ongoing compliance calendar, RBI returns, IS audit coordination, and incident response support.
Why Robust AA Compliance Matters
✓
Protect your CoR and supervisory standing
✓
Avoid penalties under RBI and DPDP Act
✓
Strengthen customer trust in your AA brand
✓
Remain Sahamati-compliant and ecosystem-ready
✓
Pass IS audits and RBI inspections cleanly
✓
Onboard quality FIPs & FIUs faster
✓
Robust consent architecture and audit trails
✓
Credibility with investors, partners & regulators
Ongoing Compliance Obligations for NBFC-AAs
NOF & Leverage
Continuous maintenance of minimum NOF and compliance with leverage / prudential norms.
RBI Returns
AA-specific periodic returns, event-based disclosures, and supervisory reporting.
Consent & Audit Trails
Logging of every consent, fetch, and data flow with immutable audit trails.
DPDP Compliance
Notice, consent, DPO, rights, and breach reporting obligations under DPDP Act.
IS Audit & CERT-In
Periodic IS audit, incident reporting to CERT-In, and cyber resilience testing.
Sahamati Rulebook
Alignment with Sahamati operational rules, dispute resolution, and conduct standards.
Grievance Redressal
Customer grievance cell, RBI IOS integration where applicable, and public disclosures.
Corporate Filings
MCA filings (AOC-4, MGT-7, DIR-3 KYC), statutory audit, income tax, and GST.
FAQs on NBFC-AA Compliance
What is an NBFC-AA?
An NBFC-AA is a specialized Non-Banking Financial Company registered with the Reserve Bank of India under the NBFC-AA Master Directions. It acts as a data-blind consent manager that transports a customer’s financial data between a Financial Information Provider (FIP) and a Financial Information User (FIU), strictly on the basis of explicit customer consent.
What are the key compliance pillars for an NBFC-AA?
Key pillars include continuous compliance with the NBFC-AA Master Directions, ReBIT technical specifications, Sahamati rulebook, DPDP Act, CERT-In cyber obligations, PMLA / FIU-IND reporting, corporate and tax compliance, and a strong consent architecture backed by end-to-end audit trails.
Can an NBFC-AA see or store customer data?
No. By design, an NBFC-AA is data-blind. It only transports encrypted data from the FIP to the FIU on the basis of the customer’s consent. It cannot read the content of the data, retain the payload, or use it for any purpose of its own. Any deviation from this design is a fundamental breach of the framework.
Does DPDP Act apply to NBFC-AAs?
Yes. The DPDP Act, 2023 applies to all entities processing personal data, including NBFC-AAs. This includes obligations around notice, consent, purpose limitation, customer rights, grievance redressal, breach reporting, and appointment of a Data Protection Officer where applicable.
What is the role of Sahamati?
Sahamati is the self-regulatory body for the Account Aggregator ecosystem. While it is not a statutory regulator, it plays a critical role in onboarding, certification, interoperability, dispute resolution, and adoption of operational rulebooks for AA participants. Alignment with Sahamati rules is expected in practice by counterparties and supervisory authorities.
Is an IS audit mandatory for NBFC-AAs?
Yes. Given the sensitive nature of AA operations, an IS audit is a core compliance expectation. NBFC-AAs are required to maintain robust information security controls, undergo periodic IS audits, follow CERT-In reporting obligations, and maintain business continuity and disaster recovery arrangements.
Can an NBFC-AA offer lending or investment advice?
No. NBFC-AAs are prohibited from undertaking any financial activity other than account aggregation. They cannot lend, invest, hold customer funds, sell financial products, or provide advice. The only permissible activity is the data-blind transport of customer data between FIPs and FIUs on the basis of consent.
What are the consequences of AA non-compliance?
Non-compliance can lead to monetary penalties under RBI and DPDP Act, restrictions or conditions on the AA CoR, supervisory action, reputational damage, loss of partners, Sahamati-level consequences, and in severe cases, cancellation of the Certificate of Registration itself. Personal liability of directors and key officers can also arise in specific circumstances.
Run a Regulator-Grade, Ecosystem-Ready NBFC-AA
Partner with our specialists for end-to-end NBFC-AA compliance — consent architecture, ReBIT & Sahamati readiness, DPDP alignment, IS audit, and ongoing RBI reporting, all under one roof.
Talk to an Expert