The Account Aggregator (AA) framework is India’s pioneering consent-based financial data sharing architecture, created by the Reserve Bank of India to give customers clear control over their financial information. An NBFC-AA is a specialized, data-blind intermediary — it does not lend, does not hold customer money, and does not see customer data. Its only role is to securely transport a customer’s consented financial information from a Financial Information Provider (FIP) like a bank or NBFC, to a Financial Information User (FIU) like a lender, insurer, or wealth manager.
NBFC-AAs sit at the heart of the emerging Digital Public Infrastructure (DPI) for finance. Strong AA compliance is not optional — it is a continuous blend of RBI NBFC-AA Directions, ReBIT technical standards, Sahamati ecosystem rules, Digital Personal Data Protection (DPDP) obligations, information security norms, and PMLA / AML discipline, all wrapped around a single core principle: no data flows without a valid, granular, revocable consent.
We offer end-to-end NBFC-AA compliance services — from CoR support and operating model design to consent framework implementation, ReBIT-aligned tech review, DPDP alignment, IS audit, RBI returns, ecosystem integration, and day-to-day compliance — so your AA stays regulator-ready, auditor-ready, and Sahamati-ready at all times.
Banks, NBFCs, mutual funds, insurers, and pension funds that hold the customer’s financial data.
The data-blind NBFC-AA that moves consented data from the FIP to the FIU, without seeing the content.
Regulated entities — lenders, insurers, wealth managers, advisors — that consume data to serve the customer.
Advisory on NBFC-AA registration, in-principle / final CoR, and operating model design.
Design and review of consent artefacts, dashboards, revocation flows, and audit trails.
Gap assessment of AA stack vs ReBIT technical specifications and API schemas.
Alignment with Sahamati onboarding, certification, and operational rulebook.
DPDP Act, 2023 alignment — notice, consent, rights, grievance redressal, and DPO setup.
IS policy, CERT-In reporting, cyber resilience, and periodic IS audit coordination.
Periodic AA-specific returns, CoR conditions, event disclosures, and SBR compliance.
Statutory audit, internal audit, IS audit, and responses to RBI & supervisory reviews.
No data flow without explicit, purpose-bound, and revocable customer consent.
AA only transports encrypted data between FIP and FIU; it cannot read or store payload.
Data can be used only for the specific purpose disclosed to the customer in the consent.
Only information strictly needed for the stated purpose is requested and shared.
Customers can view, manage, and revoke consent at any time via the AA app or dashboard.
Every consent, fetch, and data flow is logged to support regulator and customer audit.
NBFC-AAs cannot lend, invest, advise, or sell financial products on their own account.
Strong encryption, key management, and cyber resilience across every layer of the stack.
Review current AA model, CoR conditions, policies, and tech stack against RBI & ReBIT norms.
Identify gaps in consent framework, data flows, DPDP readiness, IS controls, and reporting.
Build the remediation plan — policies, flows, contractual changes, tech fixes, and training.
Hands-on support for policy rollout, process changes, artefact updates, and user training.
Ongoing compliance calendar, RBI returns, IS audit coordination, and incident response support.
Continuous maintenance of minimum NOF and compliance with leverage / prudential norms.
AA-specific periodic returns, event-based disclosures, and supervisory reporting.
Logging of every consent, fetch, and data flow with immutable audit trails.
Notice, consent, DPO, rights, and breach reporting obligations under DPDP Act.
Periodic IS audit, incident reporting to CERT-In, and cyber resilience testing.
Alignment with Sahamati operational rules, dispute resolution, and conduct standards.
Customer grievance cell, RBI IOS integration where applicable, and public disclosures.
MCA filings (AOC-4, MGT-7, DIR-3 KYC), statutory audit, income tax, and GST.
Partner with our specialists for end-to-end NBFC-AA compliance — consent architecture, ReBIT & Sahamati readiness, DPDP alignment, IS audit, and ongoing RBI reporting, all under one roof.
Talk to an Expert