The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In India, an Account Aggregator (AA) network is an RBI-regulated system for moving a customer’s financial information between participating institutions with the customer’s explicit, digital consent. An AA is a regulated non-banking financial company (NBFC) that manages permission and transfer; it is not a lender, and it does not own the information. The framework is specific to India’s financial-regulatory system, so “Account Aggregator” should not be treated as a generic name for every account-linking service in other countries.
The practical flow is: a financial information user requests particular data, the customer approves a standardized consent artefact, a financial information provider retrieves and digitally signs the data, and the AA securely passes it to the approved recipient. The permission states what may be shared, why, with whom, and for how long.
What is an Account Aggregator Network?
India’s Account Aggregator framework separates three jobs that are often bundled together in ordinary account-linking products:
- Financial information providers (FIPs) hold the customer’s information. Banks, NBFCs, insurers, depositories, asset-management companies, insurance repositories, central recordkeeping agencies and GSTN are among the institution types shown in the Reserve Bank of India’s ecosystem material. Eligibility and technical participation depend on the applicable directions.
- Financial information users (FIUs) ask for and use information for an authorised purpose, such as assessing a loan application or verifying an account.
- Account Aggregators manage the customer’s permission and transfer the information between the FIP and FIU.
The RBI defines an AA as an NBFC that retrieves or collects customer financial information and consolidates, organises or presents it to the customer or an FIU. The information remains the customer’s information, not the AA’s asset. RBI’s Master Direction states that “the financial information pertaining to the customer shall not be the property of the Account Aggregator, and not be used in any other manner.”
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
This division matters. An AA does not approve a loan, set an insurance premium, provide investment advice or become the account-holding bank. Those decisions belong to the FIU or another regulated institution using the data under the approved consent.
How does Account Aggregator work?
The network is consent-led rather than password-led. A typical transaction follows these steps.
- A service starts the request. You may encounter an AA request while applying for credit, verifying an account, buying insurance or using a personal-finance service. The FIU identifies the information it wants and the purpose for requesting it.
- You choose an AA. The customer selects an available AA to manage the permission. The AA presents the request in a consent screen; you can approve or decline it.
- The consent artefact defines the boundaries. RBI’s standardised consent record identifies the customer, requested information, purpose, recipient, notification destination, and creation and expiry dates. It also sets the permitted duration, frequency and data scope. A request for six months of current-account statements is therefore different from a request for investment holdings updated every day.
- The FIP validates the request. The institution holding the data checks that the consent is valid, within its dates and usage limits, and that the AA’s credentials are valid. RBI requires FIP responses to be real time. The FIP digitally signs the requested information and sends it through a secure channel.
- The AA verifies and transfers. The AA confirms the FIU and forwards the information under the consent terms. It is a permission-and-routing layer, not a free-standing database for the customer’s financial history.
- The FIU uses the information within scope. The recipient may use or disclose the data only as the consent artefact allows. A request for income verification does not automatically authorise unrelated marketing or a different financial analysis.
- You can inspect and withdraw permission. Customers must be able to review consent records and the FIUs with which information was shared. RBI requires revocation, including partial revocation. Individual AA apps may present these controls differently, so check the app’s consent-history and revoke screens.
What data does the network move, and who sees it?
The exact fields depend on the FIP, the FIU’s purpose and the consent you approve. Examples can include account details, transaction history, deposits, securities or insurance information. The consent request should make the category and time period clear before you approve it.
| Participant | Primary responsibility | What it does not do |
|---|---|---|
| FIP | Holds the original financial information, validates the consent and sends an authenticated response. | It does not hand over data outside the valid request’s scope. |
| AA | Records consent, verifies the parties and securely transfers information between them. | It is not the lender, insurer, adviser or owner of the information. |
| FIU | Requests and uses information for the purpose and period shown in the consent. | It cannot treat an AA transfer as permission for an unrelated use. |
Because the AA is not the source account, an AA request may fail if the relevant FIP is not connected, the requested account type is unsupported, the consent has expired or the FIP cannot return the data in real time.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Is an Account Aggregator safe?
The framework includes substantial controls, but “safe” should mean controlled and reviewable rather than risk-free. RBI directions require consent-based authorisation, secure transmission, safeguards against unauthorised access and a customer-accessible record of consents and recipients.
Two rules answer the most common security questions:
- An AA must not request or store authentication credentials that customers use with FIPs, including bank passwords, PINs or private keys.
- RBI states that customer financial information accessed by an AA shall not reside with the AA.
RBI’s direction says: “User authentication credentials of customers relating to accounts with various financial information providers shall not be accessed by the Account Aggregator.” Its consumer education material explains the model this way: “You can share your financial information through an Account Aggregator in a secured manner as it does not see or store your financial information”.
Those are regulatory requirements on the AA, not a promise that every participant, device or downstream system is immune from attack. The FIU may have its own retention, security and privacy obligations. Before approving, verify that the recipient is the institution you intended, that the requested fields are relevant, and that the duration is no longer than necessary.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Does an Account Aggregator store my bank password?
No. Under the RBI directions, an AA must not ask for or store the credentials that authenticate you to a bank or another FIP. You should authenticate with the FIP through the flow it provides, not type your bank password into an AA’s form. If a screen asks you to disclose a password, PIN, one-time credential or private key directly to the AA, stop and confirm that you are on the FIP’s genuine authentication page.
The prohibition concerns the AA’s access to credentials. It does not eliminate ordinary phishing, malware, compromised devices or a fraudulent app posing as a legitimate participant. Use the official app or site supplied by the institution, inspect the consent details and report a suspicious request to the relevant institution.
What can an Account Aggregator be used for?
The RBI describes lending, credit monitoring, wealth management and personal-finance management as possible uses. It also says digital transmission can reduce manual document collection and may support cash-flow-based lending for small and medium businesses, including information from GSTN. That is a description of the framework’s potential, not a guaranteed processing time or approval outcome for every applicant.
Sahamati, the industry alliance associated with the ecosystem, lists these application areas:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Use case | How the data can help |
|---|---|
| Account-detail verification | Confirms account information for a service without asking the customer to send paper or manually entered records. |
| Lending and underwriting | Provides permitted account or cash-flow information to help an FIU assess an application. |
| Income verification for life insurance | Supplies authorised financial evidence during an insurance application. |
| Personal-finance management | Brings information from participating accounts into a customer’s chosen financial-management service. |
| Wealth advisory | Lets an authorised adviser analyse permitted holdings or cash-flow information. |
| Credit monitoring | Supports ongoing review when the customer grants an appropriate recurring consent. |
Sahamati distinguishes use cases that are live from those still under development, and availability depends on the institutions, account types and app you use. Do not assume that every AA supports every category.
What is the difference between an Account Aggregator and a lender?
| Question | Account Aggregator | Lender |
|---|---|---|
| Role | Manages consent and transfers financial information. | Evaluates an application and may provide credit under its lending rules. |
| Data ownership | Does not own the customer’s financial information. | Receives information as an FIU when the customer authorises it. |
| Decision | Does not approve or reject a loan. | Decides whether, how much and on what terms to lend. |
| Credentials | Must not request or store FIP authentication credentials. | Authenticates through its own approved systems and handles an application under its legal obligations. |
A lender can use an AA as one route for obtaining evidence, but the AA is not an intermediary that negotiates the loan and cannot guarantee approval, a lower rate or faster funding.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to review and revoke AA consent
Use the consent screen as a data-sharing checklist rather than clicking through it as a formality.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Identify the FIU. Check the legal or displayed name of the bank, NBFC, insurer, adviser or other recipient. If it is not the institution you expected, decline.
- Match data to purpose. For a loan, look for the accounts and statement period actually needed for underwriting. A request for unrelated investments or a much longer history deserves an explanation.
- Check frequency and expiry. One-time, monthly and daily permissions have different consequences. Choose the shortest useful duration and understand the creation and expiry dates.
- Read the notification destination. Confirm where notices about sharing, renewal or revocation will arrive.
- Approve only after verifying the route. Authenticate with the FIP through its own secure page or app. Never disclose FIP credentials to the AA.
- Review the consent history. Use the AA’s record to see active, expired and revoked permissions and the FIUs that received information.
- Revoke when the purpose ends. Select the active consent and use the app’s revoke control. Where the app supports it, revoke only the account, data category or recurring permission you no longer need instead of cancelling unrelated permissions.
Sahamati’s public directory notes that customers can approve or decline requests and, where applicable, revoke active consent, but features differ among AA apps. Some apps focus on consent management while others also display financial information. Confirm that the app supports your web or mobile platform and the controls you need.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
How large is the Account Aggregator ecosystem?
Adoption figures are snapshots reported by Sahamati, an industry alliance, rather than an RBI census. Its release dated September 2, 2026 reported more than 500 million fulfilled consents and more than 1,100 regulated entities live. The same release reported AA-enabled lending of ₹3.82 lakh crore across 3.68 crore loans in financial year 2025–26 (FY26).
Sahamati’s public dashboard reported 566.26 million cumulative fulfilled consents and 338.04 million cumulative linked accounts as of August 31, 2026. These totals do not replace the September release figures: they have different snapshot dates and metric labels, so they should not be merged into one number or presented as an RBI count.
Common problems and what they mean
The account you need is not listed
The FIP may not participate, may not support that account type, or may be temporarily unavailable. Check whether another participating AA offers the connection, then contact the account-holding institution rather than supplying statements to an unverified intermediary.
The consent request is too broad
Decline it and ask the FIU to issue a narrower request. The purpose, recipient, data category, date range and frequency should align. A vague explanation is not a reason to grant unlimited access.
The transfer fails after approval
Possible causes include an expired consent, a mismatch in account identity, an FIP outage or a real-time response failure. Recheck the consent dates and account selection, then retry through the official flow. If the error persists, ask the FIP or FIU which stage failed; the AA may be able to show the status but cannot manufacture missing source data.
You cannot find a revoke button
Open the app’s consent-history or active-consents section and look for the specific permission, not merely the linked account list. If the control is absent, use the AA’s support channel and notify the FIU that you want the consent withdrawn. Keep a record of the request.
What the framework does not promise
- It does not guarantee loan approval, an insurance policy, investment performance or a particular processing time.
- It does not make every financial institution or account type available through every AA.
- It does not mean data can never be retained by an FIU under that institution’s own legal and operational obligations.
- It does not remove the need to check an app’s identity, consent scope and security of your device.
The RBI page describing the AA direction was updated through September 6, 2024. Regulatory requirements and technical participation can change, so institutions and customers should rely on the current direction and the consent screen shown at the time of sharing.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
