Five years after launch, India’s Account Aggregator (AA) network has become one of the largest consent-based financial data systems in the world. By June 2026, Sahamati reported more than 1,120 live regulated entities, 17 operational AAs, and over 290 million data shares a month.
For lenders, that scale changes the economics of underwriting. Verified bank data can now arrive in structured form, with the borrower’s consent, in minutes.
But access to data is not the same as a credit decision. This guide explains how the framework works, what lenders should request, and where AA data still needs analysis, cross-checks, and judgment.
What an Account Aggregator Is
An Account Aggregator is an RBI-licensed NBFC (NBFC-AA) that moves financial information from where it is held to where it is needed, only with the customer’s explicit consent. The framework was set up under RBI’s NBFC-AA Master Direction of 2016 and went live on 2 September 2021.
Two design choices matter most:
- Consent is mandatory and specific. Every data share is tied to a digital consent that states the purpose, data types, date range, and how long the data may be kept.
- AAs are data-blind. Data travels encrypted from the source to the requesting institution. The AA routes it but cannot read or store it.
In June 2026, RBI recognised Sahamati, the industry alliance for the ecosystem, as the Self-Regulatory Organisation for AAs.
The Three Participants: FIP, FIU, AA
| Role | Who it is | What it does |
|---|---|---|
| Financial Information Provider (FIP) | Banks, AMCs, depositories, insurers, pension funds, GSTN | Holds the customer’s data and releases it on valid consent |
| Financial Information User (FIU) | Lenders, wealth managers, insurers, brokers | Requests and uses the data for a stated purpose |
| Account Aggregator (AA) | RBI-licensed NBFC-AA | Manages consent and routes encrypted data |
FIPs and FIUs sit under their own regulators (RBI, SEBI, IRDAI, PFRDA), which is why AA is the first open-finance rail that spans the whole financial sector.
How a Consent Flow Works
A typical lending flow looks like this:
- Consent request: The lender (FIU) raises a consent request through its chosen AA, specifying purpose (for example, loan underwriting), FI types (deposit accounts), date range (last 12 months), and data life.
- Customer approval: The borrower sees the request in the AA’s interface, discovers and links their bank accounts using a mobile number and OTP flow, and approves.
- Data fetch: The AA asks the FIP for the data. The FIP encrypts it for the FIU and sends it through the AA.
- Delivery and use: The FIU decrypts and processes the data, then must delete it when the consent’s data life ends.
Consent can be one-time (a single underwriting pull) or periodic (for example, monthly fetches during the loan tenure). Periodic consent is what makes AA useful for portfolio monitoring, not just origination.
Consent design mistakes that hurt conversion
- Asking for more FI types or a longer date range than the credit policy needs.
- Vague purpose codes that make customers hesitate.
- Data life far longer than the loan decision requires.
Each of these increases drop-off at the approval screen, which is where most AA journeys are lost.
What Data Lenders Can Access
For retail and MSME lending, the most-used FI types are:
- Deposit accounts: savings and current account transactions, balances, and account profile.
- Term and recurring deposits: useful for collateral and savings-behaviour signals.
- GST returns: for MSME turnover validation where GSTN acts as an FIP.
- Investments and insurance: mutual funds, equities and policies, relevant for wealth-backed lending and affluent segments.
The transaction data arrives as structured JSON rather than a PDF. That removes OCR and tampering risk at the source, but it does not by itself tell a credit officer what the borrower earns or owes.
AA vs PDF Statements vs Other Methods
| Method | Authenticity | Speed | Customer effort | Main weakness |
|---|---|---|---|---|
| Account Aggregator | High: data comes from the bank | Minutes | Low to moderate (consent + OTP) | Coverage gaps, consent drop-off |
| PDF statement upload | Low to moderate: files can be edited | Minutes to hours | Low | Tampering, OCR errors, formats |
| Net-banking login capture | Moderate | Minutes | Great, and credential-sharing concerns | Regulatory and security discomfort |
| Branch or courier statements | High | Days | High | Slow and costly |
Most lenders now run AA-first with PDF fallback: attempt AA, and if the customer’s bank is not live or consent fails, accept a PDF with fraud checks applied.
Where AA Data Falls Short
AA solves authenticity and access. Four gaps remain.
Coverage
Not every bank, co-operative bank, or account type is live as an FIP, and FIP uptime varies. Lenders need fallback paths and FIP-level success monitoring.
Interpretation
Raw transactions still need categorisation. Salary credits must be separated from transfers between the borrower’s own accounts; EMIs from SIPs; genuine business receipts from circular transactions.
Multi-account blind spots
A borrower may link one account and leave out the one that shows other loans or cheque bounces. Cross-checking declared income against credit bureau data and asking for all primary accounts reduces this risk.
Data minimisation duties
The DPDP Act, 2023 and its Rules, 2025 reinforce purpose limitation and deletion. Lenders must keep only what the consent and the law allow and prove deletion when data life ends.
Use Cases
Salaried personal loans: An NBFC pulls 6 to 12 months of the salary account through AA, verifies employer credits, computes FOIR from detected EMIs, and approves within minutes.
MSME working capital: A lender combines AA current-account data with GST return data to test whether bank inflows match declared turnover, then sizes the limit on stable monthly cash flow.
Early-warning monitoring: With periodic consent, a lender refreshes the borrower’s account data monthly and flags falling balances, new loan EMIs, or bounce charges before an EMI is missed.
Co-lending: Both partners work from the same consented dataset, reducing disputes over underwriting inputs.
Key Takeaways
- AA is RBI’s consent-based, data-blind rail for sharing financial data across regulators.
- The ecosystem now spans more than 1,120 live entities and 290 million monthly data shares (June 2026).
- Tight consent design (purpose, FI types, date range, data life) directly improves conversion.
- AA fixes authenticity, but lenders still need categorisation, income and obligation analysis, and fraud cross-checks.
- AA-first with a checked PDF fallback is the practical operating model.
Frequently Asked Questions
Does AA replace bank statement analysis?
No. It replaces the collection step. The data still needs analysis to produce income, obligations, and risk signals.
Can a customer revoke AA consent?
Yes. Customers can view, pause, or revoke consents in their AA app. Revocation stops future fetches.
How long can a lender keep AA data?
Only for the data life stated in the consent and permitted by law. After that, it must be deleted.
Can an Account Aggregator see my bank transactions?
No. Data is encrypted end-to-end between the FIP and the FIU. The AA only manages consent and routing.
Is an Account Aggregator the same as a credit bureau?
No. A bureau reports credit history supplied by lenders. An AA transfers the customer’s own account data, only on consent, and cannot read it.
Conclusion
The Account Aggregator framework has done the hard infrastructure work: authentic, consented, structured data from most of India’s large banks. The competitive edge for lenders has shifted to what happens next: how accurately that data is categorised, how obligations and income are derived, and how quickly anomalies are caught.
Lenders that pair AA-first collection with strong analysis will approve more good borrowers, faster, and see stress earlier in the loan cycle.
FinEye by BeFiSc turns bank data, whether from AA or PDF statements, into underwriting-ready insight: income, obligations, cash-flow trends, and fraud flags. Book a FinEye demo to see it on your own sample files.
