What Is India's Account Aggregator Framework? A Plain-English Guide

Apply for a personal loan on a lending app today and you'll notice something odd: it doesn't ask you to email bank statements or upload scanned PDFs anymore. You tap a button, pick your bank from a list, approve a request on your phone, and your transaction history shows up on the lender's screen within seconds. That's not magic. That's the Account Aggregator framework, a piece of financial plumbing India built that most people use without ever learning its name.

What an Account Aggregator Actually Does

An Account Aggregator, or AA, is a licensed intermediary regulated by the Reserve Bank of India (RBI) whose only job is to move your financial data from one place to another, with your explicit permission, and without ever reading or storing it. Think of it as a secure courier for your bank statements rather than a company that keeps a copy for itself.

The network has three players, each with its own bit of jargon worth knowing. The bank or insurer holding your data is called a Financial Information Provider (FIP). The app or lender that wants to see it, say, a loan company checking your income, is the Financial Information User (FIU). And the Account Aggregator sits in between as a "consent manager," the entity that packages up your approval and hands it to both sides so neither can go around it.

How the Consent Flow Actually Works

The whole point of the system is that nothing moves until you say yes, and that yes is narrow and specific rather than a blanket permission. A typical request looks like this:

1. An app like a lender or a wealth management tool asks you to link your bank account through an AA (common ones include Setu, OneMoney, and CAMS Finserv).
2. You get a consent request specifying exactly what's being shared, your savings account transactions for the last six months, for example, and for how long the access lasts.
3. You approve it, usually via an app-based OTP or PIN, the same way you'd authorise a UPI payment.
4. Your bank pushes encrypted data straight to the requesting app through the AA, which never stores or sees the actual content.
5. The consent automatically expires or can be revoked by you at any time from the AA app itself.

This is deliberately closer to how UPI changed payments than to how, say, a credit bureau works. The data is yours, the pipe is regulated, and you control the tap.

Why This Beats PDFs and Screen Scraping

Before this framework existed (it was rolled out in phases starting 2021 under RBI's Non-Banking Financial Company-Account Aggregator, or NBFC-AA, licensing category) lenders and fintech apps verified income in one of two clumsy ways: asking customers to upload scanned statements, or using "screen scraping" tools that logged into your net banking with your password to scrape the data themselves. Both had real problems.

• Scanned PDFs can be edited, are slow to process, and often sit on some analyst's desktop longer than they should.
• Screen scraping meant handing your actual banking password to a third-party app, a genuine security risk if that app was ever compromised.
• Neither approach gave you fine-grained control over what was shared or for how long.

The Account Aggregator framework doesn't create a new copy of your data anywhere. It creates a consented, time-bound pipe for moving it, which is a fundamentally different security model from handing over your password or a PDF.

Why It Matters for Indian Users and Developers

For an ordinary borrower, this is already showing up as faster loan approvals, since underwriting that used to take days of document chasing can now happen in minutes. For small businesses and gig workers who rarely have neat salary slips, cash-flow-based lending built on AA data is opening up credit that traditional paperwork-based lending denied them.

If you build fintech products in India, the framework (coordinated by the non-profit Sahamati) means you no longer need to negotiate screen-scraping deals with individual banks or build fragile scraping infrastructure that breaks every time a bank redesigns its net banking portal. You integrate once with an AA and get standardised access across dozens of participating banks and NBFCs. It also plugs neatly into India's broader data-consent push: the same consent-first thinking shows up in the DPDP Act's rules around personal data, so AA-compliant products are generally already pointed in the right direction for that law too.

The framework has expanded beyond banking: insurance, mutual funds, tax data, and even pension accounts are gradually joining as FIPs, which means the "one consent, many data types" model is likely to become the default way Indians share financial information with apps they trust, rather than the exception.

If there's one thing worth remembering from all this, it's the shift in who holds the leash. For years, sharing your financial history meant giving something away, a password, a PDF, a photocopy, that you couldn't take back. The Account Aggregator model flips that: you grant access, you can see exactly what was shared, and you can pull the plug whenever you want. That's a genuinely different, and better, default for a country where financial data is about to flow faster than ever.