Account Aggregator (AA) — India’s Consent-Based Financial Data Sharing Framework: Complete 101 Guide

Last updated: June 2026

What is Account Aggregator (AA)?

The Account Aggregator (AA) framework is a Reserve Bank of India (RBI)-regulated system that enables individuals and businesses to securely share their financial data between regulated institutions, with explicit consent and in a structured, encrypted manner. Formally, an Account Aggregator is an NBFC-AA (Non-Banking Financial Company — Account Aggregator) licensed by the RBI under Section 45JA of the RBI Act, 1934. ¹

An AA’s sole function is to facilitate the transfer of financial data from institutions that hold it (like your bank) to institutions that need it (like a lender) — with your explicit consent, for a stated purpose, and for a limited duration. The AA itself cannot read, store, or monetise the data it transmits. ²

The AA framework is India’s practical implementation of the DEPA (Data Empowerment and Protection Architecture) in the financial sector, making India one of the first countries to operationalise a full consent-based data-sharing ecosystem. ³

Core Principles

How It Works

Transaction Flow

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

1. FIU (e.g., lender) requests your financial data for a specific purpose
                    ↓
2. AA sends a consent request to you (via the AA app or FIU's interface)
                    ↓
3. You review and approve — specifying purpose, data types, duration
                    ↓
4. AA fetches encrypted data from the FIP (e.g., your bank)
                    ↓
5. AA transmits encrypted data to the FIU
                    ↓
6. FIU uses data only for the approved purpose, within the consent period

Key Entities

The Consent Artefact

Every data-sharing request generates a consent artefact — a machine-readable, digitally signed document that captures:

• Data Principal: Your identity (linked via account discovery)
• FIU: Who is requesting the data
• FIP(s): Which institution(s) hold the data
• Data Purpose: Why the data is needed (e.g., loan underwriting, KYC)
• Data Types: Specific financial information (e.g., bank transactions, GST filings)
• Time Period: How far back the data goes (e.g., last 6 months)
• Consent Duration: How long the FIU can access the data (e.g., 30 days)
• Frequency: One-time or recurring fetch

The consent artefact is cryptographically signed and tamper-proof. You can revoke consent at any time. ⁴

Data Types Supported

The AA framework supports 16+ Financial Information (FI) types as of September 2025 ⁵:

Key Statistics (Verified)

Major Players

Licensed Account Aggregators (17 Operational)

Source: Sahamati (alphabetical listing) ⁷

Industry Bodies

Use Cases

Regulatory Framework

Primary Regulation

Cross-Regulator Oversight

While the RBI is the primary regulator for the AA framework, other financial sector regulators also play a role:

Relationship to DPDP Act, 2023

The Digital Personal Data Protection (DPDP) Act, 2023 introduces the concept of a Consent Manager for all data fiduciaries. The Draft DPDP Rules, 2025 provide registration requirements for Consent Managers. ¹⁰

• The NBFC-AA framework pre-dates the DPDP Act and currently serves as the de facto consent manager for financial data.
• Sahamati is working on reconciling the AA (NBFC-AA) and Consent Manager frameworks to avoid regulatory duplication. ¹⁰
• NBFC-AAs regulated by the RBI are expected to align with DPDP requirements as well.

Consumer Rights Analysis

Your Rights Under the AA Framework

What the AA Framework Does NOT Do

• It does not store your financial data. AAs transmit data in encrypted form and cannot decrypt it.
• It does not make lending decisions. Lenders use the data they receive; the AA has no role in credit assessment.
• It does not replace your bank’s security. Your bank account credentials and PIN are never shared.
• It does not cover non-financial data (health records, education data, etc.) — though this may expand under the broader DEPA framework.

Privacy Implications

Strengths

• End-to-end encryption: Data is encrypted at the FIP level, passes through the AA encrypted, and is decrypted only at the FIU. The AA itself handles only encrypted payloads. ²
• No AA data retention: AAs are prohibited from storing the financial data they handle. ¹
• Purpose-bound consent: Each data fetch is tied to a specific purpose and duration.
• Structured data format: The ReBIT technical standards define specific data schemas, limiting what can be shared.

Concerns and Risks

Safeguards

Technical Safeguards

Governance Safeguards

Consumer Best Practices

1. Read the consent artefact before approving — check purpose, data types, and duration
2. Choose your AA app carefully — download only from official sources (Sahamati list)
3. Revoke unused consents — if you no longer need a service, revoke its access
4. Monitor your AA activity — check your AA app for consent history
5. Report grievances — contact the AA’s Grievance Redressal Officer (see below)
6. Be sceptical of broad data requests — a personal loan shouldn’t need your entire lifetime financial history

Complaints & Grievance Redressal

Filing a Complaint

Each Account Aggregator is mandated by the RBI Master Directions to publish the contact details of a Grievance Redressal Officer (GRO). ¹ If you experience issues with:

• Unauthorised data access via an AA
• Consent not being honoured (revoked but data still shared)
• Technical failures (data not fetched, incorrect data shared)
• Poor service by the AA

You can contact the GRO of the relevant AA. Sahamati maintains a directory of GRO contact details and a public Grievance Dashboard. ¹¹

Escalation Path

1
2
3
4
5
6

1. Contact the AA's Grievance Redressal Officer
        ↓ (if unresolved within 30 days)
2. File a complaint with Sahamati Support Portal
        ↓ (if unresolved)
3. Approach the RBI's Integrated Ombudsman Scheme
        (https://cms.rbi.org.in)

Known Consumer Protections Under RBI Ombudsman

• The RBI Integrated Ombudsman Scheme, 2021 covers complaints against NBFCs, including NBFC-AAs.
• Complaints can be filed online, by email, or by post.
• The Ombudsman can award compensation up to ₹20 lakh for deficiencies in service.

Timeline of the AA Framework

Source: Sahamati Account Aggregator Timeline ¹²

Relationship to Other DPI Explainers

Frequently Asked Questions

Do I need to create an account with an AA to use it?

Not necessarily. Many FIUs (lenders, brokers) embed the AA consent flow directly in their app. You approve consent through their interface, and the data is fetched via the AA network behind the scenes. However, downloading an AA app gives you better visibility and control over your consents.

Is my bank account password shared?

No. The AA framework uses encrypted protocols (similar to how UPI works). Your bank credentials are never shared with the AA or the FIU. Account discovery uses your phone number and account details, not passwords.

Can I choose which AA to use?

Yes. You can download any of the 17 licensed AA apps. All AAs operate on the same network and protocol, so you can use any AA to share data from any FIP to any FIU.

What happens if I revoke consent?

The FIU can no longer fetch new data. However, data already fetched and processed by the FIU before revocation is subject to their own data retention policies — this is a gap in the framework.

Is the AA framework free for consumers?

Yes. You do not pay to share your data via AA. AAs charge the FIUs (who benefit from the data) for their services.

Prime References

Part of the DPI 101 Series by CashlessConsumer — empowering citizens with knowledge about India’s Digital Public Infrastructure.