Account Aggregator Archives

24/01/202224/01/2022

Bharat Distributed Ledger (BADAL) for accelerating trusted commerce in India

India has made rapid progress in digitisation of the economy in the last decade becoming a world leader in identity systems, digital payments and tax, and a new data sharing and empowerment framework. However, many deep-rooted issues still exist, such as extending true financial inclusion; formalisation and creating a higher trust economy, that is essential for growth of mostly small businesses.

In this blog post, we look at innovations in blockchain, distributed ledger and other technologies such as zero-knowledge proofs as potential solutions to build a stronger fabric for the economy for decades ahead. The unique opportunity India has is to boost commerce by enhancing trust, thereby culminating the transformation already underway through existing building blocks of digital identity, payments and data sharing to boost commerce. Unlike many other countries, faster and interoperable payments or reducing the dominance of private money are solved problems for India; the missing piece is to digitise commercial contract enforcement, which on the other hand is a solved problem for developed countries. Lack of adequate contract enforcement caused by contracting parties having different versions of the truth; due to data systems that don’t interoperate reduces trust and creates friction for economic growth. Solution requires connecting the goods and services ledger to the money ledger, so that contracts of any kind become binding promises that can be executed programmatically. Using technology to solve this trust problem is a unique opportunity for India.

BADAL (also happens to be a word for Cloud in local language), a techno-legal solution in the form of “Distributed Ledger for Privacy-preserving Trustful Commerce; is proposed as an interoperable fabric underlying a future programmable economy across large and small businesses to create high trust economy.

We also look at the emergence of Central Bank Digital Currency (CBDC) which is one of the core money applications of this framework and global backdrop in Annexure. There are many other use cases being proposed from land records to decentralised clinical trials for blockchain and allied technologies in different areas of government and business¹ likewise, that can be implemented in BADAL.

First of all, why is trust important?

Trust is the basic glue that connects strangers and promotes economic activity. Money is the basic economic institution in a society building that trust². However, trust builds slowly due to a combination of various factors such as the nature of institutions (political and legal) and the level of formalisation. While formalisation of even small businesses is increasingly addressed by the successful rollout of GST for India, formalisation of trust still remains elusive. At a core fundamental level, trust is a public good that creates friction-free commerce and is a recipe for rapid economic growth.

There is a high correlation between the level of trust in society and GDP per capita³. A study conducted by World Value Survey attempted to measure the level of trust in a country by recording the positive responses received to the question ‘most people can be trusted’. It found that countries with high GDP per capita such as Sweden, Norway and Netherlands recorded high levels of trust exceeding 60% determined in this manner as the graphic below shows.

Douglass C. North, Nobel laureate in economics⁴, found that ‘the inability of societies to develop effective, low-cost enforcement of contracts is the most important source of both historical stagnation and contemporary underdevelopment.’ The Union Minister of Finance and Corporate Affairs has rightly acknowledged the role of the “Hand of Trust”⁵when presenting the Economic Survey of 2019-20.

In societies like India, with limited ability to efficiently enforce routine civil or property contracts, businesses tend to restrict working with those similar to them based on caste, religion etc. (called associational activity) where there is an implicit social and moral enforcement mechanism or with members who have clearly demonstrated reputation in the past (usually the large or the older players). In both these situations, the economic benefit that a new firm can bring with new ideas or new techniques will be muted as its absorption is slower. Similarly, a new player will find it very difficult to compete with incumbents even if such players are economically more efficient. Economist Olson⁶ showed that associational activity is often more detrimental than favourable for an emerging economy. So we need better ways to break this trust logjam. Trust in the money system in India is comparatively high, as promises tend to be kept with sufficient legal backing and can be digitised with e-mandates or automated payments/ collections; but the same is not the case for goods (or services) ledger, leaving room for delays cascading into a logjam resulting in low trust. This is often felt in day to day life by citizens not getting routine services despite advance payment or small businesses not getting paid despite having supplied goods. Delays, defaults and disputes can become the norm if parties have different versions of the truth.

Every economic activity is thus like a mini-contract with one side on the money ledger (payment from party A to B) and the other side, on the goods/services ledger (from B to A) between counterparties, and can be converted into an electronic contract that automatically executes on both ledgers subject to interoperability. To assure the performance of contracts, the money ledger and the goods/ services ledger need to be connected in a way that is scalable, privacy-enhancing, non-repudiable and programmable. This enables a contract agreed between parties becomes a commitment, and fulfilment is guaranteed by code through the electronic contract. Assuring performance of contracts is critical for a country that is seeking to grow through startup activity, not just in tech but other sectors too.

Currently, litigants lose nearly ₹ 50,000 crores annually in wages or business lost which comes to 0.5% of the country’s GDP, because of litigation, an indication of how expensive litigation can be. The majority of civil disputes in courts are related to recovery of money (30.2 per cent) and land-or property-related matters (29.3 per cent) As reported in the 2016 survey carried out by DAKSH. Common reasons for dispute are different versions of the truth of contracting parties, prior to contract (past) or during the performance of contract (future). Having the same truth and programmability inherent in electronic contracts is a boon in this regard.

In an earlier blog, we have explored the benefits of adapted blockchain technologies to solve the problem of SME financing in India with a related post by global experts⁷. We build further on that and believe that India can harness recent advances associated with blockchain technology to enable trust between unrelated parties by combining the best of the scalable and centralized legacy world with a secure and private decentralized world. This can benefit the real economy vastly along with the financial world.

Innovations in distributed ledger technologies and BADAL

Distributed Ledger technology can help in two ways – first by being able to verify past performance before one party strikes a deal with another, and second, by being able to enforce a contract in most situations as performance unfolds in future. Thus, building trust about the past as well as the future.

We thus imagine a fabric based on the following basic principles to help create and grow a large number of applications to record economic activity even while reconciling with other activities and past data and help inject a level of trust by creating a reliable, immutable record of trusted data records and programmable contracts

Single platform to allow standards bodies and organisations to publish their schemas, and reuse other schema elements in composing workflows
Fully privacy-preserving capabilities to allow participants to publish relevant zero-knowledge proofs which do not require private data to be shared beyond the participating entities
A programmatic contracts capability that can help automatically carry out the relevant tasks as agreed on without any further manual intervention

By connecting a new digital money ledger (such as Central Bank Digital Currency, or stablecoins) with the new goods & services ledger, we envisage a boost to trust across economy and commerce. As such, BADAL is the first such framework we are aware of globally, uniquely suited to India’s needs, opportunities and strengths.

We have discussed the early version of this in detail in an earlier open-source document⁸. BADAL is thus a privacy supporting, trust enhancing mechanism of coordinating economic activity, and information recording and sharing. Originally this group started out of a process to explore the domain around and figure out the appropriate model to support CBDC, support data sharing between participants, and coordination and automation of event-based standing instructions across events in the goods and services ecosystem and/or money flow.

We then reviewed exciting developments in related areas first to understand their relevance given India’s unique needs. Blockchain technologies generally are seen to enable unrelated parties to trust each other and transact without depending on a central institution or intermediary. These technology innovations are around three key areas:

Maintaining immutability and integrity of data across the distributed ledgers of parties.
Governance mechanisms, especially for decentralised networks
The programmability of such transactions to allow automatic execution.

Public blockchain technologies like Bitcoin and Ethereum, on the other hand, are based on a philosophy of distrust of centralised institutions like Central Banks and are designed for unrestricted access and decentralised decision-making. But they have had to develop new approaches to contend with a few challenges, especially given the huge growth off late that see further wor:

The enormous consumption of resources to establish ‘proof of work’ that limits efficiency and scalability, leading to newer approaches
Exposing all transactions on these networks that generally do not allow sensitive data to be private on the key layer, is as critical for confidential business data as it is for personal data
Rise of many networks that are not interoperable with each other or with the mainstream economy, though some bridges do exist
May have ability to operate outside banking conduits and regulatory frameworks that challenges government’s sovereignty and financial stability through greater oversight has been coming recently

Research on amending throughput, reducing costs and enhancing privacy/auditability/KYC compliance has been ongoing at a rapid pace, especially over the last couple of years.

Despite these unresolved issues, Public blockchain-based tokens, so-called cryptocurrencies, NFTs etc have become an unregulated asset class, especially amongst the young rapidly given the ease of use, creating concerns on possible misuse as well as potential opportunities. We were also part of the recent consultation of the Parliamentary Committee on Finance on ‘Cryptoassets: Opportunities and Challenges’ and had shared with them some of our ideas above in our submission here⁹.

Various solutions have been employed to address some of these challenges:

Permissioned blockchains, such as Hyperledger Fabric and Corda, allow only trusted parties to participate. Corda uses Notaries for verifying transactions. Such solutions have been successfully used in finance, supply chain, property rights, healthcare, education and e-governance
Zero-knowledge Proofs (ZKPs) allow proving/verification of specific aspects of data without actually making the data public

BADAL builds on the above primitives and is offered as an open and interoperable platform to enable money ledgers such as CBDC/stablecoin along with applications relevant for finance and commerce. This can be designed as a permissioned network relying upon a few regulated entities, and interoperable to ensure that its benefits are widespread and at much lower costs than permissionless systems. It consists of a private ledger that holds sensitive user data with access restricted to participating entities only, and a public ledger that contains notarised zero-knowledge proofs about transactions between users. It supports different schemas (configurations) that enable usage across different use-cases.

This programmability coupled with immutability akin to electronic contracts, allows applications in BADAL to be used to leapfrog the trust logjam, without diluting sovereign privileges of control of money given India’s stage of development. BADAL will thus establish provenance that helps establish credibility and reputation of transacting parties, proof of title/ownership of goods and assets, proof of the history of transactions including promises made and ambiguously defined and fulfilled; automatic execution of terms of contracts along with privacy as a fundamental right.

Historically, monetary accounting has solved for only one side of this metaphorical coin- the monetary value. All monetary systems denote a money value to any transfer of goods or services. BADAL, being a ledger that can record value in any domain, solves for the non-monetary aspect of the transaction. Integrated with electronic contracts for a variety of applications, BADAL will enable digital claims on non-monetary assets, including new age asset classes such as crypto assets, NFTs, where claims can be financialized and liquidated. An inherent promissory layer can be enabled into the current transaction mechanism. This extends to all data types, from land records to hospital quality service quality etc, rather than just transactions involving money and goods/ services.

The ability to connect any of the data types across domains can give rise to massive amount of efficiency gains with automated execution thanks to new data from machines like cars, consumer durables like refrigerators or health wearables coming from advances in IoT (Internet of Things), 5G, Imagine a use case of automated crop insurance with sensors that monitor weather from a satellite in space to moisture in soil etc. and deliver claim benefit to the farmer with zero friction in real-time.

One of the biggest problems BADAL could solve at bottom of the pyramid is financial inclusion in India. This is not only in the form of increased monetary transactions through it, but also the ability for MSME’s to gain cheaper credit. This is a possibility as MSME’s will find it easier to prove their liquidity and income to banks and other lenders due to the monetary traceability the system will provide. An increased ability to prove financial stability will lead to greater leverage for borrowers and more systemic trust for lenders. This increase in the systemic trust will not only lead to an increase in credit creation but catalyse an increase in money velocity in India as a whole.

In a subsequent blog post, we will detail the potential use cases; as well as preliminary design of a prototype of one sample use case that is being built currently.

BADAL fabric supporting India Stack could boost digital India

India has pioneered transformations in Identity, Payments, and Data empowerment (these building blocks are popularly called the India Stack) through a techno-legal approach. These address friction of doing business, information asymmetry, and distributed systems. Breakthroughs along the way were public platform (identity), public protocols and standards, and techno-legal approaches to solving big societal problems.

Some examples of this:

Aadhaar enabled e-KYC has significantly reduced the onboarding cost for finance companies and utilities from ~Rs 1500 to as low as Rs10/¹⁰. This lower KYC cost has helped in expanding the reach of government initiatives like PMJDY and similar massive private rollouts like Jio.
Unified Payments Interface (UPI) has led to an explosion of digital wallets and payment technologies that reduce transaction friction. India has logged more real-time online transactions¹¹ than China and USA in 2020.
The recent launch of the Account Aggregator (AA) model (based on Data Empowerment and Protection Architecture, DEPA) allows the controlled sharing of private financial data by citizens with various financial institutions to get the best deals. This is a global first and in some sense, an export of a truly global standard¹² from India.
Open Credit Enablement Network (OCEN) is creating a way to democratise access to credit, to the level of making it accessible to a street vendor for small sums. These public goods prevent any large player from monopolising the data ecosystem and at the same time reduce the cost of providing service. For instance, microloans as small as Rs.300 can be availed on GeM-SAHAY leading to true inclusion at the bottom of the pyramid.

These techno-regulatory concepts are now being considered for adoption by several countries across the world. Overall, India is arguably ahead of most countries in adopting technology for promoting financial inclusion as well¹³.

The next building block now is the trust layer through BADAL, ensuring every commitment is met and every contract is enforceable, boosting transparency and growth over the next decade. Trust permeates through all three ends of this triangle as identity is the ‘who’; and data and payment relate to ‘what’ of commerce. In BADAL, identity and data sharing can be achieved without diluting privacy to enable trusted payments (& commerce).

Annexure: CBDC Developments

While BADAL provides fabric to money or goods ledgers, we describe CBDC in detail here, given its importance. Money was traditionally issued by the sovereign (through a Central Banker) and circulated in the economy through layers of banking intermediaries. With the advent of permissionless public blockchains, some of which also seek to portray themselves as alternate currencies, the sovereigns have taken note and introduced their own variant as a public good to protect the financial stability of the nation-states. This sovereign/state-issued digital currency is popularly known as Central Bank Digital Currency (CBDC).

Central Banks have been increasingly researching and in some cases developing prototypes of CBDC since 2017 as per a survey¹⁴ by the Bank for International Settlements (BIS). 86% of the world’s central banks¹⁵ are studying CBDCs actively. Sweden has finished its phase-1 pilot for CBDC called e-Krona in April 2021¹⁶. China published its plan for a CBDC retail pilot called e-CNY in July 2021 and has already put this in production apparently timed ahead of the Winter Olympics that will be hosted this year. This seems to already cover a fifth of the population ¹⁷. The USA is evaluating its own CBDC¹⁸; has been considering a regulatory framework for Stablecoins and has come out with a detailed report titled ‘Money and Payments: The U.S. Dollar in the Age of Digital Transformation in January 2022¹⁹’. In India, RBI is actively studying the benefits of CBDC²⁰.

fig: Central bank’s work on CBDC advances further

While there are different types of CBDCs such as wholesale/ retail and account-based/ token-based, ultimately a payment using CBDC can be immediately settled. This is akin to using paper money and unlike a cheque or money transfer between bank accounts that require a process of clearing and settlement adding to inefficiency and costs. CBDC can potentially thus leapfrog depending upon the development of existing banking systems in different countries.

Advanced Economies (AEs) and Emerging Markets and Developing Economies (EMDEs) have different motivations for issuing CBDC to end-users (via Retail CBDC) and financial institutions (via Wholesale CBDC), illustrated in the diagram below.

fig: Motivations for issuing a retail CBDC

In countries like China²¹ and Sweden²², a significant part of money moves digitally on private networks and central bankers are losing visibility and control of money flows. Both countries are moving quickly towards the launch of a retail CBDC.
China is also possibly viewing its CBDC as a tool to emerge as a global reserve currency²³ like the USD. China was also home to some of the largest mining pools²⁴ that spend enormous electricity on cryptocurrency. In this backdrop, China has recently banned crypto-mining and private cryptocurrencies.
In the USA, payments are expensive due to its legacy system of banking. This has led to a burst of digital payment options, the latest being ‘stablecoin assets’ (digital currencies backed by real assets like US dollar, treasuries, etc) that also compete with their money-market funds. Stablecoin assets have crossed $100 billion 25 in market value and are a popular choice to transact in Decentralised Finance (DeFI). DeFi is a parallel financial system evolving around crypto-assets. DeFI is not subject to transparency and compliance required in the conventional financial world at this point in time. As DeFi becomes big and interacts with the conventional financial world, there is a growing systemic risk arising from failure or fraud in DeFi. The US Government, therefore, wants to regulate some aspects of DeFI²⁶ and may thereby bless some stablecoins and crypto-assets as explicitly permitted financial products. Earlier in 2015, Bitcoin was determined to be a commodity²⁷ by some authorities there. The US Fed has also begun a consultation process towards design choices and feasibility of CBDC implementation.

Indian perspective

In India, the focus of policy has rightly been on promoting financial inclusion to formalise the economy and drive economic growth. One important factor which drives the usage of unregulated informal value transfer systems is the lack of banking facilities and corresponding amenities for managing money, which leaves rural communities without alternatives other than a person-to-person method of transferring monetary value. Even though India has seen a significant increase in the number of bank accounts created, Reserve bank data still highlights little improvement in account usage and institutional borrowings, which feeds into the broader issue of financial inclusivity.

Initiatives like Pradhan Mantri Jan-Dhan Yojana (PMJDY) opened doors to big change. UPI has been very successful as a payment mode but still needs underlying bank accounts to transact and thus depends on the banking system & its motivation to provide access to the poor. The PMJDY scheme announced in 2014 has increased the number of adults with bank accounts to 43.47cr ²⁸ (~46% of 93.55cr adults with an Aadhaar²⁹). Despite this headway, there is still a lot to be achieved. The Financial Inclusion Index (FI) recently launched by RBI shows that India is at 53.9 on March 21 (vs 43.4 in March 2017) – a little more than halfway towards complete financial inclusion (FI of 100)³⁰. Presently, the banking system acts as the main gateway to financial inclusion as the banking system is the main distributor of cash. Hence, various government programmes (like PMJDY) rely upon banks for financial inclusion, despite those being not remunerative for banks. The accounts also have various restrictions on the number of debits/withdrawals to ensure low cost.

Even with the existence of such low-cost bank accounts, the poor do not have an incentive to use a bank account regularly as they do not save enough to use the bank account as a store of value. They use these accounts mainly to collect remittances and withdraw cash at ATMs as bulk of their transactions is in cash, not leaving a visible money trail that in turn makes financial inclusion difficult. Cash in circulation in India even now is Rs 29.38 trillion³¹ (~14.9% of estimated GDP for 2020-21 32) despite the availability of these cheaper accounts, demonetisation in 2017 and the subsequent formalisation of the economy with GST, RERA, etc.

In addition, the cost of handling cash by the central bank and commercial banks (currency printing, operating currency chests, logistics of moving currency, ATM operations, etc.) has been estimated to be ~Rs 21,000 cr (Rama Bijapurkar) and ~1.7% of GDP ( (Visa Inc., 2016). High adoption of CBDC can help in reducing this cost while creating enormous amounts of data and enabling policymakers to diagnose and regulate better. At a later stage, CBDC can also be used for targeted monetary policy actions when its impact on the financial system is well understood. Experts are concerned that CBDC may result in the disintermediation of the financial system. This risk can be mitigated by following design principles set out by the Bank for International Settlements (BIS)³³ (i) “do no harm” to monetary and financial stability; (ii) coexist with cash and other types of money in a flexible and innovative payment ecosystem; and (iii) promote broader innovation and efficiency.

CBDC inherently provides an alternative to cash to directly reach a customer and can complement the banking network to make adoption quicker. By providing a digital alternative to cash will enable building verifiable money trails that can lead to greater financial inclusion by private players providing customised health, insurance, investment & education products in compliance with privacy laws. In the financially excluded segments, CBDC, being a form of central bank currency, is likely to be well trusted and be adopted easily.

The blog post is co-authored by Sanjay Phadke, Dhananjay Nene, Sharad Sharma, Navin Kabra, R Barve, K Babel, V Agarwal, K Gokarn, Kalyan Narguru, Shashank B, Arun Maharajan, Karan Sirdesai, P Sahu, P Rao, A Kulkarni, Krishna Iyer, V Nene and A Lath.

If you have any queries or comments, please contact us at [email protected].

14/10/202118/10/2021

Confidential Clean Rooms in DEPA

We are at the cusp of a data empowerment revolution in India. The DEPA architecture and its first instantiation, the Account Aggregator (AA) framework are empowering individuals and businesses to share their data at low cost and friction, enabling scenarios such as flow-based lending. The Unified Health Interface (UHI) is expected to drive a similar transformation in healthcare.

At the same time, we are acutely aware of the challenges that lurk, none more serious that security and privacy. With the Open Credit Enablement Network (OCEN)/AA framework, for example, a data principal can share their data instantly with many lenders, with no technical guarantees that all lenders will use their data only for the purpose of evaluating the current loan application. The upcoming Personal Data Protection Bill, increased regulation and periodic compliance audits can help detect and deter data abuse. But these measures are not only insufficient in the face of advanced, persistent threats from malicious data consumers, they increase operational costs and limit participation.

We are taking a step towards addressing these challenges by introducing a new privacy construct in Data Empowerment and Protection Architecture (DEPA) called Confidential Clean Rooms. Confidential clean rooms are hardware-protected secure computing environments where sensitive data can be processed while limiting the purpose for which it can be used. For example, lenders can host their business rule engines in confidential clean rooms, and prove to an auditor, regulator, or the consent manager that they cannot access the raw financial data, and the only outcome that they can learn is the loan offer. Confidential clean rooms are based on an emerging technology broadly called confidential computing, which is already supported by major hardware manufacturers such as Intel Corp and AMD and by all major cloud providers, and we expect this technology will mature and be commoditized over the next couple of years.

Today we are announcing the launch of a pilot to evaluate the feasibility and value of confidential clean rooms in the context of OCEN. The pilot is open to lenders, technology services providers and independent software vendors to partner with us over the course of the next year.

Please see the following open house session for more details about partnering with us and indicate your interest using the following forms by 31st of October 2021.

Register for Confidential Clean Rooms Pilot: https://bit.ly/CCRPilotGForm

Related Information Below

02/09/202111/09/2021

Major Indian banks join Account Aggregator network to help individuals conveniently access and digitally share their financial data

Eight of India’s major banks (State Bank of India, ICICI Bank, Axis Bank, IDFC First Bank, Kotak Mahindra Bank, HDFC Bank, IndusInd Bank, and Federal Bank) have joined the Account Aggregator network. Together, these banks cover nearly 40 percent of India’s banking customers. This move ushers in India’s open banking moment and empowers millions of customers with the ability to digitally access and share their financial data across institutions in a secure and efficient manner. AA reduces the need for individuals to wait in long bank branch queues, use complicated internet banking portals, share their passwords, or seek out physical notarisation to access and share their financial documents securely. Just as UPI, NEFT, or IMPS are key financial utilities for secure flow of money, Account Aggregator is an urgent and powerful financial utility for the flow of data controlled by the individual. AA is one of the most sophisticated open banking infrastructures in the world, and has attracted interest from other countries who are interested in implementing similar infrastructures, including the EU, the UK, Japan, and Australia.

AA creates secure, digital access to personal data at a time when COVID 19 has imposed restrictions on physical interactions for services. It also reduces the fraud associated with physical data tampering by introducing secure digital signatures and end to end encryption for data sharing. These capabilities in turn open up many possibilities. For instance, whereas physical collateral is usually required for an MSME loan, with secure data sharing via AA ‘information collateral’ – or data on future MSME income – can be used to access a small formal loan. The industry will see much needed innovation as improved access to data helps meet critical financial needs like small-ticket MSME working capital loans, affordable micro-insurance products, better savings and money management, and others. HDFC Bank and Axis Bank have been using AA for auto loans, LendingKart has been using AA for MSME loans, while IndusInd Bank has been using it for Personal Finance Management. Secure access to financial data via open banking infrastructure was estimated by a McKinsey report to create up to 5% of GDP in value for India by 2030.

Four banks are already live with data accessible for consumers via Account Aggregators, and the rest will shortly go live. Many more banks are expected to join the AA ecosystem in the coming months to allow all customers, regardless of bank, to access their data. Four NBFC-AAs have received operational licenses (Finvu, OneMoney, CAMS Finserv, NESL), three more have received in-principle approval (PhonePe, Perfios, Yodlee), and many more are in different stages of application. Consumers using the AA financial utility will benefit not only from ease of access to data but also from greater choice of products, better pricing, and increased financial inclusion. With the Personal Data Protection Bill likely to become law soon, the AA framework will become essential for regulatory compliance and access to consented data flows.

The AA journey started six years ago in July 2015 when the Financial Sector Development Committee (FSDC) — chaired by the Finance Minister and comprising the key financial sector regulators RBI, SEBI, PFRDA, and IRDAI — came together in a visionary call for a unified, consented, data sharing ability for consumers across banking, securities, pensions, and insurance.

The innovative AA network includes Banks, NBFCs, RIAs, and other regulated entities as Financial Information Users and Providers with Account Aggregators as individual-facing consent managers.

=======================================

Quotes from ecosystem members

Shri M Rajeshwar Rao, Deputy Governor, Reserve Bank of India

“India is a world leader in building Public Digital Infrastructure, and the Account Aggregator framework follows that tradition. AAs enable secure, consented data flows while protecting user privacy. In conjunction with other platforms like the Unified Payment Interface, Account Aggregator creates in India the most cutting edge digital financial infrastructure in the world. It is encouraging to observe that more entities are seeing value in this initiative for furthering financial inclusion and cultivating innovation in financial services.”

Shri Anjani Rathor, Chief Digital Officer, HDFC Bank

“As India goes digital, data becomes a significant driver of growth. And, data belongs to the citizens. Enterprises are merely custodians of data. It is only right that we build this digital infrastructure of ‘account aggregators’ through which citizens can safely share data.

With AA, enterprises can both contribute and leverage data to create amazing experiences for their customers. This will lay a strong foundation for a data-driven society in India and HDFC Bank is proud to be a part of this journey.”

31/08/202102/09/2021

Account Aggregator Ecosystem Go-Live

iSPIRT Foundation welcomes you to the virtual launch of the industry-wide Account Aggregator (AA) ecosystem on September 2, 2021.

This event announces the major financial institutions that have gone live, and demonstrates the powerful use cases of AA. It will be a major milestone for the AA framework for consented data access and sharing in the financial sector.

Time (IST)	Session	Speaker(s)
4:00-4:10 PM	A Regulatory Framework for Account Aggregators and the Path Ahead	Shri M Rajeshwar Rao, Deputy Governor, Reserve Bank of India
4:10-4:30 PM	The Account Aggregator Leapfrog is Here!	– Presentation by Shri Nandan Nilekani, Chairman, RBI Committee on Deepening Digital Payments (2019) and Volunteer, iSPIRT – Workflow demonstration by Shri Siddharth Shetty
4:30-4:35 PM	The Early Builders on AA	Hear from a cross-section of ‘early mover’ CEOs and leaders of major Banks/NBFCs, Account Aggregators, and Technology Service Providers
4:35-4:45 PM	A Global Perspective on India’s Account Aggregator Model	Shri Siddharth Tiwari, Chief Representative for Asia and the Pacific, Bank for International Settlements
4:50-5:35 PM	Fintech Roundtable: Innovating on AA for Improved Financial Services	Panel discussion moderated by Shri Rajesh Bansal, CEO RBI Innovation Hub. Panellists: Harshvardhan Lunia, Founder, Lendingkart; Sumit Gwalani, Co-Founder, Fi; Shiv Chatterjee, Co-Founder, DMI Finance; Naveen Kukreja, Co-Founder, Paisabazaar; Sucharita Mukherjee, Co-Founder, Kaleidofin, Nithin Kamath, Co-Founder, Zerodha
5:35-5:55 PM	Fireside Chat on the Future of Cross-Sectoral Data Sharing	Moderator: Shri Amitabh Kant, CEO, NITI Aayog; Panellists: Dr RS Sharma (Chairman, National Health Authority); Shri Ajay Seth, Secretary, Department of Economic Affairs and Member, Financial Stability and Development Council (FSDC)
5:55-6:00 PM	Designing User Control over Data for India	Hear from current and future Account Aggregators on innovating for control over our personal data
6:00-6:10 PM	Closing Remarks: Building for India	Dr Pramod Varma, Chief Architect, India Stack

To participate, please Register now

05/05/201913/05/2019

Announcing Data Empowerment And Protection Architecture (DEPA) Workshop On 18th May

What is DEPA?

The Data Empowerment and Protection Architecture (DEPA) empower every Indian with control over their data, and democratises access and enables the portability of trusted data between service providers. This architecture will help Indians in accessing better financial services, healthcare services, and other socio-economically important services. DEPA is more commonly known as the ‘Consent Layer of India Stack’.

The rollout of DEPA for financial data and telecom data is taking place through Account Aggregators that are licensed by RBI. It already covers all asset data, liabilities data, and telecom data.

The purpose of the session is to understand the technological, institutional, market and regulatory architecture of DEPA, it impacts on existing data consuming businesses and how people could contribute to this new data sharing infrastructure that’s being built in India.

The session will be anchored by Siddharth Shetty (Data Empowerment And Protection Architecture Lead & Fellow, iSPIRT Foundation)

DEPA Unleashed

DEPA is a new approach, a paradigm shift in personal data management and processing that transforms the current organization centric system to a human-centric system. By giving people the power to decide how their data can be used, DEPA enables the collection and use of personal data in ways that empower people to access better financial, healthcare, and other socio-economically important services in a safe, secure, and privacy-preserving manner.

In the fight for data, the individual has lost control over how their personal data is collected, shared, and used. This can be a very disempowering experience for the user, who now has no means of gathering and using their data for their benefit. It also inevitably prevents the user from accessing essential financial services and inhibiting their participation in the market.

India, who is a step ahead of the curve, recognises the need to empower the user with their own data. The Indian government has operationalised the values stated above by encouraging and mandating organisations to seek the consent of the user to use and share their data and seeded the idea of data access fiduciaries, organisations envisioned to enable personal management of consent. The first manifestation of Data Access Fiduciaries is for financial data through the NBFC-Account Aggregator

NBFC Account Aggregator Ecosystem

The Account Aggregator enables users to maintain and use their financial data as they see fit.

In the past, it was tremendously hard for an Indian to get a statement of his bank account; when applying for a loan, he had to share either unverifiable paper records or his banking password with the lender, not knowing what data might be extracted. With Account Aggregators, customers can allow certain financial data to be shared safely. And because the Account Aggregators operate on a fee-for-transaction business model and are legally prohibited from storing or selling data, users can rest assured that their privacy is respected.

The Account Aggregator performs two main functions. It assists and enables the user to access their financial data easily and it helps manage consent.

For a quick overview of the Data Empowerment and Protection Architecture and NBFC Account Aggregator, you may watch this Future State webinar: https://youtu.be/mxFe5404jY8

Future State has also put together a Data Empowerment Starter Kit: https://spark.adobe.com/page/cGGiu1XTUNrle/

Session Flow

Overview of the Data Empowerment and Protection Architecture (DEPA)
Technology Architecture
Institutional Architecture of Data Access Fiduciaries
Market Architecture of the entire Ecosystem
Q & A

Location

Residency Road, Bangalore

Time

5:30pm – 7pm

How to participate?

We’re inviting fintech entrepreneurs, product managers, developers and anyone else who is looking to understand the potential of the Data Empowerment and Protection Architecture.

If you want to further your understanding of the Consent Layer of the India Stack, click here to register for the session.

Due to limited seating, we will be unable to accommodate all applicants. (Confirmation emails with venue details will be sent across by 15th May 2019)

Key Resources

Policy

Account Aggregator Master Directive by RBI: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=10598&Mode=0
Public Credit Registry by RBI: https://rbi.org.in/scripts/PublicationReportDetails.aspx?ID=895

Technology

Electronic Consent Framework by MeitY: http://dla.gov.in/sites/default/files/pdf/MeitY-Consent-Tech-Framework%20v1.1.pdf
API Standards: https://api.rebit.org.in/list
Financial Information Standard: https://api.rebit.org.in/schema

In addition to Financial Data, the Account Aggregator approach is being adopted for:

Healthcare Data: http://www.niti.gov.in/writereaddata/files/document_publication/NHS-Strategy-and-Approach-Document-for-consultation.pdf
Telecom Data: https://www.trai.gov.in/sites/default/files/RecommendationDataPrivacy16072018_0.pdf (Recommendation – 3.3 C)
Urban Data: https://sites.google.com/view/iudx-technical/home
Private Data: Srikrishna Report for Privacy Bill: http://pibphoto.nic.in/documents/Others/2018727xcxzcx151.pdf (Page 39, Chapter 3F)
- The Draft Privacy Bill lists 4 Rights for a Data Principal, one of which is the Right to Data Portability: (1) The data principal shall have the right to— (a) receive the following personal data related to the data principal in a structured, commonly used and machine-readable format— (i) which such data principal has provided to the data fiduciary; (ii) which has been generated in the course of provision of services or use of goods by the data fiduciary; or (iii) which forms part of any profile on the data principal, or which the data fiduciary has otherwise obtained. (b) have the personal data referred to in clause (a) transferred to any other data fiduciary in the format referred to in that clause.

Reading List

Data To The People – Nandan Nilekani – Foreign Affairs
Who controls your data? India may pass a law ensuring that you do – Vasant Dhar – Washington Post
India Must Become the Worlds First Data Democracy – Nandan Nilekani – The Week
India can offer a radically new way of looking at data – Nandan Nilekani – The Print
India must embrace Data Democracy – Nandan Nilekani – Product Nation
The best way forward for privacy is to open up your data – Tanuj Bhojwani – Product Nation
Rights-based data protection framework for financial information – RBI Committee on Household Finance

02/09/201812/10/2018

Demystifying India’s Data Protection Bill By Supratim Chakraborty And Siddharth Shetty

Data protection and privacy have been a topic of hot debates and discussion in recent times in India. It had become extremely important as India is progressing to a be a “Digital economy” to address this issues relating to the use of personal data.

iSPIRT has been in forefront of developing Consent Framework and called as Data Protection & Empowerment Architecture (DEPA). The Account Aggregator Policy of RBI revolves around this consent architecture.

Whereas the bill is of interest to almost all the sectors of the economy, it is extremely important for businesses in Information Technology sector and especially in Software product Industry to understand the law as it is seeded and further as it evolves.

The bill has many aspects to it in the legal framework. It is not possible to cover the entire understanding of the bill in one blog. We have attempted to cover some salient features that may be important for the Software Product Industry as well as how it contacts with the techno-legal aspects of DEPA as it stands in financial sector, perhaps to be replicated in other important sectors of the economy.

A copy of the draft bill is given on the MeitY website at http://meity.gov.in/data-protection-framework

This blog is again posted in a Question and answer format both as a video and as a transcript of the video. You can use the one you like.

Questions have been asked by iSPIRT volunteer and Policy expert Mr Sudhir Singh and answered by Supratim Chakraborty (Data Privacy and Protection expert from Khaitan & Co.) and Siddharth Shetty (leading the DEPA initiative at iSPIRT).

What are the most important aspects of the bill?

Supratim answered, “What we have seen is through this draft bill, there is an attempt to establish the relationship of trust between the data subject and data controller. The nomenclature has been changed in this bill and It is data fiduciary and data principles. It puts a lot of onus on the data fiduciary to take care of data care protection.”

“There are several important aspects of the bill that needs attention such as localisation of data, cross-border transfer and also some other aspects such as privacy by design, transparency requirement, security safeguard, breach notification, grievance redressal mechanism, the requirement of Data protection officer, record keeping requirements”, as elaborated Supratim.

Is there some restriction on data fiduciary? Is the state exempted?

Supratim said, “this bill is equally applicable to private parties and the Government unlike earlier provisions of section 43A and 72A of IT ACT. 43A will be scrapped after this bill comes into existence. There has been a lot of debate on this aspect of bringing Govt. under the purview of the law.”

Is right to be forgotten covered in a similar way as GDPR?

Supratim explained, “Our Govt. has looked at this in a more business-friendly way by covering the right to be forgotten by provisioning that any further dissemination of data should be stopped, once the data principal chooses to withdraw the consent or ask for the right to be forgotten.”

He described four governing aspect that explains how to determine the aspect of keeping Data local, as described below.

You could have certain pockets of personal data that can be transferred outside.
There could be certain pockets of data that could be transferred outside but a serving copy of the data has to be within the country
The third category is sensitive personal data ambit of sensitive personal data which has been widened considerably compared to what we saw under the 43A of IT ACT. For this, if sent out of
The fourth category is data that cannot be sent outside country at all.

“On Cross border transfer of data in addition to ‘consent’ there has to be standard contractual clauses (approved/prescribed by authority) or the transfer to a jurisdictions is approved by the central government”, he further explained.

What is the Data Protection Authority?

Supratim answered, “In the draft bill this seems to be all encompassing all powerful authority from rulemaking to advisory to enforcement. Therefore it is important to see how this really shapes up. In “IT Act”, section 43 A and 72A were largely there to cover the aspects of data privacy but enforcement and implementation.”

What are other important aspects to consider?

“There are many aspects but let us touch upon two given below”, said Supratim.

One is the requirement of having notices in multiple languages, which is not a very hard obligation the way it has been put. But in a country like India for say an e-commerce platform imaging the cost that one has to incur for putting multiple language notices. Also, we need to see are we able to really address the point of informed consent through this, because you also have a section of people who may be illiterates. Justice Srikrishna report suggest that we should have short videos or graphical representation which make it very easy for someone to understand the critical aspects of privacy.

Another important aspect is applicability of the law. This law is applicable to all processing that is happening in India and also to foreign bodies. Section 2(2) talks about applicability to foreign bodies, the first part says that “in connection with any business carried out in India”. This means a global platform that is accessible from India has to have the entire requirement of this law.

Are we going in direction of GDPR?

Supratim answered, “Whereas we are trying to follow the Gold standard and many countries are trying to follow the path set by GDPR, India is quite different country and we are not following everything the way it is in GDPR, we have to be mindful of our requirements. But the idea is slowly and surely reach a zone where we can have our laws quite akin to laws of matured jurisdictions.”

How does Bill address iSPIRT DEPA initiative?

Siddharth, sees this draft bill as a unique India first approach. He feels that apart from addressing privacy and data protection aspects it empowers Indians on having control on the use of their data for better financial services, better health services, education etc.

Siddharth goes on to explain that at iSPIRT for past 3-4 years we have been working at Consent layer of IndiaStack or Consent framework and it is great to see that bedrock of draft bill is actually based on consent and in that way it is somewhat similar to GDPR. But, one of the biggest problem they are facing in EU today is it is very difficult to operationalise consent. It is for the first time India has a unique infrastructure to operationalise consent.

“DEPA is nothing but a set of two tools that helps to operationalise consent, explains Siddharth.

One is known as Digital Locker system which allows to the federated exchange of data and second is known as electronic data consent, which is nothing but an electronic representation of user Consent.

“This means, if you want to share or allow your data from some provider to say another consumer, then you must be able to express what date you want to share with whom for what time period in some codified manner. This codified information or consent is known as consent artefact”, says Siddharth further.

As explained by Siddharth, the ‘consent artefact’ became a national standard in 2016 adopted by four financial sector regulator RBI, PFRDA, IRDA and SEBI and they adopted it for their entire eco-system.

Based on consent artefact every individual has an access to financial data and has a mechanism to share that data to gain access to a loan or any other services provider. This has been through an institutional mechanism called Account aggregator.

Siddharth further elaborated that, “the ‘Account aggregator’ (AA) is a class of entities known as data access fiduciaries. The AA unlike other parts of world decouples the institution that collecting consent from an institution that either consuming data or providing data. In EU e.g. as per of PSP2 directive the account information service provider which consumes data is also responsible for collecting the data.”

In India, 3 AA have been approved. Technical standard drafts are also out for ecosystem. And through AA you actually have an entity that’s working toward creating an informed consent experience. Going forward just like UPI you receive your consent for a payment, through AA you will have an entity that helps you provide and control consent. Based on Financial sector we have proposed a similar concept to TRAI for the telecom sector and health sector to NITI Ayog.

Has the AA concept been addressed in the bill?

Siddharth explains further, “The bill makes bedrock of most processing of data based on consent. AA model is nothing but your consent collector or Consent manager. Every data principle they have outlined right to confirmation and access, right to correction, most importantly the right to data portability. As a data principle from data fiduciary, you have the right to request and port machine structured non-reputable transaction history or any other user-generated data to other service providers. AA is nothing but a framework to operationalise this right.”

He further explained that in the report preceding the bill, they talk about a concept consent dashboard. AA is nothing but a consent dashboard. They had 2 tech innovation consent dashboard and data dashboard. You can log consent flows and data flows.

Will, there be consent dashboards concept like AA in other sectors also or will there be one single point authority under DPA?

Siddharth, “it would be a combination of both. If you see the draft bill, it allows sectoral regulators to write rules. For data the falls under private data sets category such as data pertaining to social media etc, DPA would prescribe an standard.”

The report talks about that dashboard can be maintained by each data fiduciary or it can be a common dashboard that everyone else agrees and follows. If you look at the account aggregator dashboard it is a common dashboard for the entire financial sector. But for social media companies can follow their won dashboards.

For any Software product companies that does not lie in any of the regulated sector can create their own consent dashboards, where the user can come see their dashboard correct their data, port the data, manage their consent.

Unlike the IT act, this regulation will have a direct bearing on any businesses processing data irrespective of being in a Software product or other domain. And hence there is a need to be attentive. How right is this aspect?

“Yes, the ambit increases quite a bit. Wherever there is sensitive personal data interface involved, the level of compliance requirement has gone up several times. In the IT Act, there was a mention of personal data in section 72A. The present draft bill does not talk about the deletion of 72A. The draft bill have a parallel mechanism set out in the IT Act”, mentioned Supratim.

Siddharth, “it is just not limited to compliance, this law unlocks the whole host of business models around data sharing around consented data sharing that you haven’t yet seen in any other country and it will be really interesting to space to see what companies get a build out there.”

Question from Participants.

What is the definition of data processing? Or what is the differentiation between Data Storage and Data Processing. E.g. if you are an email service provider, is it Data Storage or Data Processing? (asked by Chintan)

Supratim answered, “definition of data processing is extremely wide enough to make businesses fall in to ‘data processing category’ without being a processor.”

What is the timeline? (Asked by Chintan)

MeitY has asked for public comments by 10^th of September on the draft bill, thereafter it will be presented to parliament and after promulgation, there will be more work in framing Authority, the rules by DPA etc. The law is not expected to be in implementable form only after 18 Months or so, minimum.

What happens to the Existing customer? Do we go back to them and get their consent? (Karthik)

Supratim answered, “whilst the it is not a retrospective legislation, if you continue processing without taking consent, you will fall foul of the requirement of law.”

Are there any fines defined here? (Karthik)

Yes, it has been taken care. Just like other aspects the draft bill he highly inspired by GDPR on this aspect also. We have 4% and 2% of annual turnover. There are 2 buckets 4% and 15 Cr and other is 2% and 5 Crore.

Do we need to appoint an DPO?

“There is a segregation which has been made of has significant Data Fiduciary under certain conditions will have to have DPO. Also, this law has an immense amount of significant rulemaking power, answered Supratim.

Hence, it will be seen in future how rules are framed by Authority. So, it has to be seen how business friendly the authority remains in rulemaking e.g. section 43A in IT ACT gave rule making power to define what is sensitive data and information and set out what is reasonable practices and procedure. In the rule made in future, we saw a plethora of requirements set out, over legislated and sometimes badly drafted.

The rules will go through an evolutionary cycle. Hence, the legislation has to be tested over a period of time as it unfolds, after crystallisation of this draft promulgation by parliament in to an ACT and rules being made after that on different aspects.

Disclaimer

PolicyHacks, and publications thereunder, are intended to provide a very basic understanding of legal/policy issues that impact Software Product Industry and the startups in the eco-system.

PolicyHacks, therefore, do not necessarily set out views of subject matter experts, and should under no circumstances be substituted for legal advice, which, of course, requires a detailed analysis of the relevant fact situation and applicable laws by experts in the subject matter on the case to case basis.

If you are facing an issue, we recommend you take expert professional advice on the case to case basis.

We intend to provide the best transcripts in the text part of the blog. However, it may not be an exact replica and maybe approximation, more standardised, normalised or moderated version of the expert view presented in the video.