Consent-based data sharing is central to India Stack. Discuss the regulatory coordination challenges between RBI and SEBI in building a unified financial data architecture.

The Account Aggregator (AA) network is India Stack's consent layer. Over 2.2 billion accounts can now share financial data, and only with the customer's explicit permission [4]. In October 2026, RBI said it would make about 15 AAs interoperable by 31 December 2026 and add bank deposits to the depositories' Consolidated Account Statement (CAS) [1]. Together these make a unified view possible, but only if RBI and SEBI move together.

Why coordination is unavoidable

• Split jurisdiction: AAs are RBI-registered NBFCs [2]. The CAS is issued by SEBI-regulated depositories [5]. Of the first 94 data users, 73 were regulated by RBI, 10 by SEBI and the rest by IRDAI or PFRDA [3].

Coordination challenges

• Different mandates: RBI focuses on depositor protection and banking stability, while SEBI focuses on investor protection and market conduct. They may differ on who can use the data and for what.
• Technical standards: About 15 AAs need common APIs and data formats. The CAS, built on PAN-linked demat records [5], must take in deposit data that will at first come only from banks already onboarded [1]. Until all banks join, users get an incomplete picture.
• Consent after the data arrives: AAs cannot keep the data and may share it only as the customer has consented [2]. However, the advisers and brokers who receive it can read it and also sell products. It is unclear whether RBI or SEBI acts if the data is misused at the user's end.
• Overlap with the DPDP Act, 2023: The Act creates Consent Managers registered with the Data Protection Board [6], which is the same role AAs play under RBI. This gives three possible regulators and risks duplicate compliance.
• Grievance redress: A wrong deposit entry in the CAS involves a bank (RBI Ombudsman) and a depository (SEBI SCORES). There is no single window for complaints.
• Limited reach: The CAS goes only to demat-account holders [5], so households with only bank accounts miss out on the benefit.

Way forward

• Set up a joint RBI–SEBI technical group under the FSDC to set common data and consent standards.
• Require consent for each purpose separately, in line with the DPDP Act's purpose limitation [6].
• Publish a list of onboarded banks and a deadline for the rest, and create a single grievance window across regulators.

Building a unified financial data architecture is more about aligning regulators than about technology. If RBI and SEBI set common consent standards and shared accountability, the AA network can deliver both inclusion and privacy, which is part of the right to life under Article 21 (Puttaswamy, 2017).