What this edition covers
This month, we look at how regulators are resetting the rules for India’s financial services ecosystem:
Main Course 1 | Insurance Reforms: Why is the IRDAI bringing back commission caps three years after scrapping them? Its recent consultation paper proposes to cap commissions again and lower insurers’ expense limits. It also proposes common rules for distributors and a shared marketplace for buying insurance. We examine what the proposals mean for fintechs, lenders, digital brokers, and insurers.
Main Course 2 | Account Aggregator Interoperability: What happens when customers can use any Account Aggregator they choose? The RBI wants NBFC-AAs to be interoperable by 31 December 2026. We explain what changes for the ecosystem, and what still needs to be settled before the network works as one.
Dessert | FPI KYC Gets Easier: Do FPIs still need to get their KYC documents checked against originals in India or repeat KYC reviews as often as before? Not anymore. The RBI now allows banks to accept certified copies from abroad, while SEBI has extended KYC review cycles for many FPIs. We unpack both changes.
Behind The Stories: A snapshot of our recent work on the issues covered in this edition.
Mints | Quick Bites: A round-up of other key fintech developments.
Introduction
When a financial system is not working as intended, regulators can tighten the rules, close the gaps or remove needless friction.
This month brings all three.
The IRDAI wants to cap insurance commissions again because greater flexibility may have made distribution more expensive and sales more incentive-driven. The RBI wants Account Aggregators to interoperate because voluntary connections left gaps in what was meant to be a network. At the same time, it has eased FPI KYC where physical verification created more friction than protection.
These reforms move in different directions, but raise the same question: when should a regulator step in, and when should it step aside?
This edition examines what these reforms could solve, what they may cost and where the next fault lines could emerge.
Let’s dive in.
Main Course 1 🥘
Commission Impossible: The IRDAI Rewrites the Insurance Playbook
Why the IRDAI wants to bring back commission caps, and why lower distribution costs may not always make insurance easier to buy.
On 23 September, the IRDAI released a consultation paper proposing major changes to insurance distribution. It wants to reduce insurers’ expenses, bring back commission caps and tighten safeguards against mis-selling. Comments were initially due by 25 October. After receiving more than 650 responses, the IRDAI extended the deadline to 31 October.
The proposals have drawn strong industry pushback. Insurers and distributors agree that customers need better protection. But many argue that the proposed caps could make some distribution models unviable. This may reduce insurance access, particularly for smaller customers and underserved markets.
Consider a customer taking a home loan. The bank also offers them a life insurance policy. The cover may be useful. But the customer may not know how much the bank earns from the sale or whether another policy would suit them better.
This is the problem the IRDAI wants to address. A distributor earns a commission when it sells a policy. If one policy pays more than another, the distributor may have a financial reason to recommend the higher-paying product. That product may not always be the best fit for the customer.
Why is the IRDAI changing the rules again?
For years, the IRDAI capped commissions for different insurance products. Insurers were also subject to limits on their Expenses of Management, or EoM.
EoM is the money an insurer spends to run its business. It includes commissions, salaries, technology, offices and marketing. A 20% EoM limit means that an insurer can spend up to Rs. 20 out of every Rs. 100 it collects in premiums on these costs.
In 2023, the IRDAI removed the product-level commission caps. The EoM limits remained. Insurers could decide how much to pay each distributor, as long as their total expenses stayed within the overall EoM ceiling.
The IRDAI expected this flexibility to help insurers manage costs and expand coverage. Instead, commissions grew faster than premiums in several segments. The regulator also remains concerned about high distribution costs, mis-selling and customers discontinuing policies early.
The new paper is an attempt to correct course.
What does the paper propose?
First, the paper proposes lowering the existing EoM limits over five years. The proposed limit for life insurers would eventually fall to 12.5% of premium income. For general insurers, it would fall to 20%.
Second, it seeks to bring back commission caps. These would vary by product and by the type of distributor making the sale. The proposed cap for an insurer-appointed agent may therefore differ from the cap for a bank, broker or digital platform selling the same policy.
Third, it envisages the reorganization of the distribution framework. Companies that distribute insurance, such as brokers and corporate agents, would become Insurance Distribution Entities (IDEs). Individual sellers would become Insurance Distribution Persons (IDPs). Digital platforms that provide common infrastructure for insurance distribution would become Market Infrastructure Institutions (MIIs).
Bima Sugam is expected to be one such MII. It is planned as a neutral, not-for-profit online marketplace. Customers would be able to use it to compare and buy policies from different insurers. It could also support services such as renewals and claims.
The paper also proposes stronger checks against mis-selling. Insurers and distributors would have to assess whether a policy suits the customer. Bank and NBFC employees could no longer earn rewards linked to insurance sales. Each policy would identify the person who sold it. If mis-selling is proved, the commission could be recovered.
To support these measures, the paper proposes a wider role for the Public Insurance Registry (PIR). The PIR would be the common data layer behind the distribution system. It would hold standard information on insurers, distributors and policy sales. This could include the commission paid on a policy and the identity of the person who sold it.
The PIR would not itself be a marketplace. Platforms such as Bima Sugam could draw information from it and present that information to customers. Put simply, the PIR would hold the data, while Bima Sugam would be the customer-facing platform through which that data could be used to compare and buy insurance.
Where could the proposals help?
The case for reform is clear. Lower distribution costs could reduce pressure on premiums. Commission disclosures could help customers understand the financial incentive behind a recommendation. Identifying the seller and recovering commissions after mis-selling could also improve accountability.
The new distribution framework could make entry simpler. Today, a fintech must choose between separate registrations, such as a broker, corporate agent or web aggregator. Bringing these businesses under a common IDE category could reduce regulatory differences and make the market easier to enter.
The proposed digital infrastructure could also improve comparison. If the PIR provides reliable and standardized information, Bima Sugam could show customers comparable policies from different insurers in one place. This may reduce their dependence on the recommendation of a single distributor.
But lower distribution costs do not automatically mean better access.
Where could the proposals hurt?
For many Indians, buying insurance still requires human assistance. First-time buyers, senior citizens, rural households, lower-income families and small businesses may need someone to explain the policy in their language. They may also need help with paperwork, renewals and claims.
Commissions are generally calculated as a percentage of the premium. This creates a problem for low-value policies. A distributor may need to do the same amount of work for a Rs. 2,000 policy as for a Rs. 20,000 policy. But a 5% commission would pay only Rs. 100 on the first policy and Rs. 1,000 on the second. If the smaller payment does not cover the cost of service, distributors may focus on customers who buy larger policies.
The proposed motor insurance caps show the scale of the change. Average commissions are reported to be around 26%. For new vehicles sold through IDEs, the paper proposes a 5% cap on own-damage cover and no commission on third-party cover. An immediate reduction of this size could disrupt existing distribution models.
Group health insurance raises a similar concern. The proposed cap is 2.5% for IDEs and 5% for insurer-appointed agents. The paper’s own data places average commissions at around 15% for new group health business and 6% for renewals. At the market-wide average premium of about Rs. 2,233 per insured person, a 2.5% commission works out to around Rs. 56. That amount must support enrolment, policy changes, claims assistance and ongoing service. This may push distributors towards larger employers. Smaller businesses could find it harder to buy group cover or obtain help when employees make claims.
The difference between company and individual distributors may also distort competition. An insurer-appointed agent, or IDP, keeps the commission paid to them. The insurer separately pays for the supporting branch, managers, training and technology. An IDE receives one commission. It must use this amount to pay its individual sellers and fund its platform, technology and compliance. A lower cap for IDEs may therefore favor agents who sell for one insurer over distributors that offer customers a choice of products.
Smaller insurers face another challenge. They need to invest in technology, distribution and customer acquisition before they reach scale. The two largest life insurers have cost ratios of around 10% to 12%. Other life insurers operate at 18% to 39%. A common EoM limit may therefore be much easier for established insurers to meet. Smaller insurers may respond by cutting investment in new products and underserved markets.
How can the framework strike a better balance?
The first step should be an independent impact assessment. Commission caps, lower EoM limits and new distributor categories will operate together. Their combined effect on premiums, customer service, employment, competition, investment and insurance access should be tested before the framework is finalized and implemented.
The commission caps should also be phased in. Insurers have five years to meet the proposed EoM limits, but distributors have no similar transition. They will need time to renegotiate contracts, revise payment arrangements and update their systems. The final framework should also explain how the caps will apply to existing policies and renewals.
The caps should reflect the actual cost of selling and servicing insurance. IDE caps should not be lower than IDP caps where both perform similar work and carry similar responsibility. Higher caps for underserved areas should also cover renewals and servicing, not only the first sale.
Smaller and newer insurers may need a longer EoM transition. The IRDAI could also allow limited additional spending on technology, insurance awareness and rural distribution. These expenses should be clearly defined, capped and verified.
The goal is not simply to reduce commissions. It is to ensure that customers receive suitable products at a fair cost, without losing access to advice and support. Done well, the reforms could make insurance more transparent and affordable. If the impact is not carefully assessed, they could make insurance cheaper on paper but harder to access in practice.
Main Course 2 🥘
The Great AA Rewire
How interoperability, common charges and customer standards could turn separate data pipes into one network.
On 7 October, the RBI announced that Account Aggregators would become interoperable. This should allow a customer to use any Account Aggregator, or AA, to share information held by different financial institutions. The RBI expects customer-level interoperability by 31 December. ReBIT (RBI’s wholly owned subsidiary) published the technical specifications on 14 October, with an implementation deadline of 1 December.
Interoperability is only one part of a broader overhaul. ReBIT has also released common standards for customer protection and user experience. These govern the customer-facing screens and consent journey and are due for adoption by 31 October. Sahamati, the SRO for the AA ecosystem, has also introduced a common pricing model, which is due to take effect on 1 December.
Together, these changes affect how financial information travels, how customers give consent and how the network is paid for. To understand why they matter, it helps to begin with the customer journey they are intended to improve.
First, what does an Account Aggregator do?
Consider a customer applying for a home loan. The lender needs six months of bank statements. The customer could download and submit them. The AA framework offers a consent-based digital route instead.
The bank holds the statements and is therefore called a Financial Information Provider, or FIP. The lender wants to use the statements and is called a Financial Information User, or FIU. An FIU must be regulated by a financial-sector regulator.
The AA connects the two. It is an RBI-regulated consent manager and data messenger. It does not decide whether the loan should be approved. Nor can it retain the information passing through it. The data can be shared only with the customer’s consent.
That consent records what may be shared, with whom, for what purpose and for how long. The customer can reject or revoke it. The same framework can carry information held by banks, NBFCs, mutual funds, insurers, pension institutions and other regulated providers.
To manage these permissions, the customer opens an AA account and receives a Virtual User Address, or VUA. This address identifies the AA account and helps other participants locate the AA through which the customer’s consent is managed.
What is missing today?
The VUA does not guarantee that the lender or bank can reach that AA. The network still relies on point-to-point connections. An FIU can work only with the AAs it has integrated with. An AA, in turn, can reach only the FIPs connected to it.
This becomes difficult as the network grows. The ecosystem currently has 17 AAs, about 200 FIPs and about 800 FIUs. Yet each FIU is connected to only a few AAs.
A customer’s VUA may therefore belong to AA One, while the lender uses AA Two and the bank is connected to AA Three. If there is no route between them, the customer may be asked to open another AA account. The request may otherwise fail. This is the gap interoperability is meant to close.
How will interoperability work?
Interoperability is meant to create this missing route. It will not send every request through one central system. Instead, the AAs will form a connected network. Each AA will also act as a gateway, which means it can pass a request to another AA.
If the lender’s AA cannot directly reach the customer’s AA or bank, another AA can relay the request. Where a direct connection already exists, it will continue to be used.
An AA carrying the request will act only as a messenger. The request will be signed and encrypted for its final recipient. An AA through which it passes should not be able to read or change it. The customer’s consent will remain with the AA that manages the VUA.
The AAs will use Sahamati’s interconnectivity graph to find the route. This is simply a map showing which AAs are connected to each other. It will help direct the request but will not itself carry any customer information.
This creates interoperability, not portability. AAs will be able to communicate with one another. But a customer will not yet be able to move their VUA, linked accounts or existing consents from one AA to another.
How do the three changes work together?
Interoperability creates the route. The proposed economic model will pay for the route. The customer standards govern the screen through which customer consent is given.
The FIU will pay for each successful data fetch, for each account. The charge has three parts: the FIP fee, the AA utility fee and Sahamati’s ecosystem fee. The customer cannot be charged directly.
The model also introduces a standard agreement and one consolidated invoice. The AA will collect the payment and pass the relevant shares to the FIP and Sahamati. The settlement playbook is still being finalised.
The customer standards govern the front end. Screens must show who wants the data, why, for what period and how often. Approve and Reject must have equal visibility. Accounts cannot be preselected. A consent dashboard, grievance channels and stronger authentication are also required.
What could change in practice?
For customers, the clearest benefit is choice. A person should be less likely to open another AA account because a lender uses a different one. Clearer screens should also make consent easier to understand.
For FIUs and FIPs, interoperability should reduce separate links with every AA. But implementation work remains. AAs bear most of it, while FIUs and FIPs still need new discovery, security and tracing capabilities.
The economic effect will differ by use case. A lender may fetch several accounts for several applicants before approving one loan. Personal-finance and wealth services may fetch data repeatedly. Per-fetch charges may therefore weigh more heavily on high-volume or small-ticket services.
What should ecosystem players watch?
First, a data request should count as successful only if it returns complete, usable information. If data is missing, the lender may have to request it again. The pricing rules should clarify whether charges apply to incomplete responses, repeat requests for the same data and failed requests.
Second, it must be clear who is responsible at each step. A common tracking ID will help trace a request across participants, but the codes explaining why a request was rejected or sent to the wrong participant are still being developed. Customers need a single place to complain, and participants need clear rules on who handles delays, routing errors, data loss and security incidents.
Third, requests should not be routed in ways that favour particular AAs. Brazil’s Open Finance rules require participants to connect with each other, treat each other fairly, share data on a reciprocal basis and maintain data quality. The UK Open Finance ecosystem publishes figures showing how often services are available, how quickly they respond and how often requests succeed. Similar reporting in India could show how reliably a customer’s request moves through the entire AA network.
The takeaway
The AA framework was built to give customers control over their financial information. Interoperability can make that control useful across the network. Common standards can make it safer, while common charges can fund it.
But December is the start of the test. Clear rules are still needed for pricing, failed fetches, routing, responsibility, performance evidence and AA exits. If these pieces fall into place, the AA framework could become to financial data what UPI is to payments: a simple, widely used everyday utility.
Dessert 🍨
FPIs get an easier route to KYC
The RBI simplifies document verification from abroad, while SEBI reduces how often many FPIs must repeat KYC reviews.
For Foreign Portfolio Investors or FPIs, KYC can create friction at two stages. Documents issued abroad may need to be verified against the originals in India. The same KYC records must also be reviewed at regular intervals. The RBI has now amended its KYC Directions to ease the first step. Banks may accept certified copies of an FPI’s original KYC documents. These may be certified abroad by specified authorities, including foreign notaries, eligible bank officials, courts or judges, and Indian embassies or consulates. This facility already existed for NRIs and Persons of Indian Origin. It now extends to FPIs and takes effect immediately.
SEBI has eased the second step. A KYC review checks whether the information already on record remains current. Under SEBI’s 30 October circular, reviews that were due every year will generally be due every two years. Those due every three years will move to an eight-year cycle. The exact period will continue to depend on the FPI’s category, jurisdiction and regulatory status. SEBI has also removed the separate requirement, at the time of continuing an FPI registration, to report changes in earlier information or submit a no-change declaration. The SEBI changes take effect on 1 December 2026. Together, the two reforms make it easier to complete FPI KYC from abroad and reduce how often the exercise must be repeated.
Behind the stories 🎬
The themes we explore in FinTales often reflect the regulatory questions we encounter in our work with fintechs, investors, and policymakers. Here is a taste of what’s keeping us busy:
Insurance Distribution: We regularly advise fintechs on insurance-related matters, including how they can structure and distribute insurance products within the regulatory framework. As the IRDAI reworks the distribution rules, we are helping market participants assess what the proposals mean for their business models. In October, we hosted a webinar with the Unified Fintech Forum to walk the industry through the consultation paper. We are also supporting industry bodies with their responses.
Account Aggregators: We have advised regtech companies, crypto platforms and personal finance businesses on building products around India’s Account Aggregator framework. Where a design does not fit the framework, we find alternative structures that achieve a similar commercial result.
NRI and FPI KYC: Our clients include leading fintechs that want to onboard non-resident investors without friction. We routinely advise them on the KYC hurdles these investors face, and we take those hurdles to regulators and policymakers.
Mints 🍃
⚖️ UPI MDR reaches the Supreme Court: The Supreme Court has issued notice to the Centre, RBI and NPCI on a plea challenging the MDR on specified UPI merchant payments above Rs. 2,000. The plea questions the MDR’s legal basis and seeks transparency, consultation and safeguards for small merchants. The Court has declined to stay the framework for now.
⏸️ UPI MDR waits out the festive rush: NPCI has deferred the 0.4% MDR on select UPI merchant payments above Rs. 2,000. It was due to start on 15 October. Merchant bodies and payment firms had asked for a delay during the festive season. The charge will now kick in after Diwali. A new date is yet to be announced.
🍎 Apple Pay finally lands in India: Apple Pay is live in India for Axis Bank-issued Visa and Mastercard credit cards. Users can add cards to Apple Wallet and pay contactless in stores, in apps and online using an iPhone, iPad or Apple Watch.
🪪 Aadhaar authentication gets a ‘lite’ on-ramp: UIDAI has launched five initiatives at Aadhaar Samvaad in Kolkata. The one for fintechs to watch is the Sub-AUA/Sub-KUA (LITE) Framework. It will let eligible entities leverage the authentication infrastructure of an existing AUA/KUA, enabling simpler and faster onboarding in real time without establishing any authentication infrastructure. UIDAI also rolled out face authentication for the public distribution system, SWIK Portal 2.0 for authentication approvals, a Token Management System and a revamped website.
🧾 GST clarity for co-lending: The GST fitment committee has proposed an 18% GST on the service an NBFC provides to a bank in a co-lending arrangement. Interest on the underlying loan would stay exempt. The service would be valued using the RBI’s prescribed method. This could settle a long-running dispute over whether an NBFC’s co-lending income is interest or a fee for a separate service. The proposal now needs the GST Council’s approval.
🏦 RBI sets up a markets sounding board: The RBI will constitute a Technical Consultative Committee for Financial Markets. It will give market participants a structured forum to engage with the RBI on policy and operational issues. Its remit covers the money, government securities and forex markets, their derivatives and related infrastructure. The RBI will notify the committee’s members and terms of reference separately.
🏛️ RBI builds its own data fortress: RBI has inaugurated a sovereign data centre in Bhubaneswar. It will host critical systems like RTGS and NEFT without relying on third-party cloud providers. It also spreads RBI’s infrastructure beyond its three existing data centres in Maharashtra. A new cybersecurity institute at the same site will train staff from RBI, banks and other financial institutions in cybersecurity, AI and emerging technologies.
🚨 RBI says assume breach until proven clean: RBI has directed banks, payment system operators and other regulated entities to treat their systems as compromised after any credential exposure or confirmed unauthorised access. Systems must stay in that status until a forensic investigation clears them. The advisory also asks entities to take admin interfaces off the public internet and enforce multi-factor authentication. They must also rotate exposed credentials and shut down dormant or test APIs. It follows a CERT-In warning about the growing use of AI tools in cyberattacks.
About FinTales
FinTales is Ikigai Law’s monthly fintech and digital economy newsletter. It tracks the regulatory shifts shaping India’s fintech ecosystem, from payments, digital lending, KYC, wealth-tech, insur-tech, AI in finance and data governance to product strategy, financial innovation and policy reform. FinTales is curated by Ikigai Law’s fintech team, which advises fintech businesses, banks, NBFCs, payment companies and policy stakeholders on regulatory, transactional and strategic questions across the financial technology ecosystem.
Author credits: Aparajita Srivastava, Astha Srivastava, Samyukta Iyer, Sidharth Chamarty and Pravi Jain.
Image credits: AI-generated
For any queries, reach out to us at contact@ikigailaw.com
