NBFC Account Aggregator Licence: Eligibility, Audit, RBI Approval

An NBFC Account Aggregator (NBFC-AA) licence lets a company retrieve, consolidate and share a customer’s financial information across banks, mutual funds, insurers and lenders, with the customer’s explicit consent, without ever storing or using that data itself. The Reserve Bank of India regulates this class of non-banking financial company under the Reserve Bank of India (Non-Banking Financial Companies, Account Aggregator) Directions, 2025, notified on November 28, 2025, which repealed and replaced the earlier 2016 Master Direction and its February 2024 amendment. For wealthtech platforms, lending infrastructure providers and data aggregation businesses, the licence is the only route to becoming a first-party node in India’s Account Aggregator ecosystem rather than a downstream consumer of someone else’s consent architecture. This article sets out who can apply, what RBI expects at each stage, what audits a licensed AA must run, and what changed with the RBI’s June 2026 recognition of an industry-wide Self-Regulatory Organisation.

What is the minimum net owned funds required for an NBFC-AA licence?

RBI requires a minimum Net Owned Funds (NOF) of ₹2 crore for an NBFC Account Aggregator, a figure carried forward unchanged into paragraph 11(3) of the Reserve Bank of India (Non-Banking Financial Companies, Account Aggregator) Directions, 2025. A company that does not have the ₹2 crore NOF at the time of seeking registration can still apply, provided it meets the requirement within the validity period of its in-principle approval, and its leverage ratio cannot exceed 7:1 at any point (paragraph 11(3) and paragraph 12(2)(vi), Account Aggregator Directions, 2025).

What is an NBFC account aggregator and where does it sit in India’s data sharing architecture?

An NBFC-AA is a licensed intermediary that moves financial data between two categories of regulated entities on a customer’s instruction, and no financial information it accesses from a Financial Information Provider may reside with it (paragraph 14(7), Account Aggregator Directions, 2025). The two counterparties are Financial Information Providers (FIPs), which hold the customer’s data, defined to include banks, NBFCs, asset management companies, depositories, insurance companies, insurance repositories, the NPS Central Recordkeeping Agency, the Goods and Services Tax Network and the Clearing Corporation of India Limited for Retail Direct Gilt accounts, and Financial Information Users (FIUs), any entity registered with a financial sector regulator, which consume that data to underwrite a loan, assess a wealth portfolio or verify KYC (paragraph 8, Account Aggregator Directions, 2025). The AA sits in the middle as a consent broker, retrieving a signed consent artefact from the customer and passing digitally signed data between FIP and FIU without a readable copy touching its own servers.

This architecture is what RBI and the industry call the Data Empowerment and Protection Architecture (DEPA), and it spans four financial sector regulators plus the Department of Revenue. RBI licenses the AA itself and most FIPs and FIUs in banking and NBFC lending, while the Securities and Exchange Board of India, the Insurance Regulatory and Development Authority of India and the Pension Fund Regulatory and Development Authority each bring their own regulated entities into the ecosystem as FIPs or FIUs, and the Department of Revenue acts as GSTN’s regulator for the purpose of sharing Form GSTR-1 and Form GSTR-3B data as Financial Information (paragraph 8(9) and 8(10), Account Aggregator Directions, 2025), which is what makes GST-return-based cash flow lending to MSMEs possible through the AA rails.

The consent architecture itself is specified in detail, not left to each AA’s discretion. Every consent artefact an NBFC-AA obtains must record the customer’s identity, the nature of the financial information requested, the purpose of collecting it, the identity of the recipients, a notification address, and the consent’s creation and expiry dates, and it must be capable of being logged, audited and verified electronically (paragraph 17, Account Aggregator Directions, 2025). RBI does not leave the underlying technical protocol to each AA either: the Reserve Bank Information Technology Private Limited (ReBIT) publishes the core API specifications that every NBFC-AA, FIP and FIU is expected to adopt, on rebit.org.in, and it is the AA’s own responsibility to ensure its systems conform to those specifications as they are updated (paragraph 32 and 33, Account Aggregator Directions, 2025).

Every NBFC-AA remains permanently in the Base Layer of RBI’s four-tier scale-based regulatory structure, regardless of its balance sheet size (paragraph 6, Account Aggregator Directions, 2025, read with the Reserve Bank of India, Non-Banking Financial Companies, Registration, Exemptions and Framework for Scale Based Regulation Directions, 2025). This matters for a wealthtech or lending infra founder comparing licence categories, because it means an AA never migrates to the Middle Layer or Upper Layer prudential regime that applies to larger NBFCs, even as transaction volumes scale into the hundreds of millions of consent requests a year.

The scale a licensed AA is expected to operate at is no longer theoretical. The ecosystem now runs into hundreds of Financial Information Providers and Financial Information Users live on the rails, and participation has grown steadily each year since the 2016 launch, though coverage across licensed AAs is uneven, a company holding an NBFC-AA licence does not automatically have live integrations with every FIP a lending or wealthtech underwriting flow needs. This is a due diligence point a wealthtech founder should check before deciding to build an in-house AA rather than integrate with an existing one.

Who is eligible to apply for an NBFC-AA licence in India?

A company qualifies to apply for an NBFC-AA licence only if it is incorporated under the Companies Act, restricts its business entirely to account aggregation, and meets a fixed set of capital, governance and promoter conditions that RBI checks before granting even the in-principle approval (paragraph 11 and paragraph 12(2), Account Aggregator Directions, 2025). A fintech founder working off an older checklist based on the 2016 Master Direction should treat that checklist as void, since the paragraph numbering and supporting cross-references changed entirely with the November 2025 rewrite.

The restricted business condition is the one most founders underestimate. An NBFC-AA cannot undertake any business other than account aggregation, though deployment of its investible surplus in instruments, provided this is not for trading, is expressly permitted (paragraph 14(6), Account Aggregator Directions, 2025). A lending infra platform that wants both a loan origination system and an AA arm needs two separate corporate entities, with the AA entity walled off in ownership and governance from any lending or advisory business it might otherwise run.

One exclusion sits ahead of all these conditions and decides whether a company needs to apply at all. An entity that is already regulated by another financial sector regulator, such as a SEBI-registered investment adviser or an IRDAI-licensed insurer, and that aggregates only the financial information of customers within its own regulated sector, does not need a separate NBFC-AA registration for that activity (proviso to paragraph 11(2), Account Aggregator Directions, 2025). The exclusion disappears the moment that entity starts pulling data across sectors, for example combining securities data with banking data for the same customer, at which point it needs its own NBFC-AA licence or a tie-up with a licensed AA.

Foreign capital is not a barrier at the eligibility stage. NBFC-AA falls within “Other Financial Services” under the FDI framework, which permits 100 percent foreign investment under the automatic route for financial services activities regulated by an Indian financial sector regulator, subject to the capitalisation and fit-and-proper conditions that RBI itself sets for the AA category (A.P. (DIR Series) Circular No. 8, RBI, October 2016). A wealthtech applicant with an offshore holding company or a venture fund based outside a FATF-compliant jurisdiction should map the full shareholding chain before filing, since RBI checks controlling interest, not just the immediate cap table.

What documents and business plan does RBI expect at the application stage?

RBI does not grant an in-principle approval on a bare application form. It expects a complete regulatory dossier that demonstrates the applicant can run a consent-based data pipeline at scale from day one, and incomplete filings are the single most common reason applications sit in the query cycle for months. The core filing package includes the following.

• Certificate of incorporation, Memorandum and Articles of Association, and board resolution authorising the NBFC-AA application
• Shareholding pattern showing ultimate beneficial ownership, with fit and proper declarations for every director and every shareholder holding a controlling stake
• A multi-year business plan covering projected FIP and FIU tie-ups, revenue model, and capital infusion schedule
• An IT and data architecture note covering API specifications aligned to ReBIT’s published technical standards, encryption standards, consent artefact lifecycle management, and data localisation compliance
• Board-approved policies for customer grievance handling, pricing of services, and fit and proper assessment of directors and the CEO, since these three are explicitly required before registration under paragraph 10 of the Account Aggregator Directions, 2025
• Governance charter showing the composition of the Nomination Committee and the Risk Management Committee and their reporting line to the board
• Net worth certificate from a chartered accountant confirming the applicant’s capital position against the ₹2 crore NOF threshold

Every one of these documents is filed through RBI’s PRAVAAH portal (Platform for Regulatory Application, Validation and Authorisation), which the Account Aggregator Directions, 2025 itself names as the filing channel to the Department of Regulation, Mumbai (paragraph 12(1), Account Aggregator Directions, 2025), and which has in any case been mandatory for all RBI regulatory applications since May 1, 2025. Applicants who prepared a filing package assuming the older physical or email-based submission route need to re-map every attachment against PRAVAAH’s upload fields, since the portal enforces its own document checklist per application type.

How does the RBI approval process for an NBFC-AA licence actually work?

RBI grants an NBFC-AA licence in two distinct stages, an in-principle approval followed by a certificate of registration, and treating the first stage as a finished licence is the most expensive misreading a founder can make. The in-principle approval is RBI’s conditional acknowledgment that the applicant’s structure and business plan meet the eligibility bar, valid for twelve months from the date of grant (paragraph 12(3) and 12(4), Account Aggregator Directions, 2025).

During that twelve month window, the company must build and test its technology platform, execute the legal agreements required with prospective FIPs and FIUs, and report its compliance position back to RBI. Only after RBI is satisfied that the company is operationally ready does it issue the certificate of registration (CoR), the document that actually authorises commercial launch (paragraph 12(5), Account Aggregator Directions, 2025). A company that signs FIU contracts or starts onboarding customers on the strength of the in-principle approval alone is operating without a registration, which exposes both the company and its FIP or FIU counterparties to RBI action.

What audits and disclosures apply to a licensed NBFC-AA?

A licensed NBFC-AA carries a distinct audit and disclosure load compared with most other Base Layer NBFCs, because its entire business model depends on demonstrating that customer data never leaves the consent-defined path. Two audit streams apply. A statutory financial audit runs under the Companies Act, and a separate Information System Audit of internal systems and processes must be conducted by an external auditor holding Certified Information System Auditor (CISA) accreditation, at least once every two years, with the report submitted to the Regional Office of RBI’s Department of Supervision within one month of the auditor submitting it (paragraph 30(6), Account Aggregator Directions, 2025). Founders who assume this audit is annual, based on older guidance, are over-budgeting the frequency but should not treat the two-year cycle as a reason to under-resource the audit itself, since the technical bar it tests against has not softened.

A separate governance certificate runs alongside the two audits. Every NBFC-AA must furnish RBI an annual statement, certified by its Statutory Auditors, confirming that fit and proper criteria were followed for any change in directors, managing director or CEO during the year, due at the Regional Office of RBI within 15 days of the financial year’s close (paragraph 48(2), Account Aggregator Directions, 2025). RBI separately retains the power to inspect any NBFC-AA at any time it considers fit, through its own officers or appointed persons (paragraph 58, Account Aggregator Directions, 2025), so a company that has not kept its audit trail, consent logs and board minutes inspection-ready should expect that gap to surface during a routine supervisory visit, not just during the CoR application.

Governance requirements sit alongside the audits. An NBFC-AA must maintain both a Nomination Committee, of at least three board members, to assess director fitness on a continuing basis, and a Risk Management Committee, also of at least three members, constituted at either board or executive level, with oversight of technology risk, system reliability and authentication controls (paragraphs 45 to 47, Account Aggregator Directions, 2025). It must also follow RBI’s Guidance Note on Operational Risk Management and Operational Resilience, reissued November 28, 2025 to replace the April 2024 version (paragraph 31, Account Aggregator Directions, 2025), and route customer grievances that remain unresolved after one month through the Reserve Bank, Integrated Ombudsman Scheme, 2021 (paragraph 40, Account Aggregator Directions, 2025). Disclosure obligations follow the Reserve Bank of India, Non-Banking Financial Companies, Financial Statements: Presentation and Disclosures Directions, 2025 (paragraph 49, Account Aggregator Directions, 2025), which are additional to, not a substitute for, whatever the Companies Act already requires.

Any change in shareholding, control or takeover of an NBFC-AA needs RBI’s prior written approval before it takes effect (paragraph 50, Account Aggregator Directions, 2025, read with the Reserve Bank of India, Non-Banking Financial Companies, Acquisition of Shareholding or Control Directions, 2025), which is a filing a wealthtech founder needs to plan for well before a priced funding round closes. Dividend declarations follow the Reserve Bank of India, Non-Banking Financial Companies, Prudential Norms on Declaration of Dividends Directions, 2025, which conditions any payout on three years of sustained capital adequacy, a net NPA ratio below the prescribed threshold, and the absence of any supervisory restriction on the company; the exact payout ceiling that applies to an NBFC-AA’s specific profile should be confirmed against the current version of that Direction before a board approves a dividend, since it varies by NBFC category and is not a single flat percentage across all NBFC types.

How does the RBI-recognised SRO-AA change compliance for account aggregators?

In June 2026, RBI formally recognised an industry body as the Self-Regulatory Organisation for the Account Aggregator ecosystem (SRO-AA), under the Framework for recognising Self-Regulatory Organisations for the Account Aggregator Ecosystem issued on March 12, 2025 (RBI press release 2026-2027/392, dated June 5, 2026). This is a genuinely new layer of governance for anyone applying for or already holding an NBFC-AA licence, and it sits alongside RBI’s direct regulation rather than replacing it.

The SRO-AA’s mandate covers standard-setting across the ecosystem, common technical and legal agreements between FIPs, FIUs and AAs, dispute resolution mechanisms, and coordination on operational issues that arise from having four different financial sector regulators overseeing different participants in the same data pipeline. For a lending infra or data platform business either applying for an AA licence now or already operating one, this means two practical changes from 2026 onward. Membership expectations and common technical standards issued by the SRO will sit on top of RBI’s Account Aggregator Directions, 2025, so a compliance calendar built purely around RBI’s own filings will miss SRO-level requirements. Second, RBI’s recognition order emphasises that the SRO itself must maintain strong governance, an independent board and transparent decision-making, so applicants should expect the SRO to formalise onboarding, dispute-resolution and common-agreement templates that were previously handled informally across the AA ecosystem.

Common mistakes that cost founders time and money

Founders applying for an NBFC-AA licence tend to repeat a narrow set of errors, and each one carries a real cost in either delayed approval or a regulatory action after launch.

• Treating in-principle approval as a licence to operate. Signing FIU contracts or onboarding customers before the certificate of registration is granted is unregistered business activity under paragraph 12(1) of the Account Aggregator Directions, 2025, and RBI can cancel the in-principle approval outright. Carrying on NBFC business without a certificate of registration is separately punishable under Section 58B(4A) of the RBI Act, 1934, with imprisonment of one to five years and a fine of ₹1 lakh to ₹5 lakh, so this is not a purely administrative risk.
• Diversifying into lending or data monetisation. An AA that starts cross-selling loans or analytics off the data it moves breaches the restricted business condition, and RBI can cancel a certificate of registration where a company is found no longer eligible to hold it (paragraph 12(6), Account Aggregator Directions, 2025).
• Leaving the CISA system audit to the last quarter of the in-principle window. A genuine information system audit against RBI’s and ReBIT’s technical expectations takes longer than most founders budget, and a rushed audit report invites further RBI queries rather than closing the file.
• Assembling a Nomination or Risk Management Committee only on paper. Both committees now need real minimum membership and a documented mandate before registration, not a board resolution created the week the application is filed.
• Not planning the shareholding-change approval before a funding round. A priced round that changes control or crosses a shareholding threshold needs RBI’s prior written approval, and a term sheet signed without that approval built into the closing conditions can stall the entire round.
• Assuming a FATF check is a one-time exercise. New investors entering later rounds also need to be checked against the FATF jurisdictional condition, not just the founding shareholders.

What we have seen at Treelife on live NBFC-AA engagements

In the NBFC-AA engagements we have run at Treelife, the recurring point of friction is not the ₹2 crore net owned funds threshold, which most wealthtech and lending infra founders clear comfortably by the time they are ready to apply. It is the gap between what a technology team thinks “consent architecture readiness” means and what RBI’s application reviewers actually test for during the in-principle approval stage. RBI reviewers routinely ask for the specific API version and encryption standard the applicant intends to run against, benchmarked against ReBIT’s published specifications, not just a description of the intended architecture, and applicants who file a business plan written in product-roadmap language rather than the technical specification RBI expects lose two to three review cycles just re-answering the same question in more precise terms.

The other pattern only visible from running live transactions is how tightly the shareholding-change approval interacts with fundraising timelines. We have seen a Series A round delayed by six weeks purely because the RBI approval for the incoming investor’s shareholding was filed after the term sheet was signed rather than before, when it should sit as a condition precedent to closing, not a post-closing formality.

FAQ’s on NBFC Account Aggregator Licence: Eligibility, Audit, RBI Approval

Q: Is GST payable on the fees an account aggregator charges FIUs?
A: Account aggregation is a supply of service and is expected to attract GST at the standard 18 percent rate applicable to financial services, since no specific exemption notification currently carves out AA fees the way certain payment aggregator settlement services are exempted. Confirm the applicable rate and any sector-specific circular with a GST practitioner before pricing FIU contracts, since CBIC has not issued an AA-specific clarification to date.

Q: What is the cost of applying for an NBFC-AA licence in India?
A: RBI charges no official application fee under the Account Aggregator Directions, 2025. The real cost sits in the ₹2 crore net owned funds requirement, legal and compliance advisory for the filing, the CISA system audit, and the technology build needed to meet RBI’s and ReBIT’s IT architecture expectations before the certificate of registration is granted.

Q: How long does the entire NBFC-AA licensing process take?
A: Most applicants should plan for 12 to 18 months end to end, covering document preparation, RBI’s review and query cycle for the in-principle approval, the twelve month platform build window, and the final inspection before the certificate of registration is issued.

Q: What documents does RBI require for an NBFC-AA application?
A: Certificate of incorporation, MoA and AoA, shareholding pattern with fit and proper declarations, a business plan, an IT and data architecture note, board-approved grievance, pricing and fit-and-proper policies, and a net worth certificate confirming the ₹2 crore NOF, all filed through the PRAVAAH portal.

Q: Is CISA certification mandatory for the account aggregator’s system audit?
A: The Information System Audit for an NBFC-AA must be conducted by an external auditor holding Certified Information System Auditor accreditation, at least once every two years, with the report submitted to RBI’s Regional Office within one month of the auditor’s report.

Q: Can foreign investors hold shares in an NBFC-AA?
A: Yes. NBFC-AA falls within “Other Financial Services” under the FDI framework, which permits up to 100 percent foreign investment under the automatic route, subject to RBI’s fit and proper and FATF jurisdictional conditions on the ultimate shareholding chain.

Q: What is the difference between in-principle approval and the certificate of registration?
A: In-principle approval is a conditional twelve month clearance to build the platform and finalise FIP or FIU agreements. The certificate of registration is the final authorisation to commence commercial operations, granted only after RBI is satisfied the company is operationally ready.

Q: Does DPIIT recognition as a startup help with NBFC-AA licensing?
A: No. NBFC-AA registration is a standalone RBI licensing process with its own capital, governance and technology conditions, and DPIIT startup recognition carries no exemption or fast-track benefit under the Account Aggregator Directions, 2025.

Q: What happens if a shareholding change or acquisition occurs after the licence is granted?
A: Any takeover, acquisition of control, or change in shareholding of an NBFC-AA requires RBI’s prior written approval before it takes effect, and this should be built into fundraising or M&A timelines as a condition precedent, not a post-closing formality.

Q: Does every account aggregation business need a separate NBFC-AA licence?
A: No. An entity already regulated by another financial sector regulator, such as SEBI or IRDAI, does not need a separate NBFC-AA licence if it aggregates only the financial information of customers within its own regulated sector, under the proviso to paragraph 11(2) of the Account Aggregator Directions, 2025. Aggregating data across sectors removes this exclusion.

Q: Can an NBFC-AA also run a lending or investment advisory business?
A: No. RBI restricts an NBFC-AA’s business entirely to account aggregation, with only non-trading deployment of its investible surplus permitted as an exception, and a separate corporate entity, walled off in ownership and governance, is required for any lending, advisory or data monetisation activity.

Q: What happens if RBI finds a licensed NBFC-AA no longer meets its conditions?
A: RBI can cancel the certificate of registration if the company stops operating as an account aggregator, breaches any condition attached to its registration, or is found no longer eligible to hold the registration.

Q: How does the recognition of a Self-Regulatory Organisation for the AA ecosystem affect an existing NBFC-AA?
A: Existing and applicant NBFC-AAs should expect the SRO to issue common technical and legal standards, onboarding templates and dispute-resolution mechanisms that sit alongside RBI’s Account Aggregator Directions, 2025, requiring compliance tracking beyond RBI’s own filings alone.

Q: What ombudsman scheme applies to customer complaints against an NBFC-AA?
A: Customer grievances against an NBFC-AA that remain unresolved after one month are handled under the Reserve Bank, Integrated Ombudsman Scheme, 2021.

Q: Is there a fixed cap on dividends an NBFC-AA can declare?
A: Not a single flat figure. Dividend eligibility depends on three years of sustained capital adequacy and a net NPA ratio below RBI’s prescribed threshold under the Reserve Bank of India, Non-Banking Financial Companies, Prudential Norms on Declaration of Dividends Directions, 2025, and the specific payout ceiling should be checked against the current Direction before a board approves a payout.

Regulatory references

• Reserve Bank of India (Non-Banking Financial Companies, Account Aggregator) Directions, 2025, RBI/DoR/2025-26/368, DoR.FIN.REC.No.287/03-10-123/2025-26, dated November 28, 2025 (repealing the Master Direction, Non-Banking Financial Company, Account Aggregator (Reserve Bank) Directions, 2016 and its February 2024 amendment)
• Reserve Bank of India (Non-Banking Financial Companies, Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025
• Reserve Bank of India (Non-Banking Financial Companies, Governance) Directions, 2025
• Reserve Bank of India (Non-Banking Financial Companies, Financial Statements: Presentation and Disclosures) Directions, 2025
• Reserve Bank of India (Non-Banking Financial Companies, Acquisition of Shareholding or Control) Directions, 2025
• Reserve Bank of India (Non-Banking Financial Companies, Prudential Norms on Declaration of Dividends) Directions, 2025

External sources

• Reserve Bank of India, Master Directions
• Reserve Bank of India
• Startup India
• Ministry of Corporate Affairs

About the Author

Share

• Link copied to clipboard!
  https://treelife.in/fintech/nbfc-account-aggregator-licence/
  
• 
• 
• 
• 

Treelife

Treelife Team | support@treelife.in

We are a legal and finance firm with a deep focus on the startup ecosystem. We offer a wide range of services, including Virtual CFO, Legal Support, Tax & Regulatory, and Global Expansion assistance.

Our goal at Treelife is to provide you with peace of mind and ease in business.