Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An API is the technical connection; an Account Aggregator (AA) is a regulated intermediary and consent framework. In India, AAs use APIs to move customer-authorized financial information from institutions that hold it to eligible institutions that need it. “Open banking” is the broader idea of permissioned financial-data sharing and related services, and its rules differ by country. The terms therefore describe different layers, not competing technologies.
What is an API, open banking, and an Account Aggregator?
These terms are often used together because they appear in the same customer journey, but they answer different questions. An API (application programming interface) describes how software systems communicate. Open banking describes a broader policy and business approach to giving customers controlled access to financial data, and sometimes to initiating financial services through authorised third parties. An Account Aggregator describes a specific regulated role in India’s financial-data-sharing framework.
API: the connection between systems
An API is a defined set of technical rules for requesting, authenticating, formatting and returning data or actions. A bank can expose an API that lets an authorised system request account information; another API might support a payment instruction or an account-verification service. The API does not, by itself, decide who is legally entitled to use the data, what consent is required, how long access lasts or how complaints are handled. Those controls come from the surrounding contracts, laws, standards and operating model.
Open banking: the broader approach
Open banking is a framework for customer-permissioned sharing of financial information and, in some jurisdictions, related services such as payment initiation. Banks and third-party providers connect through APIs, but the legal and operational design is jurisdiction-specific. Rules can differ on third-party licensing, whether institutions must provide access, technical standards, the data fields available, data storage, onward sharing, remuneration and liability.
#1 Best Overall
Account Aggregator: India’s regulated intermediary
In India, an Account Aggregator is a regulated non-banking financial company (NBFC) that participates in a consent-based information-sharing network. The AA is not a generic data broker that collects and resells a copy of your financial history. It manages a standardised consent process and facilitates an encrypted information flow between defined participants while operating under Reserve Bank of India (RBI) directions.
The practical shorthand is: an API is the connection; an Account Aggregator is a regulated intermediary and consent framework that can use that connection. That sentence is a useful explanation, not a substitute for the detailed regulatory definitions.
How India’s Account Aggregator model works
The model assigns different responsibilities to four parties. Understanding those roles explains why an AA is more than an API endpoint.
1. The customer
You decide whether to authorise a request. You select the information, the stated purpose, the recipient and the period for which access is valid. The consent record is presented in a standardised form so that the material terms are visible rather than hidden in a general privacy notice.
2. The Financial Information Provider (FIP)
The FIP is the institution that holds the information. It can be a participating bank or another eligible financial institution. The wider Indian framework can include NBFCs, asset-management companies, depositories, insurers, pension providers, the Goods and Services Tax Network (GSTN) and other entities identified under RBI rules. A provider must verify that a request is supported by valid consent before releasing information.
3. The Financial Information User (FIU)
The FIU is the regulated financial-sector entity asking for the information for a stated purpose. Examples could include an eligible lender assessing an application or another authorised institution providing a financial service. FIU eligibility is tied to registration with and regulation by a financial-sector regulator; an ordinary unregulated app cannot automatically become an FIU simply by building an API client.
4. The Account Aggregator
The AA presents and manages the consent artefact, coordinates the request and response, and facilitates the transfer between the FIP and FIU. RBI directions restrict the AA from supporting customer transactions, so the AA’s role is information sharing and consent management rather than moving money or executing a payment on your behalf. The directions also state that customer financial information accessed from FIPs must not reside with the AA.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRank #2
The request-and-response sequence
- An FIU states a need. It creates a request identifying the information required, the purpose, the intended recipient and the validity period.
- The customer reviews the consent request. The AA interface shows the material terms and asks for explicit authorisation. Approval is not meant to be an implied consequence of opening an account or accepting unrelated terms.
- The AA sends the consent artefact through the network. The record provides the basis for the FIP to check the scope and validity of the request.
- The FIP validates the request. It confirms that the consent is valid and usable for the stated purpose before preparing the requested information.
- The FIP delivers the information through the technical interfaces. APIs carry the machine-readable response between the participating systems.
- The FIU uses the information for the declared purpose. Its own legal, security, retention and grievance obligations still apply; the AA’s restriction on retaining information does not erase the FIU’s responsibilities.
- The customer can revoke consent. RBI Deputy Governor Rajeshwar Rao said in remarks delivered on 14 April 2021 that users can revoke consent. Revocation stops further use under that consent, subject to the applicable rules and any processing that was already lawfully completed.
Rao described the principle this way: “The transfer of such information is based on an explicit consent of the customer and with appropriate agreements/ authorisations between the AA, the customer, and the financial information providers.” His remarks were published by the Bank for International Settlements on 19 April 2021.
Account Aggregators and open-banking APIs compared
The following table separates the regulatory role from the technical layer. “Open banking API” is used broadly here; a particular country’s implementation may impose additional requirements.
| Question | Account Aggregator in India | Open-banking API, broadly |
|---|---|---|
| What is it? | A regulated NBFC intermediary in a consent-based framework. | A technical interface used to exchange financial data or services; open banking is the broader approach around it. |
| Who participates? | The customer, FIP, AA and FIU have defined roles under the Indian framework. | Banks and third-party providers participate under the licensing and access rules of the relevant jurisdiction. |
| What governs access? | Explicit customer consent and a standardised consent artefact under RBI directions. | Customer permission is common, but the consent, authentication, liability and redress model varies by country and provider. |
| What does the technical layer do? | APIs carry consent and information between ecosystem participants; the AA itself does not support customer transactions. | APIs can support data access and, in some frameworks, services such as payment initiation. The permitted functions are not universal. |
| What data is covered? | Eligible information held by participating FIPs across the sectors included in the Indian framework. | The local law, institution and individual API determine the available fields and history. |
| What should a customer check? | Participation, the recipient, purpose, requested fields, consent duration and revocation controls. | The applicable jurisdiction, provider status, data and actions permitted by the API, security terms and available complaint routes. |
Neither column guarantees that every participant exposes the same account types, historical depth, refresh frequency or data fields. Availability depends on the institution and the current technical implementation.
How open-banking APIs work outside the AA model
A typical open-banking integration has three layers. First, a customer-facing third-party provider asks for permission. Second, the bank or other data holder authenticates the customer and grants a token or other scoped credential. Third, the provider calls the bank’s API and receives only the permitted resources. The bank can enforce rate limits, expiry, transaction-signing requirements and other controls at the API gateway.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThat architecture does not automatically create an Account Aggregator. A country may license third-party providers directly, require banks to publish standard APIs, allow bilateral commercial connections, or combine several approaches. Some systems permit only “read” access to account data; others also permit payment initiation, balance checks, recurring-payment setup or confirmation of funds. The word “open” does not mean unrestricted or anonymous access.
Implementation details also change. ReBIT search material identifies an FIP API Specification 2.1.0, but developers and compliance teams should verify the latest applicable specification before building or certifying an integration. A version number is not a permanent guarantee of fields, endpoints or security requirements.
Consent, privacy and data retention
What the consent record should establish
In the Indian AA framework, explicit consent is central. The standardised consent artefact records material details such as:
Rank #3
- the information requested;
- the purpose for requesting it;
- the recipient or intended FIU; and
- the consent’s validity or expiry period.
These details let you distinguish a narrowly scoped credit-assessment request from a broad, long-lived request for unrelated information. Read the purpose and recipient, not just the name of the service requesting access.
Revocation and the AA’s retention restriction
Users can revoke consent. RBI directions also state that financial information accessed from FIPs shall not reside with the AA. This is a specific restriction on the AA; it should not be simplified into a claim that the data is never stored anywhere. The FIU, FIP and other service providers may have separate retention, security and legal obligations. Check the recipient’s privacy notice and the applicable law to understand what happens after a decision, application or service is completed.
Security is a chain, not a single feature
Consent screens and APIs reduce some risks but do not eliminate them. Rao’s 2021 remarks identify potential data breaches, misuse, denial-of-service attacks, infrastructure failures and difficulty assigning responsibility across multiple parties. In practice, security depends on identity verification, token handling, encryption, endpoint protection, logging, incident response and the governance of every participant. A service can use the AA network and still have weak practices elsewhere, so assess the recipient and its complaint process as well as the connection itself.
What data can you actually share?
“Financial data” is not one universal dataset. In India, the available scope depends on which FIPs participate and which information categories their systems expose. Potential sectors named by the Government of India include banking, NBFCs, asset management, depositories, insurance, pensions and GSTN. One institution may provide deposit and transaction information while another may provide investment, insurance or tax-related records.
Participation also affects continuity. If one of your institutions has not joined the network, its records will not appear merely because another account is linked. An FIU may ask for a particular category that a provider does not support, or for a date range shorter than the history you expected. Confirm the accounts and fields shown on the consent screen before approving.
How the model can improve an average person’s financial life
The benefit is less about a new app and more about replacing fragmented, manual evidence with permissioned, purpose-specific access.
Faster applications
A lender or other eligible FIU can receive verified information directly from participating providers instead of asking you to download statements, rename files and email them. That can reduce transcription errors and shorten an application, although approval decisions and processing times remain the FIU’s responsibility.
Rank #4
More complete financial context
With your permission, an FIU can see information held across multiple participating institutions rather than relying on a single account. A broader, consistent view can help an authorised provider assess income, cash flow or assets, subject to the data categories it supports and the purpose you approved.
More control over sharing
A consent artefact gives you a visible purpose, recipient and expiry rather than an open-ended instruction. You can decline a request that asks for unnecessary information or revoke an existing consent when it is no longer needed.
Recommended Free Tools
Less document handling
Direct system-to-system exchange can reduce the number of emailed statements and downloaded files. That does not mean you should ignore account security: verify the institution, review the request and use only the official consent journey.
Costs, eligibility and practical requirements
Registering with an Account Aggregator is voluntary for consumers, according to the Government of India. You generally need an account with a participating FIP and a service from an eligible FIU that supports the network. The exact sign-in, authentication and consent steps depend on the institutions involved. A person cannot force an unparticipating bank, insurer or investment provider to appear in the AA interface.
The framework does not make every open-banking service free, nor does it set one global pricing model. A customer may encounter fees charged by a financial service, but the existence of an API or AA consent does not itself establish a fee. Review the service’s disclosed charges separately.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.India’s adoption snapshot
The Department of Financial Services reported the following figures as of 31 March 2026:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Measure | Reported figure | Qualification |
|---|---|---|
| Financial Information Providers live | 179 | Department of Financial Services update dated 31 March 2026. |
| Financial Information Users live | 989 | Department of Financial Services update dated 31 March 2026. |
| Financial accounts enabled to share data | More than 2.88 billion | Department of Financial Services figure as of 31 March 2026; it is not a count of active users. |
| Accounts linked by users | 284.6 million | Department of Financial Services figure as of 31 March 2026. |
The Department page says the AA directions originated on 2 September 2016 and was last updated on 27 May 2026. These numbers describe reported network adoption, not a guarantee that every Indian consumer, account type or API function is available. Coverage changes as institutions join and implementations are updated.
A customer checklist before approving a request
- Verify the parties. Identify the AA presenting the request, the FIP supplying the data and the FIU receiving it.
- Read the purpose. Reject a request whose stated purpose does not match the service you are seeking.
- Check the fields. Look for account types, date ranges and categories that are unnecessary for the task.
- Check duration. Confirm the expiry date or validity period and whether recurring access is requested.
- Review the recipient. Make sure the FIU is the institution you intended to use and understand its privacy and retention practices.
- Keep revocation information. Know where the AA displays active consents and how to withdraw one.
- Use official authentication. Do not disclose passwords, one-time codes or screen-sharing access to an intermediary claiming to “complete” consent outside the authorised flow.
- Save confirmation details. Retain the consent reference or confirmation screen so you can raise a precise complaint if the data is used incorrectly.
Common misconceptions
“An Account Aggregator is just a data aggregator.”
No. In India, the AA is a regulated NBFC participant with a defined consent-management and data-transfer role. It is not described as a general-purpose company free to build a permanent customer-data warehouse.
“Open banking and the AA network are the same thing everywhere.”
No. The AA model is India-specific. Other countries may have different licences, mandatory-access rules, API standards, data rights, payment functions and liability arrangements.
“If an API exists, anyone can call it.”
No. An API normally requires authentication, authorisation, scoped credentials and compliance with the institution’s terms. In the AA network, the FIP must also validate the consent basis.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →“The AA can move money because it can access account data.”
RBI directions state that the AA must not support customer transactions. Data access and transaction execution are separate capabilities, even when both use APIs in other open-banking frameworks.
“No data is ever stored after I approve consent.”
The AA is restricted from retaining customer financial information accessed from FIPs, but that does not mean every participant deletes all data immediately. The receiving FIU’s retention and legal duties still matter.
Which concept should you use to explain a service?
Use API when you are describing the software interface, authentication method or data format. Use open banking when you are discussing the wider permissioned-data and financial-service framework in a particular jurisdiction. Use Account Aggregator when referring to an RBI-regulated participant in India’s consent-based network. A product can involve all three: an FIU may request data through an AA, while APIs perform the actual system-to-system exchange.
The distinction matters because a technical connection does not answer the questions customers care about most: who is entitled to request the data, what exactly will be shared, for what purpose, for how long, who receives it, how it can be revoked and where responsibility lies if something goes wrong.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
