RBI to authorise inter-operability among NBFC-AAs

1. At a Glance

• RBI will make Non-Banking Finance Company – Account Aggregators (NBFC-AAs) interoperable, so that an individual can see information on all their financial assets on a single platform. [1]
• Data is currently split across about 15 AAs. Interoperability is meant to combine it into a consolidated view of an individual's financial assets. [1]
• In a related step, RBI will help SEBI-regulated depositories add bank deposit information to the Consolidated Account Statement (CAS). [1]
• UPSC relevance: digital public infrastructure (DPI) for finance, consent-based data sharing, financial inclusion, wealth management and dormant deposits. It maps to GS-III (Banking, Inclusive Growth) and GS-II (privacy and data governance).

2. Why in the News

• RBI Governor Sanjay Malhotra announced AA interoperability as one of the additional measures released alongside the monetary policy statement. The article was published on 8 October 2026 (The Hindu, Chennai edition, p. 17). [1]
• The interoperability framework is to be implemented by 31 December 2026. [1]
• RBI will also enable SEBI-regulated depositories to include bank deposit data in the CAS. This starts with banks already onboarded, and other banks will be added over time. [1]

3. Background & Evolution

• Rationale: an individual's financial data sits with many institutions and AAs. Neither the consumer nor their advisers can see it in one place. [1]
• CAS gap: the CAS issued by depositories does not currently include bank deposits, which leaves "a significant gap" in an individual's consolidated financial picture. [1]
• Earlier milestones (not checked in this round; confirm on rbi.org.in):
• 2016: RBI issued the Master Direction – NBFC-Account Aggregator (Reserve Bank) Directions, 2016, creating a new NBFC category. [U]
• 2021 (September): the AA ecosystem went live with a small group of banks. [U]

• NITI Aayog's DEPA (Data Empowerment and Protection Architecture) is the policy framework behind consent-based data sharing. [U]

• 2026: RBI moves from separate AAs to an interoperable AA network, plus deposit data in the CAS. [1]

4. Core Static Facts

5. Multi-Dimensional Analysis

Economic

• A single view of a person's assets supports better financial advice, more efficient credit decisions and smarter allocation of household savings. [1]
• Advisers, asset managers and insurance brokers can give better-informed advice using data that customers have consented to share. [1]
• Including deposits in the CAS helps track dormant or unclaimed deposits, which can then be returned to the people entitled to them. [1]

Social

• The CAS change makes it easier to trace deposits after an account holder dies, which reduces hardship for heirs. [1]
• Retail investors and less-informed households get one consolidated statement instead of 15 separate data silos. [1]

Scientific / Technological

• Interoperability needs common technical standards and APIs across about 15 AAs, the same approach used for UPI and other India Stack networks. [1]
• The AA layer is a consent-management layer. AAs pass data along but do not read it. [U]

Legal / Governance

• Consent is the core principle: third parties can access data only with the customer's permission. [1]
• Raises data protection issues: the link to the Digital Personal Data Protection Act, 2023 (consent managers, purpose limitation). [U]
• Regulatory coordination is needed between RBI (AAs and banks) and SEBI (depositories and CAS). [1]

Administrative

• Implementation is phased. CAS deposit integration covers banks already onboarded first, and the rest follow later. [1]
• The deadline of 31 December 2026 requires quick changes to standards across the industry. [1]

6. Recent Developments (last 12–18 months)

• October 2026: RBI announced AA interoperability and deposit data in the CAS alongside the monetary policy statement. [1]
• 31 December 2026: target date for implementing the interoperability framework. [1]
• No other dated developments could be confirmed from Tier 1 sources in this retrieval round.

7. Prelims Hooks

• AAs are regulated by RBI as a category of NBFC (NBFC-AA), not by SEBI or MeitY. [1]
• In 2026, India had about 15 Account Aggregators. [1]
• The deadline for the AA interoperability framework is 31 December 2026. [1]
• The interoperability move was announced by RBI Governor Sanjay Malhotra. [1]
• The Consolidated Account Statement (CAS) is issued by SEBI-regulated depositories. [1]
• The CAS currently does not include bank deposits. RBI will make their inclusion possible. [1]
• Deposit data will come first from banks already onboarded, with the rest added gradually. [1]
• One expected benefit is tracking dormant deposits, especially after an account holder dies. [1]
• Users of aggregated data can include insurance brokers, asset managers and investment advisers, but only with consent. [1]
• The Master Direction on NBFC-AAs was issued in 2016. [U]
• Sahamati is a non-profit industry alliance of AAs, not a regulator. [U]
• FIP = holds the data (for example, a bank); FIU = uses the data (for example, a lender). [U]

8. One Consent, Many Uses: The Weak Spot in the AA Design

• One 'yes' can open data to many kinds of services
• A State Bank of India Managing Director has raised a concern about how AAs take consent. One consent from the customer is used for every kind of financial product: loans, wealth management and opening accounts [2].
• He said most customers do not read the fine print. They agree without understanding what they have agreed to [2].

• So consent, which the note calls the core principle, may be weaker in practice than it looks on paper.

• Interoperability makes this concern bigger

• Today each AA holds only part of a person's picture, because data is split across about 15 AAs [1].
• After interoperability, one consent could unlock a consolidated view of all of a person's assets [1].

• A careless 'yes' then exposes far more than it does today.

• The best argument on the other side, and what it misses

• Supporters say the system is safe because the AA cannot read the data. The AA fetches it, but the data moves fully encrypted, so the AA cannot see it [7].
• That point is true, and it protects the pipe.
• But the risk is at the FIU (Financial Information User: the lender, adviser or insurance broker who receives the data). The FIU can read the data once it arrives.
• Insurance brokers, asset managers and investment advisers are the stated users of the aggregated data [1]. They also sell products. A complete asset picture tells them exactly what to sell to whom.
• Encryption does not solve a problem that begins after the data reaches its intended receiver.

9. Why the Single View Is Still Mostly a Lending Tool

• So far, AAs have mainly been used for loans
• Sahamati, the AA industry body, reported that about ₹42,300 crore of loans had been given through the AA framework from its launch until September 2024 [3].

• Lenders use AA data mainly to check bank statements quickly before giving a loan.

• The new promise is about wealth and advice, which is untested

• RBI's stated goal is to help advisers, asset managers and insurance brokers give better advice using a full view of a person's assets [1].
• That use case has much less track record than lending.
• A good test after 31 December 2026 [1] is whether consolidated views are used for advice and wealth tracking, or whether lending still makes up nearly all AA traffic.

10. The Dormant Deposit Problem Is Large, and the CAS Fixes Only Part of It

• The amount of money involved is large
• If a bank deposit stays unclaimed for 10 years or more, it is moved to RBI's DEA Fund (Depositor Education and Awareness Fund). The money still belongs to the customer or their heirs, and there is no time limit for claiming it [6].

• The Finance Ministry told Parliament that ₹86,917 crore of unclaimed deposits was in the DEA Fund as of 30 June [4].

• RBI already has a search tool for this: UDGAM

• UDGAM (Unclaimed Deposits – Gateway to Access inforMation) is an RBI portal. It lets users search for unclaimed deposits across many banks in one place [6].
• By March 2024, 30 banks had joined it. Together they covered about 90% of the value of unclaimed deposits in the DEA Fund [5].

• However, UDGAM only finds the deposit. The heir still has to claim the money from each bank separately [6].

• The CAS step acts earlier, but reaches fewer people

• Adding deposits to the CAS works before money is lost: heirs can see the accounts while the holder is alive or soon after death. UDGAM works only after the money has already gone dormant.
• But the CAS is sent by depositories [1], so it reaches only people who invest through them, such as those with a demat account (an electronic account for holding shares and securities).
• Many families with forgotten savings accounts have no demat account. They will never receive a CAS.

• Deposit data also starts only with banks already onboarded [1]. Any bank left out stays a blind spot.

• What this means: the CAS change prevents some deposits from becoming dormant among investing households. It does not reduce the large existing balance in the DEA Fund, and it does not make claiming easier.

11. What RBI and SEBI Should Do Next

• RBI should require separate consent for each purpose, not one blanket consent
• This answers the single-consent concern raised by SBI [2].
• A customer should agree separately to share data for a loan, for advice and for an insurance quote.

• The Digital Personal Data Protection Act, 2023 already lists purpose limitation (data used only for the purpose agreed to) and creates a legal role for consent managers. RBI's AA directions can be aligned with these.

• RBI and SEBI should link CAS deposit data with UDGAM

• UDGAM already covers banks holding about 90% of unclaimed deposits by value [5].

• If a deposit shown in a CAS has had no activity for a long time, the statement could flag it, so it is noticed before it reaches the 10-year mark for transfer to the DEA Fund [6].

• RBI should publish a list of banks onboarded to the CAS, with a deadline for the rest

• The rollout is phased, and only banks already onboarded come first [1]. Without a public list and a date for the remaining banks, a user cannot tell whether their CAS shows all their deposits or only some.

• RBI should report how AA data is used, once interoperability is live

• Sahamati's figures so far mostly measure lending [3].
• Regular RBI data on what consents are taken for, and how often they are cancelled, would show whether the consent model is working as designed.

12. Anchors for Answers

• Data: ₹86,917 crore of unclaimed deposits was in RBI's DEA Fund as of 30 June, according to the Finance Ministry in Parliament [4]
• Data: About ₹42,300 crore of loans were given through the AA framework from launch until September 2024, according to Sahamati [3]
• Data: 30 banks on the UDGAM portal covered about 90% of the value of unclaimed deposits in the DEA Fund (March 2024) [5]
• Law/Case: Digital Personal Data Protection Act, 2023 (consent managers, purpose limitation); RBI Act, 1934, Section 45-IA (NBFC registration)
• Scheme: UDGAM portal and DEA Fund: RBI's existing tools for tracing and holding unclaimed deposits, which the CAS deposit step adds to [5][6]

13. Mains Relevance

• GS-III: Indian Economy: mobilisation of resources, banking and financial sector, inclusive growth. Science and Technology: IT and digital infrastructure.
• GS-II: Government policies and interventions; statutory and regulatory bodies (RBI, SEBI); data governance and privacy.
• Possible question stems: 1. Account Aggregators are described as India's financial data-sharing DPI. Examine how interoperability among AAs can deepen financial inclusion, and discuss the privacy safeguards needed. 2. Fragmented financial information creates both consumer harm and unclaimed wealth. Critically evaluate RBI's 2026 measures on AA interoperability and on bank deposits in the Consolidated Account Statement. 3. Consent-based data sharing is central to India Stack. Discuss the regulatory coordination challenges between RBI and SEBI in building a unified financial data architecture.

14. Related Topics to Study Next

• India Stack / Digital Public Infrastructure: the AA network is its data-sharing layer.
• UPI and NPCI: an earlier example of payment interoperability that AA interoperability follows.
• Digital Personal Data Protection Act, 2023: the consent manager concept and data rights.
• RBI's UDGAM portal and unclaimed deposits / DEA Fund: linked to the goal of tracking dormant deposits.
• SEBI, depositories (NSDL, CDSL) and the CAS: the other half of the October 2026 announcement.
• NITI Aayog's DEPA: the policy basis of consent-based data flows.
• Unified Lending Interface (ULI): RBI's credit platform that uses AA data.
• Monetary Policy Committee and RBI's Statement on Developmental and Regulatory Policies: the vehicle used for such announcements.

15. NCERT Concepts to Revise

• Account Aggregator (Economy): The article is about making these RBI-regulated consent-based data-sharing intermediaries work together.
• India Stack (Polity): Account aggregators are the data-sharing layer of India Stack, alongside Aadhaar and UPI.
• Digital public infrastructure (Polity): AA interoperability is a financial DPI move, like UPI, so you need the concept and its examples.
• Consent manager (Polity): AAs act as consent managers; the DPDP Act gives this role a legal basis.
• Digital Personal Data Protection Act 2023 (Polity): Consent-based sharing of financial data raises privacy questions that this law governs.
• Non-Banking Financial Company (Economy): AAs are a special category of NBFC regulated by RBI, so know what an NBFC is.

16. Common Errors / Trap Areas

• Wrong regulator: AAs are RBI-regulated NBFCs. Sahamati is an industry body, and SEBI regulates the depositories that issue the CAS, not the AAs. [1][U]
• AA ≠ data owner: AAs pass data along only with consent. They do not own or analyse it, and the data stays with the FIPs. [U]
• CAS issuer: the CAS is issued by depositories (SEBI), not by RBI or banks. RBI only facilitates adding deposit data. [1]
• Deadline vs announcement: announced in October 2026; implementation is due by 31 December 2026. [1]
• Scope of CAS deposit inclusion: it starts only with banks already onboarded, not all banks at once. [1]