Peer-to-Peer Lending & Account Aggregator Licensing

They are two entirely separate RBI-regulated activities governed by two different Master Directions. An NBFC-P2P operates a marketplace that matches individual lenders with individual borrowers for unsecured personal loans — money moves between the participants through escrow accounts, and the platform earns a fee without lending from its own books. An NBFC-Account Aggregator never handles money at all — it operates a consent-based technology layer that retrieves a customer's financial data from banks, NBFCs, insurers, and other Financial Information Providers, and transmits it to a lender or other Financial Information User only with the customer's explicit, revocable consent. One is a lending marketplace; the other is a regulated data pipe. Neither can be operated under the same Certificate of Registration as the other.

You can build and internally test the technology. What you cannot do is operate the regulated activity commercially — onboard real lenders and borrowers to facilitate actual P2P loans, or go live with real customer consent flows moving actual financial data to a Financial Information User — before the Certificate of Registration is issued. Operating the commercial activity without RBI registration is a contravention of Section 45-IA of the RBI Act.

RBI prescribes a minimum Net Owned Fund threshold for both categories under their respective Master Directions, computed per the Section 45-IA definition of NOF — broadly, paid-up equity capital and free reserves, reduced by accumulated losses, deferred revenue expenditure, and certain specified intangible assets and investments in group companies. Because RBI periodically revises these thresholds, we confirm the exact figure applicable as of your specific filing date during the pre-application consultation rather than quoting a number that may already be superseded.

Generally, no. Both NBFC-P2P and NBFC-AA are activity-specific registrations under RBI's regulatory architecture — an entity registered for one NBFC category is not automatically permitted to conduct P2P or AA activity under the same Certificate of Registration. In most cases a separate application, and often a separate corporate entity, is required. There are limited scenarios where RBI has permitted structural adjustments, but this should never be assumed without a specific regulatory consultation on the exact existing licence and the proposed new activity.

There is no fixed statutory timeline that RBI guarantees for NBFC-P2P or NBFC-AA Certificate of Registration approval. In practice, the process runs through one or more rounds of RBI queries on the promoter profile, capital structure, business plan, and — particularly for these two categories — the technology and data-security architecture. The overall timeline depends heavily on how complete and well-prepared the initial application is, and on RBI's own processing queue at the time of filing.

A Financial Information Provider is an entity that holds a customer's financial data and is willing to share it through the Account Aggregator framework when the customer consents — typically banks, NBFCs, insurance companies, mutual funds, pension funds, and certain tax and other RBI/regulator-notified data sources. A Financial Information User is the entity requesting that data for a specific, disclosed purpose — typically a lender assessing a loan application, or a wealth manager building a consolidated view of a client's holdings, with the customer's explicit and revocable consent captured through the AA's consent artefact. The Account Aggregator itself sits in the middle as a consent-management and data-transmission conduit — it is never a FIP or FIU itself.

No. This is the central regulatory design principle of the AA framework. An Account Aggregator is expressly prohibited from using, retaining, or storing the substance of the financial information it transmits between an FIP and an FIU beyond what is operationally necessary for the technical transmission itself, and it cannot use the data for any purpose other than the specific consented transmission. The AA's business model is built entirely around being a data-blind conduit — its revenue comes from facilitating the consented data flow, not from having any commercial use of the data itself.

An NBFC-P2P platform is required to route lender funds pending disbursal, and borrower repayments, through escrow accounts opened with a bank and structured such that the platform itself does not have unrestricted access to co-mingle or use these funds for its own purposes. This structure exists specifically so a P2P platform's own financial distress cannot put participant funds at risk, since the platform is a facilitator, not a custodian in the ordinary lending sense.

Yes. RBI's P2P Master Direction prescribes exposure limits — a cap on the amount a single lender can lend to a single borrower, and an aggregate cap on a single lender's total P2P lending exposure across all platforms combined, along with a maximum tenure for P2P loans. Because RBI periodically reviews and can revise these figures, we confirm the exact caps in force at the relevant time as part of platform design and lender/borrower disclosure documentation, rather than treating any previously quoted figure as permanently fixed.

Foreign investment in NBFC activities, including P2P and AA categories, is generally permitted under the automatic route under India's FDI Policy and the FEMA (Non-Debt Instruments) Rules, 2019, subject to the conditions applicable to NBFC/financial-services FDI. Where foreign shareholders are involved, the standard FEMA reporting obligations — FC-GPR on the RBI FIRMS portal within the prescribed window of allotment — apply in addition to, and independently of, the NBFC licensing process itself. Foreign promoters and directors are also subject to the same fit-and-proper scrutiny as resident promoters.

RBI is not obligated to disclose detailed reasons for rejection in the way a court judgment would, though the query rounds preceding a decision typically surface the specific concerns RBI has with the application. A rejected applicant can, after addressing the underlying concerns — whether promoter profile, capital adequacy, or business-model clarity — submit a fresh application, but this means restarting substantially the entire process, including fresh fees and documentation. There is no fast-track re-application process specific to a previously rejected NBFC-P2P or NBFC-AA application.

Both remain subject to the standard Companies Act 2013 statutory audit requirement applicable to every company. In addition, RBI requires the statutory auditor of a registered NBFC-P2P or NBFC-AA to specifically report on the entity's compliance with the applicable Master Direction — covering matters like Net Owned Fund maintenance, adherence to prescribed exposure caps (for P2P) or data-handling restrictions (for AA), and compliance with the fair practices code and grievance redressal framework — as an addition to the standard financial-statement audit opinion.

Registered NBFC-P2P and NBFC-AA entities are subject to periodic reporting obligations to RBI specific to their category, in addition to general returns applicable to NBFCs more broadly under the Scale Based Regulation framework where relevant to their classification. The exact return formats, frequency, and filing portal are prescribed in the respective Master Directions and RBI circulars issued from time to time. We set up the applicable reporting calendar as part of the post-registration engagement, confirmed against the current RBI reporting requirements at that time.

The RBI-prescribed aggregate exposure cap for an individual P2P lender applies across all P2P platforms combined, not per platform in isolation — the intent is to prevent a lender from circumventing the individual exposure cap simply by spreading lending across multiple registered P2P platforms. This is enforced in part through mandatory reporting by registered P2P platforms, and lenders are expected to make accurate disclosures of their existing P2P exposure when onboarding to a new platform.

No. An NBFC-P2P platform is expressly prohibited from providing or arranging any credit enhancement, credit guarantee, or assured minimum return to lenders on the platform. The entire regulatory design treats the P2P platform as a facilitator of a direct lender-borrower relationship, with the credit risk sitting with the lender, not the platform. Any marketing or product feature that implies a guaranteed return or a platform-backed safety net for lenders is a direct violation of this core restriction.

RBI expects a registered NBFC-P2P or NBFC-AA to designate specific accountable individuals within the organisation — typically a Principal Officer responsible for regulatory and AML/KYC compliance oversight, and a Grievance Redressal Officer responsible for handling and escalating customer complaints within a defined turnaround time, whose contact details must be disclosed to customers. These are not honorary titles — RBI expects these roles to be functionally staffed and accountable, and their existence and effectiveness can be examined during a supervisory review.

An Account Aggregator's revenue model is typically fee-based, charging FIUs (and in some arrangements, FIPs) a transaction or subscription-based fee for facilitating each consented data-transmission event through its platform — analogous to a toll on a data pipe rather than a business built on monetising the underlying data itself. Because the AA cannot use, sell, or repurpose the data it transmits, the entire commercial model has to be built around the volume and reliability of consented data-flow transactions, not data monetisation.

A DSA or loan-comparison marketplace refers borrowers to banks or NBFCs and earns a referral or origination commission — the loan itself is originated and held on the referring bank's or NBFC's own books, and the marketplace is not itself a party structuring a lender-borrower relationship. A P2P platform is fundamentally different: it structures and facilitates an actual lending relationship between an individual lender (who could be another retail customer) and a borrower, with the platform itself as the regulated intermediary for that specific transaction. This distinction is exactly why a loan-comparison website does not need P2P registration, while a platform that actually matches individual lenders to borrowers does.

Yes. PNPC's FEMA & RBI practice covers both tracks as a coordinated engagement rather than two separate workstreams handed to different specialists — the RBI Certificate of Registration process for the P2P or AA activity itself, and the FEMA/FDI compliance (FC-GPR filing, sectoral cap confirmation, downstream investment mapping if relevant) for any foreign capital in the structure. Structuring both together from Day 1 avoids a scenario where the NBFC application and the FEMA filing timeline are misaligned.

Once RBI issues the Certificate of Registration, the entity is authorised to operate the regulated activity across India — there is no state-specific licensing layer for the core NBFC-P2P or NBFC-AA activity itself, since RBI regulation operates at the central/national level. Other unrelated state-level registrations a company needs regardless of its NBFC status (GST registration in states of operation, professional tax, shops and establishment registration for physical offices) apply independently, in the same way they would for any company.

For a P2P platform, the escrow-account structure exists specifically to protect participant funds independent of the platform's own solvency — funds in transit are held with the escrow bank per the prescribed structure, not on the platform's own balance sheet, which is intended to limit (though not necessarily eliminate) the operational disruption to lenders and borrowers if the platform itself winds down. For an AA, since it never holds or stores the substance of financial data by design, a shutdown does not create a data-retention exposure in the way it would for a data-storing business — the AA's core architecture is built to avoid exactly this risk. In both cases, an orderly wind-down still requires RBI intimation and a formal closure process, and existing participant relationships (outstanding P2P loans, active AA consent artefacts) need a documented transition plan.

RBI charges a prescribed application fee for the Certificate of Registration process, which is a modest component compared to the overall cost of getting licence-ready — the larger costs are the Net Owned Fund capitalisation itself, technology-platform build cost, and professional fees for structuring, documentation, and RBI liaison through the query-and-approval process. Because the capitalisation requirement and RBI's fee schedule are both subject to periodic revision, and because professional fees depend on the complexity of the specific promoter structure and business model, we provide a written, case-specific fee proposal after the initial discovery conversation rather than quoting a generic figure that would not reflect your actual situation.

NBFC-P2P and NBFC-AA applications sit precisely at the intersection of company law, RBI regulatory practice, FEMA/FDI compliance (where foreign capital is involved), Net Owned Fund certification (which specifically requires a practising Chartered Accountant's certificate), and ongoing statutory audit with Master-Direction-specific certification. A firm that only handles the legal drafting or only handles the technology documentation leaves the financial certification, capital-structuring, and post-registration compliance pieces to be coordinated separately — often across multiple advisors who are not talking to each other. PNPC's CA practice covers the full lifecycle: NOF certification, FEMA/FDI compliance, the RBI application process, and the annual statutory audit and compliance cycle after registration, as one coordinated engagement.

This is not the standard structure RBI's licensing framework contemplates — each Certificate of Registration is issued for a specific NBFC activity category, and P2P and AA are distinct categories with different Master Directions, different technology and risk profiles, and different core prohibitions (an AA cannot lend or hold funds; a P2P platform's whole purpose is facilitating a lending relationship). A promoter group wanting to operate both business lines would typically need to structure them as separate corporate entities, each separately registered, rather than seeking a combined registration under one company.

The Account Aggregator ecosystem operates on a common, interoperable technology framework, with a central registry maintaining the list of live, technically-compliant Account Aggregators, Financial Information Providers, and Financial Information Users participating in the network. A licensed NBFC-AA is expected to achieve live technical integration with this common framework as part of becoming operationally functional — holding the Certificate of Registration alone does not make an AA operationally useful to FIUs and FIPs; the technical onboarding to the interoperable ecosystem is what actually enables it to route consented data flows in practice.

RBI's P2P Master Direction sets eligibility conditions for participants — both lenders and borrowers must meet KYC requirements, and there are exposure and category restrictions on who can participate and to what extent (for instance, restrictions distinguishing individual lenders from institutional participants, and caps on total exposure per lender). The platform is responsible for verifying eligibility and enforcing exposure caps at onboarding and on an ongoing basis, not merely at the point of first registration.

RBI's P2P Master Direction prescribes a maximum tenure for loans facilitated through a P2P platform. Because this figure, like the exposure caps, is subject to periodic RBI revision, we confirm the tenure limit in force at the relevant time as part of platform design rather than relying on a figure that may have been superseded. Loan restructuring or extension on a P2P platform also needs to be handled within the platform's disclosed terms and RBI's applicable framework — it is not simply a bilateral matter between lender and borrower outside the platform's oversight.

PNPC has operating offices in Chennai, Bangalore, Hyderabad, and Dubai. For a UAE-based promoter or NRI wanting to set up an Indian NBFC-P2P or NBFC-AA entity, we coordinate the India-side incorporation, RBI licensing, and FEMA/FDI compliance from our Chennai/Bangalore/Hyderabad teams while managing the UAE-side promoter relationship and any UAE entity considerations through our Dubai office — as a single coordinated engagement rather than requiring the client to separately brief two disconnected firms.

The fit-and-proper assessment is RBI's evaluation of whether the promoters, directors, and key managerial personnel of an applicant have the integrity, financial soundness, and professional competence to responsibly operate a regulated financial entity. In practice, RBI takes this assessment seriously for both P2P and AA categories given the sensitivity of the activities involved — unsecured lending intermediation and financial-data handling respectively — and a promoter with an undisclosed adverse credit history, a prior regulatory action, or unclear source of funds for their capital contribution can cause significant delay or outright rejection, even if every other part of the application is strong.

Cross-selling unrelated financial products on a P2P platform raises regulatory questions about whether the platform is operating within the specific, narrow scope of its P2P Certificate of Registration or has effectively expanded into other regulated activities without approval. Any cross-sell arrangement needs to be structured carefully — often through a properly disclosed, arm's-length referral relationship with a separately licensed insurance or investment entity, rather than the P2P entity itself directly offering the additional product — and reviewed against the specific conditions of the entity's CoR.

No. PNPC's engagement model for NBFC-P2P and NBFC-AA clients is structured as a continuing relationship, not a one-time licensing project. Post-registration, we support the statutory audit and Master-Direction-specific certification, the periodic RBI reporting calendar, policy reviews, advisory on structural changes (funding rounds, promoter changes, business-model expansion), and representation in any RBI supervisory correspondence — because a Certificate of Registration is the start of an ongoing regulated relationship with RBI, not the end of the compliance journey.