Account aggregators: meaning, how the RBI AA framework works

An account aggregator is a type of non-banking finance company (NBFC) licensed by the Reserve Bank of India (RBI) to carry data, not money. It acts as a consent manager. When you agree, it passes your financial records from the place that holds them, such as your bank, to the place that wants them, such as a lender.

The idea is to put the customer in charge of their own data. Instead of sending PDF statements by email or sharing a bank login with an app, the customer approves a specific request, and the data flows in a standard, encrypted form.

Three roles appear in every transfer. The Financial Information Provider (FIP) holds the data, for example a bank, a mutual fund registrar or an insurer. The Financial Information User (FIU) is the party that needs it, such as a lender or a wealth app. The account aggregator sits in the middle, handles the consent and relays the data.

RBI-regulated entities can be both: a bank may be an FIP for its own customers' data and an FIU when it reads data from elsewhere. A November 2023 RBI change requires a regulated entity that joins as an FIU to also join as an FIP if it holds data of the kind covered.

The customer is shown a request in the FIU's app that says what data is wanted, for what purpose, for what period and how long it can be kept. The customer then logs in to an AA app using a mobile number and a one-time password, picks the accounts to share and approves.

The approval becomes a digital consent artefact, a standard record of the permission. The AA forwards it to the FIP, which checks that it is valid, signs the data and sends it in encrypted form through the AA to the FIU. The AA is not meant to see the contents.

• FIU asks: data type, purpose, date range and duration.
• Customer approves in an AA app with a one-time password.
• Consent artefact is created and sent to the FIP.
• FIP checks it and sends encrypted data through the AA.
• FIU reads the data and may use it only for the stated purpose.
• Customer can revoke consent later.

The core document is the RBI Master Direction for Non-Banking Financial Company Account Aggregator, issued in 2016 and updated since, as of November 2026. It requires an AA to hold a Certificate of Registration from the RBI and to meet a minimum net owned fund requirement, which practitioner summaries put at ₹2 crore, though the amount is revised from time to time.

The direction bars an AA from looking at, storing or selling the customer's data, and from carrying on other business. The technical side follows API standards published by ReBIT, the RBI's technology arm, so that every AA and every participant talks in the same format. Consent rules sit alongside the Digital Personal Data Protection Act 2023, whose rules come into force in phases.

For a lender, a few months of verified bank data in seconds beat a pile of scanned statements. It can price risk better, especially for borrowers with no credit history, such as gig workers or small shop owners whose cash flows show up in their bank account. Fewer documents can also mean fewer drop-offs during application.

Wealth and personal finance apps use AAs to show a person's holdings across banks, deposits and funds in one place. Other uses include business lending, insurance underwriting and tax filing help.

The design aims for safety: consent is specific, data moves in encrypted form, the AA does not read it, and the user can see and revoke what was shared. Risks remain at the edges, such as a user approving a request they did not read, or an FIU using data beyond its purpose. The rules limit that use, and a customer who sees misuse can complain to the company, the AA and the RBI.

AAs earn fees from the institutions that use them, not from selling data, which the rules prohibit. Several licensed AAs operate in India, and the RBI keeps the list of registered ones on its website, which is the right place to check a current name.

Coverage is the first limit. The system works only for institutions that have joined as providers, so a customer may find that one bank or fund is not yet available. Speed and reliability depend on each provider's systems, and a failed fetch can stop a loan application.

A second limit is awareness. Some customers approve requests quickly without reading the purpose or the duration, which weakens the idea of informed consent. Regulators and industry groups have stressed clearer screens and shorter default periods. A third question is how AA consent sits with the Digital Personal Data Protection Act 2023, whose rules come into force in phases, and the sources reviewed disagree on how the two will fit together, so watch for RBI guidance.

A startup that wants to read data as an FIU usually signs with an AA or a technology service provider and agrees to use data only for the stated purpose. It should keep only what it needs, delete it when the period ends, and avoid sharing it with partners without fresh consent. A lender that is itself an RBI-regulated entity has its own duties as an FIP and an FIU.

Product teams also need a plan for failures: if the fetch does not work, the customer should have a fallback such as uploading a statement. Clear wording on the consent screen reduces complaints and improves approval rates.

The framework began with banking data and expanded to deposits, mutual funds, insurance, pensions, equities and tax and GST records, as institutions regulated by the RBI, SEBI, IRDAI, PFRDA and the GST network joined. The list of participants keeps growing, so a lender or app should check which data types its chosen AA supports before building a product on it.

A payment app moves money. An AA moves data. A credit bureau collects loan repayment records on its own and sells scores to lenders. An AA does not keep records and does not score anyone. Lenders may use AA data alongside bureau scores, but the roles are separate. This page is a general explainer and not legal advice, so check the current RBI text for compliance.