PFRDA — Pension Fund Regulatory and Development Authority Compliance Guide

PFRDA was statutorily established under the PFRDA Act 2013. Its remit covers the NPS Trust, pension fund managers (PFMs), Central Recordkeeping Agencies (CRAs such as NSDL Protean, K-Fintech and CAMS), Points of Presence (PoPs — banks and select financial institutions), trustee banks, and the Atal Pension Yojana (APY) ecosystem. Key investment guidelines (PFRDA Investment Guidelines 2019, periodically revised): • Tier-I NPS for government employees: prescribed allocation across Government Securities, corporate bonds and equities — auto-choice or active-choice • Equity exposure cap: 75 % up to age 35, declining ~2 pp/year to 50 % at age 50 (auto-choice LC75) • Single-issuer exposure cap: 5 % of AUM per corporate issuer (10 % for AA+ rated) • Rating floor: only AA and above corporate bonds for Tier-I scheme G/C/E corpus CRA cybersecurity and data-protection obligations: aligned with the SEBI cyber-resilience framework and CERT-In incident-reporting rules. CRAs must maintain ISO/IEC 27001 certification, annual VAPT, segregation of subscriber data from agent-portal data, and incident reporting to PFRDA + CERT-In within 6 hours of detection. DPDP Act 2023 obligations apply to subscriber PII.

• Independent statutory regulator with capital-markets-grade governance for pensions
• Light-touch CRA model has kept NPS subscriber costs among the lowest globally (~0.09 % bps)
• Auto-choice life-cycle funds remove behavioural-finance pitfalls for retail subscribers
• Mandatory cyber-resilience controls for CRAs match SEBI MIIs

• APY default rate has crept up to ~21 % per PFRDA Q3-FY26 data
• Equity exposure cap restricts long-horizon retail subscribers from full equity participation
• Annuity market remains thin — Tier-I exit forces 40 % annuitisation at frequently sub-par rates

• Karvy / Atal Pension Yojana onboarding fraud (2019-21) — PoP licence cancellations followed
• NPS subscriber base crossed 8 crore in 2026 — largest defined-contribution pension scheme globally
• Protean (formerly NSDL eGov) CRA cyber-incident 2023 — PFRDA forced a 48-hour transaction freeze + RCA

• Rationalise the equity-cap formula for younger subscribers — allow up to 100 % for ages 18-35
• Mandate independent third-party annuity-rate benchmarking at retirement exit
• Issue a pension-fund-specific DPDP DPIA template for CRAs and PoPs