What Is the Account Aggregator Framework?

In a country where millions of citizens have fragmented financial lives — savings in one bank, loans in another, insurance with a third party, and investments scattered across brokers and mutual funds — the Account Aggregator (AA) framework is a transformational leap toward financial coherence and consumer empowerment. Launched operationally in September 2021 and expanded significantly through 2023-2026, the AA framework is India’s answer to Open Banking, and arguably a more privacy-preserving, consent-first model than anything deployed globally.

At its core, the Account Aggregator is a Reserve Bank of India (RBI)-licensed Non-Banking Financial Company (NBFC-AA) that acts as a secure data-sharing intermediary. It allows individuals and businesses to share their financial data — bank statements, tax records, insurance policies, investment portfolios, pension data — with financial service providers in a digitally consented, encrypted, and auditable manner.

This guide covers everything from the foundational architecture and regulatory framework to the practical journey of a loan applicant using AA in 2026, the key players in the ecosystem, and the expanding scope beyond banking into healthcare, telecom, and GST data.

Background & Genesis — How the AA Framework Was Born

The seeds of the Account Aggregator were planted in the Data Empowerment and Protection Architecture (DEPA) — a policy framework developed collaboratively by iSPIRT, the Ministry of Finance, Ministry of Electronics and Information Technology (MeitY), and the RBI. DEPA’s philosophy centres on giving individuals sovereign control over their own data while enabling its use for economic benefit.

Key Milestones:

Regulatory Framework — Who Governs the Account Aggregator?

The AA framework is a multi-regulator initiative, unique in that it involves four of India’s financial regulators working in concert. This is what makes it far more comprehensive than traditional open banking frameworks that cover only banking data.

The Master Direction — Non-Banking Financial Company — Account Aggregator (Reserve Bank) Directions, 2016 (as amended up to 2024) is the primary regulatory instrument governing NBFC-AAs. Key provisions include:

• Minimum Net Owned Fund (NOF): Rs. 2 crore for NBFC-AA registration.
• NBFC-AAs cannot undertake any other NBFC activity — they are pure data intermediaries.
• NBFC-AAs cannot store financial data of customers — they act only as a conduit.
• All data flows must be end-to-end encrypted using industry-standard encryption (TLS 1.2+, AES-256).
• Every data-sharing transaction requires explicit, revocable, purpose-specific consent from the customer.
• Consent Artefacts must be digitally signed and stored by the AA for audit purposes.
• NBFC-AAs are subject to regular RBI inspections and must maintain IT security standards aligned with RBI’s IT Framework for NBFCs.

The AA Architecture — Three Core Pillars

1. Financial Information Provider (FIP)

A Financial Information Provider is any regulated entity that holds a customer’s financial data and provides it through the AA network upon receiving a valid consent artefact. FIPs are the data sources.

2. Financial Information User (FIU)

A Financial Information User is any regulated entity that seeks access to a customer’s financial data (with consent) in order to provide a financial service. FIUs are the data consumers.

• Banks and NBFCs seeking bank statements for loan underwriting.
• Wealth management platforms seeking investment data for portfolio advice.
• Insurance companies seeking financial health data for premium assessment.
• Credit rating agencies using multi-source financial data for alternative scoring.
• Personal Financial Management (PFM) apps aggregating all financial accounts.
• Chartered Accountants and tax filing platforms seeking multi-bank transaction data.
• Government agencies (e.g., SIDBI for MSME loans) using AA-verified income data.

3. Account Aggregator (AA) — The Consent Manager

The NBFC-AA sits in the middle — it never sees the content of the financial data itself (the data is encrypted from FIP to FIU), but it manages the consent flow, creates and stores digitally signed Consent Artefacts, and provides the technical plumbing that connects FIPs and FIUs. Think of the AA as a ‘secure courier’ — it carries the sealed envelope but cannot open it.

• Onboard customers via mobile app / web interface with Aadhaar/Mobile eKYC.
• Present consent requests from FIUs to customers in plain-language format.
• Generate cryptographically signed Consent Artefacts upon customer approval.
• Route encrypted financial data from FIP to FIU on the basis of valid consent.
• Maintain a consent dashboard for customers to view, modify, pause, or revoke consents.
• Maintain audit logs of all data sharing transactions.
• Ensure data deletion by FIUs upon expiry of consent period.

The Consent Framework — Heart of the AA System

The consent architecture is what differentiates AA from conventional data sharing. Every piece of data shared through the AA network is governed by a Consent Artefact — a machine-readable, digitally signed document that specifies exactly what data will be shared, with whom, for what purpose, for how long, and in what frequency.

The 6 Pillars of AA Consent:

Importantly, under the AA framework, consent is granular and revocable. A customer who has granted a bank access to 12 months of salary data for a loan can revoke that consent at any time through their AA app — even mid-process. This is fundamentally different from screen-scraping or traditional KYC-based data collection where revocation is impossible.

Step-by-Step: How the AA Framework Works — A Practical Example

Let us walk through a real-world scenario: Priya, a 32-year-old salaried professional in Pune, applies for a personal loan of Rs. 5 lakh from an NBFC using the Account Aggregator framework.

Licensed Account Aggregators in India — 2026 Status

As of 2026, the following entities hold a valid NBFC-AA Certificate of Registration (CoR) from the RBI and are operational on the AA network:

Note: RBI may have issued additional licenses post this publication. Always verify current licensees at rbi.org.in/Scripts/BS_NBFCList.aspx

Financial Information Types Supported by AA Framework (2026)

The AA framework supports a comprehensive range of Financial Information (FI) types as defined in the RBI Master Directions and the FI Data Standards published by Sahamati/ReBIT (Reserve Bank Innovation Hub). As of 2026:

Key Use Cases of the Account Aggregator Framework in 2026

1. MSME Credit — The Game Changer

India’s MSME credit gap stands at an estimated Rs. 20-25 lakh crore. The inability of banks to quickly verify cash flows, GST turnover, and income history of small businesses has been a major bottleneck. The AA framework solves this by allowing MSMEs to share GST returns, bank statements, and ITR data in minutes, enabling:

• Cash-flow-based lending without the need for property collateral.
• Automated underwriting with same-day loan disbursal for working capital.
• SIDBI, NABARD, and public sector banks using AA to serve micro-enterprises previously outside the formal credit system.
• Integration with OCEN (Open Credit Enablement Network) for embedded lending in supply chains.

2. Personal Loan & Home Loan Underwriting

Banks and NBFCs using the AA framework have reduced loan processing times from 3-7 days to as little as 10-30 minutes for salaried individuals. Salary credits, existing EMI outflows, and bank balance trends are available instantly, enabling real-time credit decisions.

3. Personal Finance Management (PFM) Apps

PFM apps like INDmoney, Smallcase, and similar platforms use the AA framework to pull a 360-degree financial view of a user — bank balances, mutual fund portfolios, insurance policies, pension accounts — all in one dashboard, updated in real-time with user consent. No screen scraping, no storing credentials.

4. Insurance Underwriting & Wealth Management

• Life insurers using income and investment data for accurately-priced term insurance.
• Wealth managers using AA to access client’s existing portfolio for holistic financial planning.
• Health insurance companies exploring AA-linked premium adjustments based on financial wellness indicators.

5. Tax Filing and Compliance

Tax filing platforms can, with user consent, pull transaction data from multiple banks, MF statements, and demat account data via AA to auto-populate ITR forms, reducing manual data entry and errors. The process is fully consent-based — the tax platform requests only what is needed and only for the duration of the filing session.

6. Rent and Employment Verification

A new emerging use case in 2025-26 involves landlords and employers using AA-based financial data sharing for tenant income verification and employee financial background checks, replacing the traditional cumbersome process of collecting physical bank statements.

Technical Standards — The API Architecture Behind AA

The AA ecosystem is built on open, interoperable API standards developed by ReBIT (Reserve Bank Innovation Hub) and Sahamati. All FIPs and FIUs must implement these standards to participate in the AA network. Key technical specifications in 2026:

AA Framework vs. Screen Scraping vs. Traditional Data Sharing

DEPA — The Philosophy Powering the AA Framework

The Account Aggregator is the first operational implementation of DEPA — Data Empowerment and Protection Architecture — India’s unique approach to data governance. Unlike GDPR (which focuses on data protection) or PSD2 (which focuses on payment data sharing), DEPA is a consent-centric, sector-agnostic framework that can be applied to any data domain.

DEPA operates on three principles: DATA EMPOWERMENT (individuals control their data and can use it for their own benefit), DATA PROTECTION (strong technical and regulatory safeguards prevent misuse), and DATA MARKET CREATION (enabling a competitive, consent-based data economy that drives financial inclusion and innovation).

In 2026, DEPA is being expanded beyond financial data. The Health Data Management Policy proposes a Health Account (HA) / Health Locker using the same AA-like consent framework for medical records. Similarly, the Telecom Regulatory Authority of India (TRAI) is exploring AA-like consent frameworks for telecom data (call records, data usage) for alternative credit scoring.

Challenges and Limitations of the AA Framework (2026)

Benefits of the Account Aggregator Framework

For Consumers:

• Single-tap sharing of financial data for loans, investments, and insurance — no more collecting bank statements.
• Complete visibility into who has accessed your financial data and the ability to revoke access at any time.
• Faster loan approvals — personal loans in minutes, home loan pre-approvals within hours.
• Better financial product recommendations based on comprehensive financial profile (with consent).
• Elimination of risk associated with sharing bank credentials with third-party apps.

For Banks and NBFCs (FIUs):

• Drastic reduction in loan processing costs — automated underwriting vs. manual verification.
• Access to richer, more accurate financial data — multi-bank view vs. single bank statement.
• Reduction in fraud risk — data sourced directly from regulated FIPs, not from customers who could forge documents.
• Ability to extend credit to thin-file customers using alternative financial data (GST, EPFO, ITR).
• Regulatory compliance — AA-based KYC and credit appraisal is increasingly preferred by RBI examiners.

For the Indian Economy:

• Closing India’s MSME credit gap estimated at Rs. 20-25 lakh crore by enabling cash-flow-based lending.
• Reducing dependence on physical collateral — enabling credit on the basis of financial history.
• Accelerating India’s Digital Public Infrastructure (DPI) model — AA as the financial data layer alongside UPI (payments) and Aadhaar (identity).
• Creating a competitive data economy where data portability enables consumers to switch financial service providers easily.

Digital Personal Data Protection (DPDP) Act 2023 & the AA Framework

The DPDP Act 2023, which came into force progressively from 2024, introduces the concept of Data Fiduciaries (entities that determine the purpose of data processing) and Data Principals (individuals). Under this framework:

• Account Aggregators are Data Fiduciaries for the purpose of consent management.
• FIUs that process financial data received via AA are also Data Fiduciaries.
• FIPs are Data Fiduciaries for the data they hold and share.
• Customers are Data Principals with rights to access, correction, and erasure of their data.
• The DPDP Act mandates clear, specific, and informed consent — consistent with the AA consent framework.
• Consent Managers under the DPDP Act align closely with the NBFC-AA model — AAs are well-positioned to become registered Consent Managers under DPDP.
• The DPDP Act’s data localisation requirements (data must remain in India) are already met by the AA architecture.
• Cross-cutting obligations under DPDP (breach notification within 72 hours, grievance officer appointment) apply to all AA ecosystem participants.

Account Aggregator Framework — Numbers That Matter (2026)