An Account Aggregator (AA) network is India’s RBI-regulated system for sharing a customer’s financial information between institutions with the customer’s explicit, time-limited consent. An AA is a consent manager—not a lender, bank, financial-data owner, or general-purpose account-linking service. It retrieves or coordinates permitted information from a financial information provider (FIP), then securely transfers it to an authorized financial information user (FIU) for the purpose stated in the consent.
This article explains the India-specific framework: what an AA does, how a consent request moves through the network, whether an AA stores your bank password, how revocation works, and how the model differs from a lender.
As an Amazon Associate I earn from qualifying purchases.
What is an Account Aggregator Network?
In India, an Account Aggregator is an RBI-regulated non-banking financial company (NBFC) that manages permissioned financial-data flows. The RBI definition covers an entity that retrieves or collects a customer’s financial information and consolidates, organizes, or presents it to the customer or a financial information user.
The customer remains the source of authority for each transfer. The AA cannot decide independently that a lender, insurer, adviser, or other business may see an account. A standardized consent artefact specifies what information may be shared, why it is needed, who will receive it, where notifications go, and when the permission starts and expires.
#1 Best Overall
The framework is India-specific. “Account aggregator” should not be treated as a universal synonym for every account-linking product in another country, where legal roles, data rights, and security requirements may differ.
“the financial information pertaining to the customer shall not be the property of the Account Aggregator, and not be used in any other manner.”
Reserve Bank of India, Master Direction, paragraph 3(1)(iv)
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Who does what: AA, FIP, FIU and lender
The network separates custody, consent management, and use. That separation is the key to understanding what an AA is—and what it is not.
| Participant | Role in the data flow | Typical examples or relationship |
|---|---|---|
| Financial information provider (FIP) | Holds the underlying financial information, validates the consent and request, and sends the permitted information securely. | A bank, insurer, asset manager, depository or another eligible institution holding your records. |
| Account Aggregator (AA) | Manages the consent artefact, verifies the parties and transfers information under the customer’s instructions. | An RBI-regulated NBFC operating as a consent manager. |
| Financial information user (FIU) | Requests and uses the information for the stated purpose and may disclose it only as the consent permits. | A lender, insurer, wealth manager, service provider or personal-finance application authorized for that request. |
| Lender | Assesses an application and decides whether to offer credit under its own underwriting and compliance rules. | A bank or NBFC may be an FIU when it requests data, but it is not the AA merely because it uses the network. |
RBI’s consumer material depicts banks, NBFCs, asset management companies, depositories, insurers, insurance repositories, central recordkeeping agencies and GSTN among institutions or categories in the ecosystem. Eligibility and technical obligations depend on the applicable RBI directions and the participant’s role.
How does Account Aggregator work?
A normal transaction follows a consent-led sequence. The exact screens differ by AA app and FIU, but the legal logic remains the same.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
- An FIU asks for information. You may encounter the request while applying for a loan, verifying an account, buying insurance, receiving a financial service or using a personal-finance tool. The request should identify the purpose and the institution that wants the information.
- You choose an AA and review the consent. The consent artefact identifies you, the requested information, the purpose, the recipient, the notification destination, and creation and expiry dates. It can also define frequency and other limits. Read the scope rather than approving a vague “all accounts” request by default.
- The FIP checks the request. The financial institution holding your records checks that the consent is valid, that the dates and permitted use match the request, and that the AA is properly authenticated. RBI describes FIP responses as real time. The FIP digitally signs and securely transmits the information authorized by the consent.
- The AA validates and transfers. The AA verifies the FIU and passes the information under the consent terms. Its job is to manage permission and delivery, not to make a credit decision or repurpose the data.
- The FIU uses the information for the stated purpose. A lender might assess cash flow, an insurer might verify income, or a service provider might confirm account details. The FIU’s use and disclosure must stay within the consent artefact.
- You can inspect and change permissions. The framework requires access to a record of consents and the FIUs with which information was shared. You can revoke an active consent, including part of it, subject to the particular request and app’s controls.
What is inside an AA consent request?
Consent is more than a one-time “connect account” button. Before approving, look for these fields:
- Data scope: Which accounts, products, statements, balances, transactions or other financial information are requested?
- Purpose: Is the reason specific enough to understand what the FIU will do?
- Recipient: Which legal entity will receive the information?
- Duration and frequency: Is this a single fetch, recurring access, or access that lasts until a stated expiry date?
- Notifications: Where will approvals, fetches, failures and revocations be reported?
- Revocation controls: Can you see the active permission and withdraw all or part of it?
If the recipient, purpose or data scope does not match what you are trying to accomplish, decline the request and ask the FIU to correct it. A consent screen is the decision point; do not rely on a later explanation to narrow an overly broad authorization.
Does an Account Aggregator store my bank password?
Under RBI directions, the AA must not request, access or store authentication credentials used by a customer with an FIP, including passwords, PINs and private keys. The RBI wording is explicit:
“User authentication credentials of customers relating to accounts with various financial information providers shall not be accessed by the Account Aggregator.”
Reserve Bank of India, Master Direction, paragraph 3(1)(v)(9)
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
In a compliant flow, you authenticate with the FIP or its approved mechanism, while the AA receives the authorization needed to coordinate the transfer. RBI also states that customer financial information accessed by an AA shall not reside with the AA. Its consumer education material summarizes the intended model this way:
“You can share your financial information through an Account Aggregator in a secured manner as it does not see or store your financial information”.
Reserve Bank of India, consumer education material
These are regulatory requirements for the AA framework, not a promise that every participant, device, identity provider or downstream system is risk-free. The FIU may receive and retain information under its own legal, contractual and operational obligations. Use only the AA app and FIU identified in the consent request, keep your phone and email secure, and report a suspicious request to the relevant institution.
Is an Account Aggregator safe?
The framework is designed around explicit authorization, limited purpose and secure transmission. RBI directions require AAs to safeguard information against unauthorized access and provide customers with consent records. FIPs must validate permissions and send information securely; FIUs may use or disclose it only as authorized.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Safety still depends on how you use the system and how each participant operates. Before approving a request:
- Confirm that the app is an AA participating in the regulated framework, not an unrelated screen-scraping service.
- Check the FIU’s legal name and whether it is the bank, lender, insurer or adviser you intended.
- Reject requests for credentials, one-time passwords or private keys to be handed directly to an AA.
- Match the data categories and access period to the stated purpose.
- Review your consent history after approval and revoke permissions that are no longer needed.
Do not convert the rules into an absolute claim that financial information can never be stored or misused anywhere. The AA’s role is constrained, but an FIU that lawfully receives data remains a separate organization with its own systems and responsibilities.
Can I revoke Account Aggregator consent?
Yes. RBI requires customers to be able to review consent and revoke it, including in part. The practical path depends on the AA app and the FIU’s implementation, but it generally involves opening the app’s consent or activity section, selecting an active permission, reviewing what will stop, and confirming revocation.
Rank #4
- Open the AA app or web interface used for the request.
- Go to the consent history, active consents or permissions area.
- Select the relevant FIU and consent artefact.
- Choose revoke, withdraw or the equivalent control; use a partial option when you want to remove only certain accounts or data categories.
- Confirm the action and save the confirmation or notification.
Revocation stops future access under that consent. It does not necessarily erase information an FIU already lawfully received, cancel a loan application, or undo a transaction. Ask the FIU about its retention and deletion policy if you need information already delivered to be removed.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What can Account Aggregators be used for?
RBI identifies lending, credit monitoring, wealth management and personal-finance management as possible uses. It says digital transmission can reduce manual document collection and loan-processing time, and it highlights cash-flow-based MSME lending potential after GSTN’s inclusion. Those are stated possibilities, not a measured result guaranteed for every applicant.
Sahamati, the industry alliance, distinguishes live use cases from those still under development. Examples include:
| Use case | How shared information may help | Status qualification |
|---|---|---|
| Account-detail verification | Confirm account information for a service without exchanging paper statements. | Listed by Sahamati as a use case; availability depends on participating entities. |
| Lending and underwriting | Give a lender permissioned transaction or income information to support assessment. | Live across parts of the ecosystem; a lender still makes its own decision. |
| Income verification for life insurance | Provide permitted financial evidence during an insurance process. | Listed by Sahamati; implementation differs by insurer and request. |
| Personal-finance management | Bring information from multiple institutions into a customer-facing view or analysis. | Some implementations are live; app features vary. |
| Wealth advisory | Allow an adviser to analyze authorized holdings or cash-flow information. | Listed by Sahamati, with availability dependent on the adviser and data providers. |
What is the difference between an Account Aggregator and a lender?
A lender provides or arranges credit and decides whether an applicant meets its underwriting criteria. An AA does neither. The AA manages the customer’s permission and transfers selected information from FIPs to FIUs. A bank or NBFC can appear on both sides of a transaction—as a lender acting as the FIU and as an institution holding information as an FIP—but those are distinct functions.
Approving an AA consent is not approving a loan. It authorizes a data transfer for a defined purpose. The lender can still request additional information, apply affordability and risk policies, set terms, or decline the application.
How to evaluate an AA app or consent request
There is no single feature set across every AA app. Sahamati’s directory notes that some apps show financial information while others primarily manage consent, and web or mobile support differs. Use these checks when choosing among an app or reviewing a request:
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
- Purpose fit: Is the request necessary for the service you are using?
- Recipient identity: Does the FIU match the intended bank, lender, insurer, adviser or service provider?
- Scope: Are only relevant accounts, data types and dates included?
- Control: Can you view active and historical consents and revoke them in that app?
- Platform: Does it support your device and display the information you actually need, rather than only forwarding approvals?
- Support: Is there a clear route to report a failed fetch, incorrect institution or unauthorized request?
Adoption and scale: read the dates carefully
Adoption figures are ecosystem metrics reported by Sahamati, not an RBI census. The figures also use different dates and labels, so they should not be combined into one total.
| Metric | Reported figure | Publisher and date |
|---|---|---|
| Fulfilled consents | More than 500 million | Sahamati release dated September 2, 2026 |
| Regulated entities live | More than 1,100 | Sahamati release dated September 2, 2026 |
| AA-enabled lending | ₹3.82 lakh crore across 3.68 crore loans in FY26 | Sahamati, reported for FY26 |
| Cumulative fulfilled consents | 566.26 million | Sahamati public dashboard, as of August 31, 2026 |
| Cumulative linked accounts | 338.04 million | Sahamati public dashboard, as of August 31, 2026 |
The difference between the release and dashboard totals likely reflects different snapshots or metric definitions. Treat each number as a dated report from Sahamati rather than as an independently verified government statistic.
Limitations and common failure points
The requested institution is not available
A consent can fail when the relevant FIP or FIU has not joined the network, has not enabled the required product, or does not support the requested account type. Ask the service provider whether another permitted verification method is available.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe data is incomplete or stale
An FIP may not hold the requested period, the account may be closed, or a temporary technical issue may prevent a real-time response. Check the date range and retry only through the original AA flow; do not send credentials to a third party to “fix” the connection.
The consent is too broad
Decline it and request a narrower artefact. A shorter duration, fewer accounts or one-time frequency may be appropriate for a single verification.
Revocation is unclear
Use the AA’s consent-history area and contact the FIU named in the artefact. Keep the confirmation and note that revocation affects future access, not necessarily information already received.
The RBI page describing the AA direction is identified as updated through September 6, 2024. Because directions and technical implementations can change, check the current RBI material and the specific AA app’s terms when making a compliance or operational decision.
Free tools Windows power users keep installed
One-click scans. No signup required.
Bottom line
India’s Account Aggregator Network is a regulated consent layer for moving financial information—not a lender and not a database that owns your records. The FIP holds the information, the FIU requests and uses it for a stated purpose, and the AA manages permission and secure transfer. Read every consent, never hand an AA your bank password or PIN, monitor the consent history, and revoke access when its purpose is finished.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
