Lok Sabha Question No. 862 (UNSTARRED), answered on 2022-02-07
Subject: Account Aggregators
Ministry: FINANCE
Asked by: K. Shanmuga Sundaram, P. Velusamy

## GOVERNMENT OF INDIA MINISTRY OF FINANCE

## LOK SABHA UNSTARRED QUESTION NO-862

ANSWERED ON- 7/2/2022

## ACCOUNT AGGREGATORS

## 862. SHRI SHANMUGA SUNDARAM K SHRI VELUSAMY P.

Will the Minister of FINANCE be pleased to state:

- (2) whether the Government is awate of the fact that Reserve Bank of India has given permission fot Account   Aggregators as a non-banking financial   company under a contract for providing financial information to various persons;
2. whether it is any con interest with CIBIL, CRISIL and other agencies and if the details thereof; having flicting SO, rating SO,
3. the kind of security provided by the Account Aggregators to protect the financial data of the individual; and
4. whether the application is any to prevent multiple banking of individual and companies and if the details thereof? having facility SO,

## ANSWER

## THE MINISTER OF STATE IN THE MINISTRY OF FINANCE

## (DR BHAGWAT KARAD)

(a) and (): RBI has that with the objective of facilitating aggregation of all Account Aggregator (Reserve Bank) Directions, 2016 and subsequently a apprised of transaction data from deposit/ current accounts, assists in decision of various loan monitoring, personal  finance wealth management etc. the data collected and shared by credit information/ companies like CIBIL, CRISIL etc: consolidate credit information of borrowers savings making lending; rating

financial assets of an individual, RBI issued Master Direction Non-Banking Financial Company Gazette Notification in this regard was published on 26.11.2016 by the Government: Account Aggregator (AA) is an (company registered as an NBFC-AA with RBI) that undertakes the business of retrieving/ collecting   and  consolidating information related to individual's financial assets scattered across various financial instruments, with various financial intermediaries (Financial Information Providers (FIPs) spread across the purview of different financial sector regulators viz. RBI, SEBI, IRDA, PFRDA and such other as may be identified by the RBI), and presenting the same to the individual herself or fied/ regulated Financial Information Users (FIUs). The transfer of such information is based on an consent of the customer and with appropriate agreements, authorisations between the NBFC-AA, the customer; and the FIPs. While the AA  framework by allowing bank statements required for provision entity entity specil explicit sharing

(c): RBI has informed that to facilitate secured, duly authorised, seamless transfer of strict consent-based sharing of financial information and to protect the financial data of the   individual, a set of core technical  specifications for  participants of NBFC-AA ecosystem has been framed by Reserve Bank Information Technology Pvt: Ltd: (ReBIT), a wholly owned subsidiary of RBI, in November 2019. The extant regulations mandated for   NBFC-AAs on security and  protection of financial data   include, inter   alia, the following: data,

- FIPs are required to implement interfaces that will allow an AA to submit consent artefacts and authenticate each other enabling secure flow of financial information to the AA and such  electronic consent artefacts be capable of logged, audited and verified. being
- No financial information of the customer shall be retrieved, shared or transferred by the AA without the explicit consent of the customer; and such information accessed by the AA from the FIPs shall reside with the AA,
- Data cannot be stored by account aggregators Or used for any other purpose
- (v) AA should not to undertake any business other than the business of AA
- (iv) User authentication credentials of customers to accounts with various FIPs should not be accessed by the AA relating
- (vi) AA should not request Of store customer credentials (like passwords, PINs, private keys) which may be used for authenticating customers to the FIPs and access by AAs to customer s information to be based on consent-based authorisation:
- (viii) Robust data security and customer grievance redressal mechanisms   have been prescribed.
- (vii) Information System Audit of the internal systems and processes to be in place and be conducted at least once in two years by CISA certified external auditors:

(d): With regard to the application any to prevent multiple of individual and companies, RBI has informed that the AA is a regulated mandated for digitally signed and encrypted it does not support transactions by customers, and is just an interoperable data-blind consent manager who can selectively share and even revoke data once shared. having facility banking entity sharing data,