The Closed Framework
India’s Account Aggregator (AA) framework lets individuals share their financial data, with consent, through RBI-registered account aggregators. However, it restricts who can receive this data and how they can use it. Apart from the customer, only financial information users (FIUs) regulated by an Indian financial sector regulator can receive the data. They can use it only for recognised purposes tied to their own business.
These restrictions pose a challenge for businesses that want to use financial data to build new products and services but do not qualify as FIUs. Some explore partnerships with regulated entities to access the data. Such arrangements raise important questions: can the regulated partner share the data for the proposed use? Does the use serve the partner’s own business, or an external service?
Whether that works depends on who effectively controls the data and how the data, including any insights derived from it, is ultimately used.
Our Framework
Ikigai Law tests each proposed use of AA data against three questions drawn from the RBI’s Account Aggregator Directions.
Control: Who decides what data is fetched, how it is processed and where the output goes? We judge this on substance, not contractual labels.
Nexus: Is the use connected to the regulated entity’s own business and its own customer?
Purpose: Does the use fit a purpose the framework recognises?
Each test stands on its own, so passing one does not cure a failure on another. We then trace the data beyond the regulated entity to its final use. Where a proposed structure raises regulatory concerns, we identify alternative ways to achieve a similar commercial outcome, and we set out the practical limits of each.
Applying It in Practice
We have applied this framework to products in personal finance, crypto and cross-border verification.
Cross-border verification of source of wealth
In one matter, we advised a UK regtech company planning a platform for UK conveyancing solicitors. The platform would verify the source of wealth of Indian buyers of UK property, using Indian bank data pulled through a regulated Indian partner.
The structure raised concerns under all three tests. The client would control the consent journey, the processing and the output, while the partner only lent its registration. The service would benefit a UK firm rather than the partner’s own customer. No recognised purpose covered source of wealth checks.
We set out two alternative routes. The first would allow individuals to obtain their own data through an account aggregator and share it directly with the platform. The second would rely on other verifiable sources, such as digitally signed bank statements and tax records. We also mapped the data protection obligations that would apply under each route.
Using bank data to power crypto rewards
In another matter, we advised a data technology group building a crypto rewards product for Indian users. Bank account data would be turned into a spending fingerprint that decided whether, and on what terms, a user could buy a rewards token.
The original design carried risk on all three tests. We proposed alternative structures that separate the regulated use of the data from the crypto layer. These reduced the risk and clearly identified the risk that remained. We also assessed the crypto layer separately under the Prevention of Money Laundering Act, 2002 (PMLA) and the Foreign Exchange Management Act, 1999 (FEMA).
While the details of each client’s assessment remain confidential, the underlying approach can be applied across products.
The Ikigai Law team on these matters comprised Aparajita Srivastava, Vijayant Singh and Akshat Tenneti.
For any queries, reach out to us at contact@ikigailaw.com
“Account aggregator data carries a reliability that few other sources of financial data can match, and the framework’s restrictions reflect that. Our approach is to understand those restrictions and work with clients to find the structure that serves their product. The products that hold up best are those designed with the framework in mind from the start.”
— Vijayant Singh, Principal Associate
