What is an Account Aggregator? Explained simply

The old ways, and why they had to go

Before the AA framework, financial data moved in three clumsy ways, each with its own trouble:

None of these gave you a way to limit what was shared, for how long, or to take the access back once given. The AA framework was designed to close exactly those gaps.

• Screen-scraping: you gave an app your netbanking login and it impersonated you to copy data. The app saw everything — not just what it needed — and your password now lived outside your bank.
• Password and OTP sharing with agents and intermediaries, which meant trusting a stranger with the keys to your account.
• PDF uploads: safer than the first two, but slow, easy to forge, hard for machines to read, and stale the moment you downloaded them.

What an Account Aggregator actually is

An Account Aggregator is a special category of non-banking financial company — an NBFC-AA — licensed by the Reserve Bank of India to do one job: carry your financial data between institutions with your consent. It cannot lend, take deposits, or sell you financial products. Finvu, OneMoney, NADL and CAMS Finserv are among the RBI-licensed entities operating today.

The framework has three roles. A Financial Information Provider (FIP) is the institution that holds your data — your bank, your mutual fund registrar, your insurer. A Financial Information User (FIU) is the institution that wants to see it — a lender assessing your loan application, or an adviser building your financial picture. The AA sits between the two as a consent broker.

The most important design choice: the AA never sees or stores your data in readable form. Information travels encrypted from the FIP to the FIU, and the AA routes it along with the consent artefact — a digitally signed record of exactly what you agreed to share, with whom, for what purpose, and for how long. Think of the AA as a courier carrying a sealed envelope: it verifies the addresses and your permission slip, but it cannot open the envelope.

How a consent request works, step by step

Suppose a lender wants to see your bank statements before approving a loan. On the AA rails, that plays out like this:

• The lender (an FIU) raises a request for specific data for a specific purpose — say, your last 12 months of bank transactions for a loan assessment.
• You receive the request on your Account Aggregator's own app or screen — never inside the lender's form, and never by typing your bank password anywhere.
• The consent screen spells out what data, from which accounts, for what purpose, how often, and until when.
• If you approve, the AA passes the consent artefact to your bank (the FIP), which sends the data — encrypted — through the AA to the FIU.
• You can see every active consent in your AA app, and revoke any of them at any time.

What data can travel on the AA rails

The framework covers financial information as defined by the regulators, and the list has been widening as more institution types come aboard. The categories include:

Coverage keeps growing as banks, insurers, pension funds and registrars sign on as FIPs across the RBI, SEBI, IRDAI and PFRDA-regulated sectors. Not every institution is live on every data type yet, so an AA app may show some of your accounts and not others.

• Bank accounts — savings and current, along with their transactions
• Term deposits and recurring deposits
• Mutual fund holdings and transactions
• Insurance policies
• Pension accounts such as NPS
• Securities and demat holdings
• GST data via GSTN — particularly useful for small businesses seeking credit

Consent that is bound, timed — and revocable

Every AA consent is purpose-bound: the FIU must state why it wants the data, and may use it only for that purpose. It is time-bound: consent carries an expiry, and can allow either a one-time fetch or periodic pulls within that window. And it is granular — you choose which accounts to link and share. Linking an account to your AA does not, by itself, share anything with anyone.

Revocation is a first-class feature, not buried small print. Open your AA app, find the active consent, and withdraw it. The AA notifies the institutions involved, and no further data flows under that consent. Data the FIU already received before you revoked stays with it, but its use remains limited to the purpose you agreed to — and India's data-protection law now backs that up.

Where the DPDP Act fits in

The Digital Personal Data Protection Act, 2023 sits alongside the AA framework. Section 6 requires that consent for processing personal data be free, specific, informed, unconditional and unambiguous — given through a clear affirmative action. The AA consent artefact is a working example of what that looks like in practice: specific about the data, informed about the purpose, and recorded.

Section 6(4) adds the right that matters most after the fact: you can withdraw consent at any time, and withdrawing must be as easy as giving it was. Once you withdraw, processing based on that consent must stop unless some other legal ground applies — and that obligation flows down to processors too. The AA framework's revocation flow and the DPDP right reinforce each other: one is the switch on the rail, the other is the statutory backstop.

Before you tap Approve

A consent screen deserves thirty seconds of actual reading. Check:

If a request looks broader than the task at hand, decline it and ask the institution why it needs more. A good FIU can always narrow the ask.

• Who is asking — the FIU's name, and whether you recognise it
• What exactly is requested — which accounts, which data types, what date range
• The purpose — does it match what you are actually doing?
• Duration and frequency — a one-time fetch for a loan should not be an open-ended daily pull for a year
• That you are on the AA's own screen or app — no legitimate AA flow will ever ask for your netbanking password

Questions people ask

Is it safe to share data through an Account Aggregator?

It is designed to be far safer than what it replaces. Data travels encrypted from your bank to the requesting institution, the AA cannot read it, and you never share passwords. No system removes every risk, so the practical safeguards remain yours: read the consent screen, share only for purposes you recognise, and revoke consents you no longer need.

Which companies are licensed Account Aggregators in India?

Account Aggregators are NBFC-AAs licensed by the Reserve Bank of India. Finvu, OneMoney, NADL and CAMS Finserv are among the licensed entities, and the RBI publishes the current list. You are free to hold accounts with more than one AA.

Does using an Account Aggregator cost me anything?

For individuals, AA apps are typically free. The business model generally charges the institutions that request data (the FIUs), not the person sharing it. Check the specific AA's terms — there is no obligation to use any particular one.

Can I take back consent after I have given it?

Yes. Open your AA app, view your active consents, and revoke the one you want to end — no further data flows under it after that. Under Section 6(4) of the DPDP Act, withdrawal must be as easy as giving consent was, and processing based on that consent must stop.

Keep reading

• Track expenses from UPI and bank SMS
• The DPDP Act — what it gives you
• Mukodi's DPDP consent posture