An Account Aggregator (AA) is an RBI-licensed company that moves your financial data from one institution to another, only when you approve it. If a lender wants six months of your bank statements, you approve a request in an AA app, your bank sends the statements in encrypted form, and the lender receives them. The AA carries the data but cannot read, keep or sell it. It is the data-sharing layer of India Stack, alongside Aadhaar for identity and UPI for payments.
Why it exists
Before AAs, sharing your financial history meant scanned, signed statements or handing a third party your net-banking password, as the Ministry of Finance noted. The Ministry of Finance described the AA system as replacing the “blank cheque” of long terms and conditions with “a granular, step by step permission and control for each use of your data” (PIB, September 2021).
The RBI created the licence category, called NBFC-AA (a non-banking financial company that does account aggregation), in a Master Direction of 2 September 2016. The network went live on 2 September 2021 with eight large banks signed up (PIB, September 2025). On 28 November 2025, the RBI replaced the 2016 rules with consolidated NBFC – Account Aggregator Directions, 2025, which keep the same core design.
The three roles
Every data share involves three parties.
| Role | Who it is | What it does |
|---|---|---|
| Financial Information Provider (FIP) | Where your data sits: banks, NBFCs, mutual fund houses, depositories, insurers, PFRDA-regulated pension entities, and GSTN for GST data | Checks your consent, then digitally signs, encrypts and sends the requested data |
| Account Aggregator (AA) | An RBI-licensed NBFC-AA you register with | Shows you consent requests, records your approval, and passes encrypted data along |
| Financial Information User (FIU) | Whoever asked for the data: a lender, broker, insurer or wealth adviser | Requests consent for a stated purpose, then decrypts and uses the data |
Under the RBI Directions, an FIU must be registered with and regulated by a financial sector regulator. Providers and users come from the books of four regulators, the RBI, SEBI, IRDAI and PFRDA, plus the Department of Revenue for GST data. A bank can be an FIP when it shares your statement and an FIU when it lends to you.
How consent works, step by step
- You register with an AA through its app or website get a handle (like a username) and link the accounts you want to make available. One AA can reach any bank on the network, so you do not need to sign up with several (PIB, September 2021).
- The FIU sends a consent request to your AA, saying what data it wants, from which accounts, why, and for how long.
- You approve or reject it in the AA app. You can also pick which linked accounts to include.
- The AA creates a consent artefact, a standard, digitally signed record of exactly what you agreed to, and shares it with the FIP.
- The FIP checks the artefact: whether it is valid, the dates and permitted use, and the AA’s credentials. It then digitally signs the data and sends it on (RBI Directions, 2025).
- The FIU decrypts and uses the data, and only for what the consent artefact allows.
What a consent artefact contains
The RBI requires each artefact to state your identity, the nature of the financial information requested, the purpose, the recipients, where notifications go each time it is used, its creation and expiry dates, and the AA’s identity and signature. Sahamati, the industry body, publishes sample artefacts showing how these appear in practice. Its one-time loan application example includes:
| Field | What it means | In the sample |
|---|---|---|
| Purpose | Why the data is wanted, as a coded purpose | “To process borrower’s loan application” |
| Fetch type | One-time pull or periodic pulls | One-time |
| Data range | Which period of history is shared | Six months of transactions |
| Data life | How long the fetched data stays valid for the FIU | 15 days |
| Consent expiry | When the permission itself ends | About 20 days after approval |
| Consent types | Which data | Profile, summary and transactions |
A periodic consent, such as one used to monitor a loan account, allows repeated fetches until it expires.
What an Account Aggregator cannot do
The design rests on the AA having nothing to gain from your data. The RBI Directions say:
- No financial information accessed by an AA “shall reside with” it, and the information “shall not be the property of the Account Aggregator”.
- An AA “shall not undertake any other business” and “shall not support transactions by customers”, so it cannot sell you loans or move your money.
- An AA cannot hand the aggregation work to a third-party service provider.
The data is also encrypted by the sender and can be decrypted only by the recipient. “Account Aggregators cannot see the data,” the Ministry of Finance said; contrary to the name, they cannot aggregate it into a profile of you (PIB, September 2021).
What it is used for
The Ministry of Finance names two main uses: loans and money management (PIB, September 2021). A lender can pull tamper-proof bank data instead of scanned statements, speeding up a personal or small-business loan; a small business may also share GST data to support a cash-flow-based loan. A wealth or financial-planning app can show deposits, mutual funds, insurance and pension holdings in one place.
How big it is
According to Sahamati, as of June 2026 there were 17 operational AAs, 176 FIPs and 1,076 FIUs live on the network. More than 2,880 million accounts were enabled for sharing, and the network handled over 295 million data shares that month. On 5 June 2026 the RBI recognised Sahamati as the ecosystem’s self-regulatory organisation, with a role in standards and dispute resolution (Sahamati).
Risks and limits
- The AA is blind; the FIU is not. Once data reaches a lender or adviser, protection depends on that company following the consent artefact and its own regulator’s rules. The AA’s guarantees end at delivery. India’s general privacy law generally applies to FIUs too, as companies handling personal data; see India’s DPDP Act explained.
- Read the duration. A periodic consent with a long expiry and long data life lets the FIU keep fetching and holding your data.
- Coverage is incomplete. Sahamati’s FAQ says only asset-side data is currently available, such as bank accounts, deposits, mutual funds, insurance and pension funds, and that institutions are not mandated to join the network.
- Revoking is not free of consequences. Sahamati notes that if you revoke consent in the middle of a loan, the lender may need to fall back on offline methods.
- Approve only what you started. Treat an unexpected consent request the way you would treat an unexpected payment request; our guide to how UPI frauds work explains why pressure to approve something quickly is a warning sign.
How to revoke consent
Open the app or website of the AA you registered with, find your active consents, and revoke the one you no longer want. The RBI requires AAs to offer this, including revoking consent for parts of the information; on revocation, a fresh artefact is shared with the FIP. Ongoing, recurring consents “can also be revoked at any time later” (PIB, September 2021). Revoking stops future sharing; it generally cannot pull back data already delivered, which the FIU must handle under its own obligations.
If something goes wrong, complain to the AA first. The RBI Directions require AAs to resolve complaints within one month of receipt.
The point: An Account Aggregator is a licensed courier for your financial data: it carries encrypted records from your bank to a lender or adviser only on a consent you can read, limit and revoke, and it cannot open, keep or sell what it carries. The weak point is not the AA but what you approve and what the recipient does next, so check the purpose, data range and expiry before tapping approve.
Sources
- Reserve Bank of India (Non-Banking Financial Companies – Account Aggregator) Directions, 2025, Reserve Bank of India, 28 November 2025
- Master Direction: NBFC – Account Aggregator (Reserve Bank) Directions, 2016, Reserve Bank of India, 2 September 2016 (now repealed)
- Know all about Account Aggregator Network: a financial data-sharing system, Ministry of Finance via PIB, 10 September 2021
- Celebrating four years of launch of the Account Aggregator Ecosystem, Ministry of Finance via PIB, 2 September 2025
- Sahamati, Account Aggregator ecosystem statistics (accessed October 2026)
- FAQ and Consent Artefact: One-time Consent for a loan application, Sahamati
- RBI Recognition of Sahamati as Self-Regulatory Organisation, Sahamati, June 2026