RBI Account Aggregator Directions 2025: Consent Artefact, Data Rules and the DPDP Gap

Regulatory Explainer Fintech & Payments 28 Nov 2025 Status: in-force
TL;DR

The Reserve Bank of India (Non-Banking Financial Companies - Account Aggregator) Directions, 2025 (RBI/DoR/2025-26/368, DoR.FIN.REC.No.287/03-10-123/2025-26, 28 November 2025) consolidate and repeal the earlier NBFC-AA framework. Issued under Section 45JA of the Reserve Bank of India Act, 1934, they require a registered NBFC-AA to hold net owned funds of at least Rs 2 crore, keep a leverage ratio no higher than seven, operate on a standardised seven-attribute consent artefact, hold no customer financial data at rest, never access customer credentials, use no third-party service provider for the aggregation business, and undergo an information system audit by CISA-certified external auditors at least once every two years.

Veritect
Veritect Legal Intelligence
Legal Intelligence Agent
8 min read
Continue with Veritect

Every Fintech & Payments rule, sourced from the primary notification.

Try Veritect free Book a demo

TL;DR for Founders

The RBI (NBFC - Account Aggregator) Directions, 2025 (RBI/DoR/2025-26/368, 28 November 2025) consolidate India's account-aggregator regime into a single instrument and repeal what came before. Headline numbers: Rs 2 crore net owned funds, leverage ratio no higher than 7, 12-month in-principle approval validity, a seven-attribute standardised consent artefact, zero customer data at rest with the aggregator, zero access to banking credentials, and an information system audit by CISA-certified auditors at least once every two years. If you are building on the AA rails as a lender, wealth platform or insurer, most of these obligations reach you through the Financial Information User role, not through registration.

The Reserve Bank of India (Non-Banking Financial Companies - Account Aggregator) Directions, 2025 were issued on 28 November 2025 under Section 45JA of the Reserve Bank of India Act, 1934, and came into force on the day they were placed on the RBI website. Paragraph 61 repeals the earlier NBFC-AA directions, instructions and guidelines, communicated by circular DOR.RRC.REC.302/33-01-010/2025-26 of the same date, while preserving rights, liabilities and proceedings that arose under them.

They are part of the RBI's wider 2025 consolidation of NBFC regulation, and they sit inside it: an NBFC-AA is permanently in the Base Layer under the scale-based regulation framework, and named paragraphs of the 2025 NBFC Governance, Financial Statements, Acquisition of Shareholding or Control, Dividends, Outsourcing, Amalgamation and Miscellaneous Directions apply on top.

Registration: Who Can Be an Aggregator

  • Only a company may undertake the business of an account aggregator; no company may commence or carry it on without an RBI certificate of registration.
  • Carve-out: entities regulated by another financial sector regulator that aggregate only accounts within that regulator's own sector fall outside the registration requirement.
  • Net owned funds of at least Rs 2 crore, or such higher amount as the RBI specifies. A company below the floor at application must reach it within the validity of the in-principle approval.
  • Leverage ratio not exceeding seven — outside liabilities excluding group borrowings, over owned funds.
  • Applications are filed on the PRAVAAH portal to the Department of Regulation, Mumbai.
  • In-principle approval is valid for twelve months, during which the applicant must stand up the technology platform, complete legal documentation and report compliance before the certificate issues.
  • Registration is cancellable where the company ceases the business, breaches a condition of registration, becomes ineligible, or fails to comply with an RBI direction, maintain and publish accounts, or produce books for inspection.

The Six Prohibitions That Define the Model

The AA is designed as a data-blind, consent-driven conduit. Six paragraph-level prohibitions do the design work:

  1. No data at rest — no financial information accessed from a Financial Information Provider (FIP) shall reside with the AA (para 14(7)).
  2. No credentials — the AA shall not access, request or store customer authentication credentials such as passwords, PINs or private keys (paras 14(9), 30(2)).
  3. No third-party service provider for undertaking the account-aggregation business itself (para 14(8)).
  4. No transactions — the AA shall not support customer transactions (para 14(3)).
  5. No other business — save deployment of investible surplus in non-trading instruments (para 14(6)).
  6. No sharing without consent — nothing acquired from or on behalf of a customer leaves without explicit consent, backed by a Citizen's Charter guaranteeing customer rights (para 14(10)).

Where the AA-generated statement and the FIP's books diverge, the FIP's records prevail (para 14(11)).

Paragraph 17 fixes a standardised consent artefact with seven attributes: customer identity and optional contact information; nature of the financial information requested; purpose of collection; identity of the recipients; a URL or other address to be notified every time the artefact is used; consent creation date, expiry date and the identity and signature or digital signature of the AA; and any further attribute the RBI prescribes.

Three properties make it more than a checkbox. It is revocable at part-granularity — a customer can withdraw consent for portions of the information, after which a fresh artefact goes to the FIP (para 20). It must be loggable, auditable and verifiable (para 21). And it is verified at the FIP end: on presentation the FIP checks validity of consent, the specified dates and usage, and the AA's credentials, then digitally signs the financial information and transmits it securely on the artefact's terms, in real time (paras 23-25). FIPs must maintain a log of all information-sharing requests and the actions taken, and submit it to the AA (para 26(4)).

Downstream, the Financial Information User (FIU) may not use or disclose the information except as specified in the consent artefact (para 28) — the artefact is the outer boundary of lawful use, not merely the trigger for access.

💡 Building on the AA rails and unsure where the RBI regime ends and DPDP begins? The Veritect Legal AI platform holds the RBI Account Aggregator Directions 2025 alongside the DPDP Act 2023 consent-manager provisions and the DPDP Rules 2025 First Schedule — so you can see, clause by clause, which obligation is discharged by the consent artefact and which still needs a DPDP notice. Explore Veritect Legal AI →

Reciprocity, Data Security and Governance

Reciprocity: an RBI-regulated entity joining the ecosystem as a Financial Information User must also join as a Financial Information Provider if it holds specified financial information and meets the FIP definition (para 29). This is the clause that stops one-way extraction.

Data security (para 30): an entirely IT-driven business; an IT framework and interfaces securing flows from FIP to AA to FIU; scalable technology; safeguards against unauthorised access, alteration, destruction, disclosure or dissemination; disaster risk management and business continuity; and an information system audit at least once in two years by CISA-certified external auditors, with the report filed to the Regional Office of the RBI Department of Supervision within one month of the auditor's submission.

Technical standards: core API specifications are framed by Reserve Bank Information Technology Private Limited (ReBIT) and published at rebit.org.in; all RBI-regulated entities acting as AA, FIP or FIU are expected to adopt them as updated. The Directions are explicit that ReBIT specifications cover APIs only — ensuring the AA's systems actually perform its functions in conformity with the Directions remains the AA's responsibility (para 34).

Governance: a Nomination Committee of not fewer than three board members for fit-and-proper assessment, and a Risk Management Committee of not fewer than three board members with an express technology-risk mandate covering system security, reliability, resiliency and recoverability, and strong authentication protecting access to customer data. An annual statement on change of directors, managing director or CEO, certified by the statutory auditors, goes to the RBI Regional Office within 15 days of the close of the year.

Customer rights and grievance: the customer can access a record of the consents given and the FIUs with whom information was shared (para 35); the AA may not use customer information for anything other than the account-aggregation business the customer requested (para 36); complaints are disposed of within the board-approved policy timeline and in any case within one month, with escalation to the RBI thereafter and coverage under the Reserve Bank - Integrated Ombudsman Scheme, 2021. Pricing runs on a board-approved policy that must be transparent and in the public domain (para 41).

Where AA Meets the DPDP Act

The 2025 Directions and the Digital Personal Data Protection Act, 2023 describe overlapping but non-identical machinery, and conflating them is the most common design error in fintech builds.

NBFC-Account Aggregator DPDP Consent Manager
Statutory base Section 45JA, RBI Act 1934 Section 6(7)-(9), DPDP Act 2023; Rule 4 + First Schedule, DPDP Rules 2025
Registers with Reserve Bank of India Data Protection Board of India
Data scope 'Financial information' — 20 listed categories Personal data, all sectors
Counterparties FIPs and FIUs, both regulated entities Data fiduciaries generally
Core artefact Standardised consent artefact, 7 attributes Consent record with First Schedule obligations

A consent artefact satisfying paragraph 17 is not, by itself, a DPDP-compliant notice: the DPDP Act requires an itemised notice under Section 5 in the customer's chosen language among the Eighth Schedule options, together with the means to withdraw consent and to complain to the Board. Conversely, a DPDP consent manager registration confers no right to receive financial information over the AA rails. Institutions running both should map, per data flow, which instrument authorises the access and which authorises the downstream use.

Founder Checklist

  • If you are an RBI-regulated FIU, confirm the reciprocity trigger — if you hold specified financial information you must also join as an FIP.
  • Bound your FIU use case by the artefact. Paragraph 28 makes the consent artefact the outer limit of permitted use; a product roadmap that exceeds it needs a new artefact, not a broader privacy policy.
  • Schedule the biennial IS audit with a CISA-certified external auditor and diarise the one-month filing to the RBI Regional Office of the Department of Supervision.
  • Do not architect any credential handling. Storing or requesting a customer's FIP credentials is prohibited outright — no compensating control cures it.
  • Run a DPDP overlay assessment. The AA artefact discharges the RBI consent requirement; Section 5 notice, withdrawal mechanics and grievance routes under the DPDP Act sit on top.

Frequently Asked Questions

Q1: Can a bank act as its own account aggregator?

Only through a separately registered NBFC-AA. The carve-out for entities regulated by another financial sector regulator applies where the entity aggregates only accounts relating to financial information of customers of that particular sector — a general-purpose aggregation offering across banks, insurers, depositories and NPS requires registration.

Q2: Does the customer have to be an individual?

'Customer' means a person who has entered into a contractual arrangement with the AA. 'Person' is defined to include an individual, a Hindu undivided family, a company, a firm, an association of persons or body of individuals whether incorporated or not, and every artificial juridical person — so business account aggregation, including GSTR-1 and GSTR-3B flows, sits inside the framework.

Q3: What happens if the AA-generated statement disagrees with the bank's records?

The Financial Information Provider's records are treated as correct. Product design that reconciles or adjudicates on the AA-delivered view rather than the FIP position runs against paragraph 14(11).

Q4: Is an AA allowed to use a cloud provider or an outsourced technology partner?

Paragraph 14(8) prohibits using a third-party service provider for undertaking the business of account aggregation itself. Separately, an NBFC-AA must self-assess its existing outsourcing arrangements against the RBI (NBFC - Managing Risks in Outsourcing) Directions, 2025. The practical line runs between outsourcing the aggregation function — impermissible — and procuring general infrastructure and support services under a compliant outsourcing arrangement.

Q5: How does this interact with the RBI digital lending framework?

Directly, for any lender sourcing bank-statement or income data through the AA rails. The Reserve Bank of India (Digital Lending) Directions, 2025 govern what a regulated entity and its lending service providers may collect, store and process; the AA Directions govern how the data may lawfully reach them. A digital lender must satisfy both, and the consent artefact's stated purpose must match the lending purpose actually pursued.

Q6: Will the AA regime be superseded by the DPDP consent-manager regime?

Nothing in either instrument suggests so. The DPDP Rules, 2025 create a general-purpose, sector-neutral consent manager registered with the Data Protection Board of India; the AA regime is a prudentially regulated financial-data conduit with its own capital, leverage, audit and supervision requirements. Paragraph 63 of the 2025 Directions is explicit that they are in addition to, and not in derogation of, other laws in force.

Beyond this brief Preview

Veritect Legal AI holds the full operative chain: the RBI (NBFC - Account Aggregator) Directions, 2025 with all six chapters; the companion 2025 NBFC Directions on Governance, Outsourcing, Acquisition of Shareholding or Control and Miscellaneous matters that apply on top; the Reserve Bank of India (Digital Lending) Directions, 2025; the Reserve Bank - Integrated Ombudsman Scheme, 2021; and the Digital Personal Data Protection Act, 2023 with the DPDP Rules, 2025 First Schedule.

Practitioner-level content available on Veritect Legal AI:

  • Consent-artefact field mapping against DPDP Section 5 notice requirements
  • FIU onboarding due-diligence framework and reciprocity assessment under paragraph 29
  • IS-audit scope note for the biennial CISA-certified audit and the one-month filing obligation
  • Registration pack: net owned funds, leverage ratio, in-principle approval milestones and the twelve-month clock
  • Grievance and RBIOS escalation workflow for AA customers

Access Veritect Legal AI →

Primary Sources

Primary source

Title: Reserve Bank of India (Non-Banking Financial Companies - Account Aggregator) Directions, 2025
Issuer: Reserve Bank of India
Effective: 2025-11-28
Gazette: RBI/DoR/2025-26/368 — DoR.FIN.REC.No.287/03-10-123/2025-26

Supporting sources

Frequently asked

What are the RBI Account Aggregator Directions, 2025 and what did they replace?

The Reserve Bank of India (Non-Banking Financial Companies - Account Aggregator) Directions, 2025 were issued on 28 November 2025 under reference RBI/DoR/2025-26/368, DoR.FIN.REC.No.287/03-10-123/2025-26, in exercise of powers under Section 45JA of the Reserve Bank of India Act, 1934. They came into force on the day they were placed on the RBI website. Paragraph 61 repeals the existing directions, instructions and guidelines relating to NBFC-Account Aggregators, as communicated by circular DOR.RRC.REC.302/33-01-010/2025-26 of the same date. Actions taken under the repealed instruments continue to be governed by them, and approvals granted under the repealed framework are deemed to be governed by the 2025 Directions.

What are the registration requirements for an NBFC-Account Aggregator?

Only a company may undertake the business of an account aggregator, and no company may commence or carry it on without a certificate of registration from the RBI. Applications go through the PRAVAAH portal to the Department of Regulation, Mumbai. Net owned funds must be at least Rs 2 crore, or such higher amount as the RBI may specify; a company below that at application must meet it within the validity of the in-principle approval. The leverage ratio must not exceed seven. In-principle approval is valid for twelve months, within which the company must put the technology platform and legal documentation in place and report compliance before the certificate of registration is granted. An NBFC-AA always remains in the Base Layer under the scale-based regulation framework. Entities regulated by another financial sector regulator that aggregate only their own sector's accounts are outside the registration requirement.

What must the Account Aggregator consent artefact contain?

Paragraph 17 specifies a standardised consent artefact containing: the identity of the customer and optional contact information; the nature of the financial information requested; the purpose of collecting it; the identity of the recipients of the information, if any; a URL or other address to which a notification is sent every time the consent artefact is used to access information; the consent creation date, expiry date, and the identity and signature or digital signature of the Account Aggregator; and any other attribute the RBI prescribes. The artefact may be obtained electronically and must be capable of being logged, audited and verified. The customer must be able to revoke consent, including for parts of the information, upon which a fresh consent artefact is shared with the Financial Information Provider.

Can an Account Aggregator store customer financial data or access banking credentials?

No to both. Paragraph 14(7) provides that no financial information of the customer accessed by the NBFC-AA from Financial Information Providers shall reside with the NBFC-AA — it is a data-blind conduit, not a data store. Paragraph 14(9) provides that user authentication credentials of customers relating to accounts with Financial Information Providers shall not be accessed by the NBFC-AA, and paragraph 30(2) reinforces that the AA shall not request or store customer credentials such as passwords, PINs or private keys. Access to customer information must be based only on consent-based authorisation. Paragraph 14(8) separately prohibits the use of a third-party service provider for undertaking the business of account aggregation, and paragraph 14(3) prohibits supporting transactions.

What data security and audit obligations apply to an NBFC-AA?

Paragraph 30 requires an entirely IT-driven business with an IT framework and interfaces securing data flows from Financial Information Providers to the AA and onward to Financial Information Users; a prohibition on requesting or storing credentials; scalable technology; adequate safeguards against unauthorised access, alteration, destruction, disclosure or dissemination of records and data; disaster risk management and business continuity arrangements; and an information system audit of internal systems and processes conducted at least once in two years by CISA-certified external auditors, with the report submitted to the Regional Office of the RBI Department of Supervision within one month of the auditor's submission. Paragraphs 46 and 47 add a Risk Management Committee of not less than three board members, with oversight of technology risk and strong authentication protecting access to customer data and systems.

Is an Account Aggregator the same as a DPDP consent manager?

No. They are separate regimes with different registration authorities, different data scopes and different statutory bases. An NBFC-AA is registered with the RBI under Section 45JA of the Reserve Bank of India Act, 1934, handles only 'financial information' as defined in paragraph 8(9) of the 2025 Directions, and moves it between Financial Information Providers and Financial Information Users. A consent manager under Section 6(7) to 6(9) of the Digital Personal Data Protection Act, 2023 read with Rule 4 and the First Schedule of the DPDP Rules, 2025 registers with the Data Protection Board of India and handles personal data across all sectors. A single company can in principle hold both roles, but each carries its own registration, net-worth, record-keeping and obligation set. Neither is a substitute for the other.

What financial information can flow through the Account Aggregator network?

Paragraph 8(9) lists twenty categories: bank deposits (fixed, savings, recurring and current); deposits with NBFCs; structured investment products; commercial paper; certificates of deposit; tradable government securities; equity shares; bonds; debentures; mutual fund units; exchange traded funds; Indian depository receipts; collective investment scheme units; alternative investment fund units; insurance policies; National Pension System balances; units of infrastructure investment trusts; units of real estate investment trusts; Goods and Services Tax returns in Form GSTR-1 and Form GSTR-3B; and any other information the RBI specifies. Financial Information Providers include banks, NBFCs, asset management companies, depositories and depository participants, insurance companies, insurance repositories, the Central Recordkeeping Agency, the Goods and Services Tax Network and the Clearing Corporation of India Limited.

What are the customer grievance timelines?

An NBFC-AA must have a board-approved policy for handling and disposal of customer grievances and a dedicated setup to address them. Complaints must be disposed of within the time set in that policy and in any case within one month of receipt. The name and contact details of the Grievance Redressal Officer must be displayed on the website and at places of business, together with a statement that if the complaint is not redressed within one month the customer may appeal to the Reserve Bank. NBFCs covered by the Reserve Bank - Integrated Ombudsman Scheme, 2021 must also comply with that scheme.

Tags

rbi account-aggregator nbfc-aa consent-artefact dpdp-act-2023 consent-manager open-banking fintech-payments data-security
About Veritect

AI research & drafting, purpose-built for Indian litigation.

Veritect indexes over 50 million orders & judgments from the Supreme Court of India and all 25 High Courts, 1,000+ Central and State bare acts, and 50,000+ statutory sections — including the new BNS, BNSS, and BSA codes.

Built for Indian courts. Trusted by litigation practices from solo chambers to full-service firms.

Request a guided demo

30-minute walkthrough, then 3 weeks of free full access. Your account is activated after the meeting.