The Reserve Bank of India, (the Bank) issued a Notification No..........DNBS.(AA) / CGM (CDS)-2016 dated XXXX 2016 in terms of sub-clause (iii) of clause(f) of section 45I of the Reserve Bank of India Act, 1934 (hereinafter referred to “the Act”) and on being satisfied that it is necessary to do so, in exercise of the powers conferred under section 45JA of the Act, and of all the powers enabling it in this behalf, hereby issues these directions for compliance of the same by every non-banking financial company undertaking the business of Account Aggregator as defined herein.

1. Short title, commencement and applicability of the directions :

1. These directions shall be known as the "Non-Banking Financial Company - Account Aggregator (Reserve Bank) Directions, 2016".

2. These directions shall come into force with immediate effect.

2. Scope

These directions provide a framework for the registration and operation of Account Aggregator in India.

3. Definitions

(1) In these directions unless the context otherwise requires,

i. “Account Aggregator” means a non-banking financial company as defined in sub-clause (iii) of clause (f) of section 45-I of the Act, that undertakes the business of an account aggregator, for a fee or otherwise, as defined at clause (iv) of sub-section 1 of section 3 of these directions.

ii. "bank" means -

1. a banking company; or

2. a corresponding new bank; or

3. the State Bank of India; or

4. a subsidiary bank; or

5. such other bank which the Bank may, by notification, specify for the purposes of these directions; and

6. a cooperative bank as defined under clause (cci) of section 5 read with section 56 of the Banking Regulation Act, 1949 (10 of 1949);

iii. "Banking company" means a banking company as defined in clause (c) of section 5 of the Banking Regulation Act, 1949 (10 of 1949);

iv. “business of an account aggregator” means the business of providing under a contract, the service of,

retrieving or collecting information of its customer pertaining to such financial assets, as may be specified by the Bank from time to time;

and

consolidating, organizing and presenting such information to the customer or any other person as per the instructions of the customer;

Provided that, the consolidated statement/ report of the financial assets of the customers, shall not be the property of the Account Aggregator, for any further use. The consolidated statement/ report will be only for use of the customer.

v. “Company” means a company registered under section 3 of the Companies Act, 1956 or a company registered under sub section (20) of section 2 of the Companies Act, 2013;

vi. “Customer” for the purpose of these directions means a ‘person’ who has entered into an arrangement with the Account Aggregator to avail services provided by the Account Aggregator;

vii. “Depository” means a company formed and registered under the Companies Act and which has been granted a certificate of registration under sub-section (1A) of section 12 of the Securities and Exchange Board of India Act, 1992;

viii. “Depository Participant” means a person registered under sub-section (1A) of section 12 of the Securities and Exchange Board of India Act, 1992;

ix. “Financial Assets” means

1. bank deposits including fixed deposits, saving deposits, recurring deposits and current deposits,

2. Deposits with NBFCs

3. Structured Investment Product (SIP)

4. Commercial Paper (CP)

5. Certificate of Deposit (CD)

6. Government Securities (Tradable)

7. Equity Shares

8. Bonds

9. Debentures

10. Mutual Fund Units

11. ETFs

12. Indian Depository Receipts

13. CIS (Collective Investment Schemes) units

14. Alternate Investment Funds (AIF) units

15. Insurance Policies

16. Balances under the National Pension System (NPS)

17. Units of Infrastructure Investment Trusts

18. Units of Real Estate Investment Trusts

19. Any other asset as may be identified by the Bank for the purposes of these directions, from time to time;

x. “Financial Sector regulator” for the purpose of these directions, shall mean the Reserve Bank of India, Securities and Exchange Board of India, Insurance Regulatory and Development Authority and Pension Fund Regulatory and Development Authority;

xi. “Financial service provider” means bank, banking company, non-banking financial company, asset management company, depository, depository participant, insurance company, insurance repository and such other entity as may be identified by the Bank for the purposes of these directions, from time to time;

xii. “Insurance Repository” means a company formed under the Companies Act, 1956 and which has been granted a certificate of registration by Insurance Regulatory and Development Authority (IRDA) for maintaining data of insurance policies in electronic form on behalf of insurers.

xiii. “Leverage Ratio” means the ratio of the Outside Liabilities to Owned Funds.

xiv. “Non-banking financial company” means a company registered under the Companies Act and which has been granted certificate of registration by the Bank under section 45IA of the Act;

xv. "Person" means

1. an individual,

2. a Hindu undivided family,

3. a company,

4. a firm,

5. an association of persons or a body of individuals, whether incorporated or not, and

6. every artificial juridical person, not falling within any of the preceding sub-clauses.

(2) Words or expressions used in the directions but not defined herein and defined in the Act, shall have the same meaning as assigned to them under that Act. Any other words or expressions not defined in the Act, shall have the same meaning assigned to them in the Companies Act, 1956/2013.

4. Registration and matters incidental thereto

4.1 (a) No entity other than a company can undertake the business of an Account Aggregator.

(b) No company shall commence or carry on the business as an Account Aggregator without obtaining a certificate of registration from the Bank.

(c) Every company seeking registration with the Bank as Non-Banking Financial Company - Account Aggregator shall have a net owned fund of not less than ₹ two crore or such higher amount, as the Bank may specify.

Provided that, entities being regulated by other financial sector regulators and aggregating only those accounts relating to the financial assets of that particular sector will be excluded from the registration requirement.

4.2 Process of registration

4.2.1 Every Account Aggregator shall make an application for registration to the Department of Non-Banking Regulation, Mumbai of the Bank, in the form specified by the Bank for the purpose at Annex 1.

4.2.2 The Bank for the purpose of considering the application for registration shall require to be satisfied that the following conditions are fulfilled:-

1. The company has the necessary resources and wherewithal to offer such services to customers.

2. The company has the adequate capital structure to undertake the business of an account aggregator.

3. The promoters of the company are fit and proper.

4. The general character of the management or proposed management of the company shall not be prejudicial to the public interest.

5. The company has submitted a plan for a robust Information Technology system.

6. The company shall not have a leverage ratio of more than seven.

7. That the public interest shall be served by the grant of certificate of registration to the Account Aggregator to commence or to carry on the business in India.

8. Any other condition, fulfilment of which in the opinion of the Bank shall be necessary to ensure that the commencement of or carrying on the business in India shall not be prejudicial to the public interest.

4.2.3 The Bank may, after being satisfied that the conditions specified under paragraph 4.2.2 are fulfilled, grant in-principle approval for setting up of an Account Aggregator subject to such conditions which it may consider fit to impose.

4.2.4 The validity of the in-principle approval issued by the Bank will be twelve months from the date of granting such in-principle approval.

4.2.5 Within the period of twelve months, the company shall put in place the technology platform, enter into all other legal documentations required to be ready for operations and report position of compliance with the terms of grant of in-principle approval to the Bank. The Bank may, after being satisfied that the company is ready to commence operations grant it a Certificate of Registration as an NBFC - Account Aggregator subject to such conditions which it may consider fit to impose.

4.2.6 The Bank may cancel the certificate of registration granted to an Account Aggregator, if such company -

(a) ceases to carry on the business of an Account Aggregator in India; or

(b) has failed to comply with any condition subject to which the certificate of registration has been issued to it; or

(c) it comes to the notice of the Bank that the Account Aggregator is no longer eligible to hold the certificate of registration; or

(d) at any time fails to fulfill any of the conditions referred to in paragraphs 4.2.2 and 4.2.5; or

(e) fails to -

1. comply with any direction issued by the Bank; or

2. maintain accounts, publish and disclose its financial position in accordance with the requirements of any law or any direction or order issued by the Bank; or

3. submit or offer for inspection its books of account or other relevant documents when so demanded by the Bank.

5. Duties and Responsibilities of an Account Aggregator

a) Account Aggregator shall ensure that the providing of services to a customer who has made a specific application for availing such services, would be backed by appropriate agreements/ authorisations between the Account Aggregator, the customer and the Financial Service providers.

b) Account Aggregator shall not support transactions in financial assets by customers.

c) Account Aggregator shall ensure appropriate mechanisms for proper customer identification.

d) Account Aggregator shall share information as referred to under paragraph 3(iv) only with the customer to whom it relates or any other person authorized by the customer. The process of authentication of the authorization has to be robust.

e) Account Aggregator shall not undertake any other business other than the business of account aggregator. Deployment of investible surplus by an Account Aggregator in instruments, not for trading, shall however be permitted.

f) No financial asset related customer information pulled out by the Account Aggregator from the financial service providers should reside with the Account Aggregator.

g) Account Aggregator shall have a Citizen Charter that explicitly guarantees protection of the rights of a customer. The Account Aggregator shall not part with any information that it may come to acquire from/ on behalf of a customer.

h) In the event of any difference in position of financial assets in the statement generated from the Account Aggregator and the books of the Financial Service provider, the position as reflected in the records of the Financial Service provider shall be considered correct.

6. Data Security

(a) Business of an Account Aggregator will be entirely Information Technology (IT) driven.

(b) The technology should also be scalable to cover any other financial assets or financial service provider as may be identified by Bank in future.

(c) There shall be adequate safeguards built in its IT systems to ensure that it is protected against unauthorised access, alteration, destruction, disclosure or dissemination of records and data;

(d) Appropriate measures for Disaster Risk Management and Business Continuity shall be in place.

(e) Information System Audit of the internal systems and processes shall be in place and shall be conducted at least once in two years by external auditors. Report of the external auditor shall be submitted to the Regional Office of the Department of Non-Banking Supervision of the Bank, under whose jurisdiction the Registered Office of the Account Aggregator is located, within one month of submission of the report by the external auditor.

7. Customer Grievance

7.1 An account aggregator shall have in place a Board approved policy for handling/ disposal of customer grievances/ complaints. It shall have a dedicated set-up to address customer grievances/ complaints.

7.2 Customer complaints shall be handled/ disposed off by the Account Aggregator within such time and in such manner as provided for in its Board approved policy, but in any case not beyond a period of one month from its receipt.

7.3 At the operational level, Account Aggregator shall display the following information prominently, for the benefit of customers, on the website and at the place/s of business:

(a) the name and contact details (Telephone / Mobile nos. as also email address) of the Grievance Redressal Officer who can be approached by the public for resolution of complaints against the company.

(b) that if the complaint / dispute is not redressed within a period of one month, the customer may appeal to the Bank.

8. Pricing

8.1 An Account Aggregator would require to have a Board approved policy for pricing of services. Pricing of services will be in strict conformity with the internal guidelines adopted by the Account Aggregator which need to be transparent and available in public domain.

9. Corporate Governance

9.1 An Account Aggregator shall have adequate internal mechanisms for reviewing, monitoring and evaluating its controls, systems, procedures and safeguards. The integrity of the IT systems shall be maintained at all times and all necessary precautions taken to ensure that the records are not lost, destroyed or tampered with.

9.2 Audit Function

9.2.1 An Account Aggregator shall constitute an Audit Committee, consisting of not less than three members of its Board of Directors.

Explanation I : The Audit Committee constituted by a non-banking financial company as required under Section 177 of the Companies Act, 2013 shall be the Audit Committee for the purposes of this paragraph.

Explanation II : The Audit Committee constituted under this paragraph shall have the same powers, functions and duties as laid down in Section 177 of the Companies Act, 2013.

9.3 Nomination Committee

9.3.1 An Account Aggregator shall form a Nomination Committee consisting of not less than three members of its Board of Directors to ensure 'fit and proper' status of proposed/ existing directors.

Explanation I : The Nomination Committee constituted under this paragraph shall have the same powers, functions and duties as laid down in Section 178 of the Companies Act, 2013.

9.4 Risk Management Committee

9.4.1 The account aggregator shall establish a well-documented risk management framework which shall include

1. A sound and robust technology risk management framework;

2. Strengthening system security, reliability, resiliency, and recoverability; and

3. Deploying strong authentication to protect access to customer data and systems.

9.4.2 To manage the integrated risk, an Account Aggregator shall form a Risk Management Committee consisting of not less than three members of its Board of Directors. The Risk Management Committee should

a) give due consideration to factors such as reputation, customer confidence, consequential impact and legal implications, with regard to investment in controls and security measures for computer systems, networks, data centres, operations and backup facilities.

b) have oversight of technology risks and ensure that the organisation’s IT function is capable of supporting its business strategies and objectives.

9.5 Fit and Proper Criteria

9.5.1 An Account Aggregator shall

i. ensure that a policy is put in place with the approval of the Board of Directors for ascertaining the fit and proper criteria of the directors/ managing director/ CEO at the time of appointment, and on a continuing basis. The policy on the fit and proper criteria shall be on the lines of the Guidelines contained in Annex 3;

ii. obtain a declaration and undertaking from the directors/ managing director/ CEO giving additional information on the directors/ managing director/ CEO. The declaration and undertaking shall be on the lines of the format given in Annex 4;

iii. obtain a Deed of Covenant signed by the directors/ managing director/ CEO, which shall be in the format as given in Annex 5;

iv. furnish to the Bank an annual statement on change of directors/ managing director/ CEO duly certified by the Statutory Auditors that fit and proper criteria in selection of the directors has been followed. The statement must reach the Regional Office of the Bank within 15 days of the close of the year.

10. Requirement to obtain prior approval of the Bank for acquisition or transfer of control of Account Aggregators –

10.1 (i) The prior written permission of the Bank shall be required for -

a) any takeover or acquisition of control of an Account Aggregator, which may or may not result in change of management;

b) any change in the shareholding of an Account Aggregator, including progressive increases over time, which would result in acquisition / transfer of shareholding of 26 per cent or more of the paid up equity capital of the Account Aggregator.

Provided that, prior approval would not be required in case of any shareholding going beyond 26% due to buyback of shares / reduction in capital where it has approval of a competent Court. The same is to be reported to the Bank not later than one month from its occurrence;

c) any change in the management of the Account Aggregator which would result in change in more than 30 per cent of the directors, excluding independent directors.

Provided that, prior approval would not be required in case of directors who get re-elected on retirement by rotation.

d) any change in shareholding that will give the acquirer a right to nominate a director.

10.2 Application for prior approval

(i) An Account Aggregator shall submit an application, on the company letter head, for obtaining prior approval of the Bank, along with the following documents:

a) Information about the proposed directors/ shareholders as per the Annex 2;

b) Sources of funds of the proposed shareholders acquiring the shares in the Account Aggregators;

c) Declaration by the proposed directors/ shareholders that they are not associated with any unincorporated body that is accepting deposits;

d) Declaration by the proposed directors/ shareholders that they are not associated with any company, the application for Certificate of Registration of which has been rejected by the Bank;

e) Declaration by the proposed directors/ shareholders that there is/ was no criminal cases, including proceedings initiated under section 138 of the Negotiable Instruments Act,1881 against them; and

f) Bankers' Report on the proposed directors / shareholders.

(ii) Applications in this regard may be submitted to the Department of Non-Banking Regulation, Mumbai of the Bank.

10.3 Public notice about change in control/ management

i. A public notice of at least 30 days shall be given before effecting the sale of, or transfer of the ownership by sale of shares, or transfer of control, whether with or without sale of shares. Such public notice shall be given by the Account Aggregator and also by the other party or jointly by the parties concerned, after obtaining the prior permission of the Bank.

ii. The public notice shall indicate the intention to sell or transfer ownership/ control, the particulars of transferee and the reasons for such sale or transfer of ownership/ control. The notice shall be published in at least one leading national and in one leading local (covering the place of registered office) vernacular newspaper.

10.4 Information with respect to change of address, directors, auditors, etc. to be submitted

Every Account Aggregator shall communicate, not later than one month from the occurrence of any change in :

(a) the complete postal address, telephone number/s and fax number/s of the registered / corporate office;

(b) the names and residential addresses of the directors of the company;

(c) the names and office address of the auditors of the company; and

(d) the specimen signatures of the officers authorised to sign on behalf of the company

to the Regional Office of the Department of Non-Banking Supervision of the Bank in whose jurisdiction the Registered Office of the Account Aggregator is located.

11. Returns

The Bank may, from time to time, prescribe return/s to be submitted by Account Aggregator as deemed fit.

12. Supervision

The Bank may, at any time, cause an inspection by one or more of its officers or employees or other persons of any Account Aggregator and at any intervals as it deems fit.

13. Exemptions

13.1 The Bank may, if it considers necessary for avoiding any hardship or for any other just and sufficient reason, grant extension of time to comply with or exempt any company or class of companies or all companies, from all or any of the provisions of these guidelines either generally or for any specified period, subject to such conditions as the Bank may impose.

13.2 The Bank can give any clarification in respect of the above directions and such clarification shall be treated as part of these directions. The directions can be amended by the Bank from time to time.