Account Aggregator in 2026: Consent-Based Financial Data Sharing
1. Current position
RBI’s Account Aggregator directions govern NBFC-AAs and the consent-based transfer of specified financial information between regulated participants. The AA should not be treated as the owner of the customer’s money or as a guarantor that a lender will approve credit. Consent must identify purpose, data, frequency, duration and recipient.
2. How it works in practice
The model separates Financial Information Providers, the Account Aggregator and Financial Information Users. A customer authorises a defined data flow; the AA facilitates encrypted transfer. Businesses should still minimise data, authenticate participants and manage retention at the receiving institution.
A reliable decision separates the legal rule, the commercial contract and the actual cash flow. A regulatory permission does not guarantee suitability, and a product label does not override the substance of the transaction.
3. Key rules and measurement boundaries
| Item | Position | How to read it |
|---|---|---|
| AA role | Consent manager and data-transfer intermediary | Not lender or adviser |
| Core control | Consent artefact | Purpose, data, duration and frequency |
| Decision owner | Financial information user | Lender/adviser remains responsible for decision |
4. Practical example
A small business authorises six months of bank statements for a loan assessment. The consent should not silently permit five years of data or repeated marketing access. The lender must underwrite the loan; the AA does not certify the borrower or approve the facility.
5. Action checklist
- Read every field in the consent artefact.
- Limit data range, frequency and duration to the stated purpose.
- Revoke consent when the purpose is complete where appropriate.
- Verify that the AA appears in RBI’s regulated-entity records.
- For businesses, restrict downloaded data and log internal access.
6. Evidence and document checklist
- Consent artefact and revocation record.
- Name of FIP, FIU and AA.
- Data types, date range and frequency.
- Purpose statement and retention policy of the FIU.
- Complaint records and access logs.
7. Common mistakes
- Calling AA data “open banking” without consent limits.
- Assuming the AA made the lending decision.
- Granting recurring access for a one-time purpose.
- Downloading data into uncontrolled spreadsheets.
8. Red flags
- Consent requests more data than the service needs.
- Purpose uses vague language such as “all future services”.
- Unrecognised app claims to be an RBI-approved lender because it connects to AA.
- No visible revocation or grievance channel.
9. Complaint or escalation route
Complain first to the AA or regulated financial institution. If no satisfactory response is received within the applicable period, RBI CMS may be available depending on the regulated entity and scheme coverage.
10. FAQs
Does an AA lend money?
No. It facilitates consent-based financial-data sharing.
Can an AA guarantee loan approval?
No. The lender remains responsible for underwriting and the credit decision.
What should a consent contain?
The data requested, purpose, recipient, duration, frequency and other prescribed details.
Should a business store AA data forever?
No. Retention should be purpose-linked, controlled and consistent with applicable law and policy.
11. Official sources
- RBI — NBFC Account Aggregator Directions
- RBI — National Strategy for Financial Inclusion 2025–30
- RBI — FinTech Department
Information date: 20 June 2026. Rates, thresholds, portal processes and live proceedings can change; use the linked official material for the transaction or filing date.