RBI Cautions Account Aggregators Against Monetising Customer Data — October 15, 2026

The Reserve Bank of India (RBI) has issued a caution to non-banking financial company account aggregators (NBFC-AAs), warning them against monetising customer financial information and calling for strict neutrality across the open finance framework. The regulator reiterated that data must flow strictly on a consent-driven basis and solely for the specific purposes authorized by users.

Delivering an address at Samvaad, organized by Sahamati—the industry alliance and self-regulatory organization for the account aggregator ecosystem—RBI Executive Director Kesavan Ramachandran outlined key compliance priorities for data intermediaries.

Strict Guardrails on Data Monetisation

Ramachandran highlighted the operational risks that accompany massive repositories of sensitive financial figures, noting that market participants must guard against exploiting consumer records.

"When we have a lot of data at our disposal, there is always a tendency, at least in the minds of unscrupulous users of data, to monetise it," Ramachandran stated, stressing that the industry "will and must always guard against the monetization of data."

He underlined that financial information can only be shared to the exact degree requested by customers, in strict alignment with the provisions of the Digital Personal Data Protection (DPDP) Act. Under RBI's regulatory structure, account aggregators are designed to operate as "data-blind" pipes—meaning they cannot decrypt, store, view, or sell the financial assets or transaction statements they transfer between entities. Any attempt to commercialize or leak this data could severely damage consumer confidence in India's digital financial infrastructure.

Warnings to Financial Information Providers

Alongside the advisory to aggregators, the central bank also cautioned Financial Information Providers (FIPs)—primarily banks, asset managers, and insurance companies—against dragging their feet or withholding customer-requested data transfers. When an account holder provides valid, verifiable consent, FIPs are obligated to transmit the required information promptly to the designated Financial Information User (FIU).

The RBI additionally urged caution regarding the rapid adoption of artificial intelligence tools in automated credit scoring, noting that financial institutions must balance technological innovation with cybersecurity safeguards and operational risk management.

Interoperability and Expanded Access Underway

The warning follows a series of regulatory announcements by RBI Governor Sanjay Malhotra aimed at streamlining the account aggregator ecosystem:

• Full Interoperability: Enabling NBFC-AAs to become fully interoperable, so customers can share records across multiple institutions using any single aggregator platform of their choice.
• Consolidated Account Statements (CAS): Integrating bank deposit balances into CAS through SEBI-regulated depositories, providing investors with a combined view of both investment holdings and bank deposits.
• Implementation Timeline: The central bank has set a deadline of December 31, 2026, for the implementation of interoperability across the network.

By reinforcing data confidentiality and zero-monetisation standards, the central bank aims to ensure that digital lending and portfolio consolidation scale safely without compromising Indian consumers' privacy.

Tags: Reserve Bank of India Account Aggregators Sahamati Digital Lending Fintech Data Privacy