India Account Aggregator Framework (RBI)
India's regulation for account aggregators: the Reserve Bank of India's 2025 Directions for non-banking financial companies that retrieve customers' financial information from banks, insurers, depositories, pension and GST systems and pass it, on a signed and revocable consent artefact, to the customer or a regulated user, without storing it. Registration and capital, eleven operating duties, the consent architecture, obligations of information providers and users, data security and IS audit, ReBIT interface standards, customer grievance and pricing rules, and corporate governance.
India Account Aggregator Framework (RBI) is a compliance framework from India (Reserve Bank of India) with 8 domains and 67 controls that map to 48 other frameworks. The largest domains are Chapter IV: Corporate governance and change of control – India Account Aggregator Framework (RBI) (13 controls), Chapter III A: Duties and responsibilities of an NBFC-AA – India Account Aggregator Framework (RBI) (11 controls), Chapter III C to E: Financial Information Providers and Users – India Account Aggregator Framework (RBI) (11 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
Chapter II: Board policies and registration – India Account Aggregator Framework (RBI)
| Code | Title |
|---|---|
| india-account-aggregator-framework-rbi::10 | Para 10: Board-approved policies with periodic review |
| india-account-aggregator-framework-rbi::11(1) | Para 11(1): only a company may carry on account aggregation |
| india-account-aggregator-framework-rbi::11(2) | Para 11(2): certificate of registration before commencing |
| india-account-aggregator-framework-rbi::11(3) | Para 11(3): net owned fund of at least two crore rupees |
| india-account-aggregator-framework-rbi::12(1) | Para 12(1): application on the PRAVAAH portal |
| india-account-aggregator-framework-rbi::12(2) | Para 12(2): registration conditions met and kept |
| india-account-aggregator-framework-rbi::12(5) | Para 12(5): technology platform and legal documentation within the in-principle approval |
| india-account-aggregator-framework-rbi::13 | Para 13: investment from FATF non-compliant jurisdictions (applicants) |
Chapter III A: Duties and responsibilities of an NBFC-AA – India Account Aggregator Framework (RBI)
| Code | Title |
|---|---|
| india-account-aggregator-framework-rbi::14(1) | Para 14(1): services only on the customer's explicit consent |
| india-account-aggregator-framework-rbi::14(10) | Para 14(10): Citizen's Charter and no disclosure without explicit consent |
| india-account-aggregator-framework-rbi::14(11) | Para 14(11): provider records prevail over AA statements |
| india-account-aggregator-framework-rbi::14(2) | Para 14(2): services backed by agreements among AA, customer and providers |
| india-account-aggregator-framework-rbi::14(3) | Para 14(3): no support for customer transactions |
| india-account-aggregator-framework-rbi::14(4) | Para 14(4): proper customer identification |
| india-account-aggregator-framework-rbi::14(5) | Para 14(5): sharing only with the customer or authorised users per the consent |
| india-account-aggregator-framework-rbi::14(6) | Para 14(6): no business other than account aggregation |
| india-account-aggregator-framework-rbi::14(7) | Para 14(7): no customer financial information resides with the AA |
| india-account-aggregator-framework-rbi::14(8) | Para 14(8): no third-party service provider for the aggregation business |
| india-account-aggregator-framework-rbi::14(9) | Para 14(9): no access to customers' provider authentication credentials |
Chapter III B: Consent architecture – India Account Aggregator Framework (RBI)
| Code | Title |
|---|---|
| india-account-aggregator-framework-rbi::15 | Para 15: no retrieval, sharing or transfer without explicit consent |
| india-account-aggregator-framework-rbi::16 | Para 16: obtaining, submitting and managing consent |
| india-account-aggregator-framework-rbi::17 | Para 17: standardised consent artefact with the prescribed details |
| india-account-aggregator-framework-rbi::19 | Para 19: informing the customer when consent is obtained |
| india-account-aggregator-framework-rbi::20 | Para 20: revocation of consent, in whole or in part |
| india-account-aggregator-framework-rbi::21 | Para 21: consent artefacts logged, auditable and verifiable |
Chapter III C to E: Financial Information Providers and Users – India Account Aggregator Framework (RBI)
| Code | Title |
|---|---|
| india-account-aggregator-framework-rbi::22 | Para 22: providers share on a valid consent artefact |
| india-account-aggregator-framework-rbi::23 | Para 23: providers verify consent, dates, usage and AA credentials |
| india-account-aggregator-framework-rbi::24 | Para 24: providers digitally sign and securely transmit |
| india-account-aggregator-framework-rbi::25 | Para 25: providers respond in real time |
| india-account-aggregator-framework-rbi::26(1) | Para 26(1): providers implement interfaces for consent submission and mutual authentication |
| india-account-aggregator-framework-rbi::26(2) | Para 26(2): providers verify consent signatures |
| india-account-aggregator-framework-rbi::26(3) | Para 26(3): providers digitally sign shared information |
| india-account-aggregator-framework-rbi::26(4) | Para 26(4): providers log requests and actions and submit the log to the AA |
| india-account-aggregator-framework-rbi::27 | Para 27: AA verifies the user and transfers securely per the consent |
| india-account-aggregator-framework-rbi::28 | Para 28: no use or disclosure beyond the consent artefact |
| india-account-aggregator-framework-rbi::29 | Para 29: Reserve Bank entities joining as users must also join as providers |
Chapter III F and H: Data security and technical specifications – India Account Aggregator Framework (RBI)
| Code | Title |
|---|---|
| india-account-aggregator-framework-rbi::30(1) | Para 30(1): IT framework and interfaces for secure data flows |
| india-account-aggregator-framework-rbi::30(2) | Para 30(2): no request or storage of customer credentials; consent-based access only |
| india-account-aggregator-framework-rbi::30(3) | Para 30(3): technology scalable to new information and providers |
| india-account-aggregator-framework-rbi::30(4) | Para 30(4): safeguards against unauthorised access, alteration, destruction, disclosure or dissemination |
| india-account-aggregator-framework-rbi::30(5) | Para 30(5): disaster risk management and business continuity |
| india-account-aggregator-framework-rbi::30(6) | Para 30(6): biennial IS audit by CISA-certified external auditors, report to RBI within a month |
| india-account-aggregator-framework-rbi::33 | Para 33: adopt the ReBIT technical specifications as updated |
| india-account-aggregator-framework-rbi::34 | Para 34: AA systems carry every function the Directions require |
Chapter III I to L: Customer rights, grievances, ombudsman and pricing – India Account Aggregator Framework (RBI)
| Code | Title |
|---|---|
| india-account-aggregator-framework-rbi::35 | Para 35: customer access to the record of consents and recipients |
| india-account-aggregator-framework-rbi::36 | Para 36: no use or access beyond the requested aggregation service |
| india-account-aggregator-framework-rbi::37 | Para 37: Board-approved grievance policy and dedicated set-up |
| india-account-aggregator-framework-rbi::38 | Para 38: complaints disposed of within one month |
| india-account-aggregator-framework-rbi::39 | Para 39: display of the Grievance Redressal Officer and the right to appeal to RBI |
| india-account-aggregator-framework-rbi::40 | Para 40: compliance with the Integrated Ombudsman Scheme where covered |
| india-account-aggregator-framework-rbi::41 | Para 41: Board-approved, transparent and public pricing |
Chapter IV: Corporate governance and change of control – India Account Aggregator Framework (RBI)
| Code | Title |
|---|---|
| india-account-aggregator-framework-rbi::42 | Para 42: internal review of controls and integrity of IT records |
| india-account-aggregator-framework-rbi::43 | Para 43: Board experience as required by the Governance Directions |
| india-account-aggregator-framework-rbi::44 | Para 44: Audit Committee as required by the Governance Directions |
| india-account-aggregator-framework-rbi::45 | Para 45: Nomination Committee of at least three directors |
| india-account-aggregator-framework-rbi::46 | Para 46: documented risk management framework with technology risk, resilience and strong authentication |
| india-account-aggregator-framework-rbi::47 | Para 47: Risk Management Committee with technology risk oversight |
| india-account-aggregator-framework-rbi::48(1) | Para 48(1): Board-approved fit and proper policy for directors, MD and CEO |
| india-account-aggregator-framework-rbi::48(2) | Para 48(2): annual auditor-certified statement on change of directors |
| india-account-aggregator-framework-rbi::49 | Para 49: financial statement disclosures |
| india-account-aggregator-framework-rbi::50 | Para 50: prior RBI approval for change of control, shareholding and management |
| india-account-aggregator-framework-rbi::52 | Para 52: public notice of change in control or management |
| india-account-aggregator-framework-rbi::53 | Para 53: reporting changes of address, directors, auditors and signatories |
| india-account-aggregator-framework-rbi::54 | Para 54: ongoing compliance on investment from FATF non-compliant jurisdictions |
Chapter V: Miscellaneous instructions – India Account Aggregator Framework (RBI)
| Code | Title |
|---|---|
| india-account-aggregator-framework-rbi::55 | Para 55: dividend declaration norms |
| india-account-aggregator-framework-rbi::56 | Para 56: outsourcing arrangements aligned to the Outsourcing Directions |
| india-account-aggregator-framework-rbi::57 | Para 57: returns prescribed by the Reserve Bank |
Your Compliance Coverage
If you comply with India Account Aggregator Framework (RBI), you already cover:
Maps to 48 other frameworks
Coverage is not the same as your position
This page shows what India Account Aggregator Framework (RBI) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is India Account Aggregator Framework (RBI) and who does it apply to?
India Account Aggregator Framework (RBI) is a compliance framework from India (Reserve Bank of India) with 8 domains and 67 controls. India's regulation for account aggregators: the Reserve Bank of India's 2025 Directions for non-banking financial companies that retrieve customers' financial information from banks, insurers, depositories, pension and GST systems and pass it, on a signed and revocable consent artefact, to the customer or a regulated user, without storing it. Registration and capital, eleven operating duties, the consent architecture, obligations of information providers and users, data security and IS audit, ReBIT interface standards, customer grievance and pricing rules, and corporate governance. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does India Account Aggregator Framework (RBI) actually require?
India Account Aggregator Framework (RBI) has 67 controls organised across 8 domains. The largest domains are Chapter IV: Corporate governance and change of control – India Account Aggregator Framework (RBI) (13 controls), Chapter III A: Duties and responsibilities of an NBFC-AA – India Account Aggregator Framework (RBI) (11 controls), Chapter III C to E: Financial Information Providers and Users – India Account Aggregator Framework (RBI) (11 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of India Account Aggregator Framework (RBI) do I already cover?
India Account Aggregator Framework (RBI) maps to 48 other compliance frameworks. The top mapping partners are Family Educational Rights and Privacy Act (FERPA) (3% coverage), ISO/IEC 27557:2022 - Organisational Privacy Risk Management (3% coverage), ISO/IEC 29100:2024 (3% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement India Account Aggregator Framework (RBI)?
Start your India Account Aggregator Framework (RBI) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about India Account Aggregator Framework (RBI) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 67 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required