Account Aggregator Framework (2021): Transforming Consent-Based Data Sharing in India’s Financial Ecosystem

Policy Update

Divya Natarajan

Background

The Account Aggregator (AA) framework is a Reserve Bank of India (RBI)-regulated system that lets individuals and businesses share their financial data across institutions through explicit, revocable digital consent, rather than routing it through banks and lenders that hold it in custody. Its legal basis goes back to September 2016, when the RBI issued the Master Direction on Non-Banking Financial Company (NBFC) – Account Aggregator (Reserve Bank) Directions, creating an entirely new class of NBFC whose only permitted business is consent-based data retrieval and transfer. It took another five years of pilot testing before the system went live commercially on September 2, 2021.

An Account Aggregator does not lend, advise, or store a user’s financial data. It is meant to function only as an encrypted conduit between institutions that hold financial information and institutions that need it, and it is only supposed to move when a user actively consents.

The framework sits within India’s Data Empowerment and Protection Architecture (DEPA) and is often described as the third layer of India’s Digital Public Infrastructure, after Aadhaar (identity) and UPI (payments). It received international recognition during India’s G20 Presidency in 2023, and again in the G20 Task Force Report on Digital Public Infrastructure (July 2024), which is notable given that the framework itself was still fairly thin on actual usage numbers at that point, as the data below shows.

Functioning

Table 1: Three types of entities operate within the AA system

The process itself is fairly simple in design: an FIU raises a data request through an AA, the AA asks the user to approve or deny it (specifying exactly what data, for how long, and for what purpose), and once approved, the data moves directly from the FIP to the FIU in encrypted form. The AA itself is not supposed to read or retain the content. Consent can be withdrawn at any time. This is a genuine improvement on the earlier norm of emailing PDF bank statements or handing over net-banking passwords to loan agents, and it is worth acknowledging that as a design choice, it is sound.

In practice, however, licensing does not equate to functional reach. The RBI has issued a Certificate of Registration to 17 companies to operate as AAs, but regulatory approval is not the same as widespread use, reliable integration with major banks, or trust among first-time borrowers in smaller towns (Department of Financial Services, 2026). The system’s effectiveness depends on how comprehensively FIPs, particularly public sector banks and insurers, have built and maintained the underlying technical infrastructure, an area where onboarding has been markedly uneven.

Performance

Official figures warrant careful interpretation. Government reporting tends to foreground the more favourable metric, “accounts enabled to share data,” which reflects supply-side integration by banks rather than actual usage by individuals. The more meaningful indicator of adoption is “accounts linked by users.”

Table 2: Performance of the AA Framework

Source: Department of Financial Services, Ministry of Finance; PIB; Sahamati.

Figure 1: Growth in User-Linked Accounts on the AA Framework

Source: Department of Financial Services, Ministry of Finance, Government of India; Press Information Bureau (PIB); Sahamati

Two observations follow from this data. First, the growth trajectory is substantive: linked accounts nearly doubled between September 2025 and March 2026 alone, marking a shift from a slow, multi-year build-up to a phase of rapid adoption. Second, and this is the dimension official communications tend to omit, the conversion rate between “accounts enabled” and “accounts actually linked” remains under 10 per cent even at the March 2026 mark (284.6 million linked against 2.88 billion enabled).

This disparity is structurally significant rather than incidental. It indicates that while banks have completed the technical work of integration, the framework has not yet translated that supply-side readiness into proportionate demand-side usage. Whether this gap narrows as public awareness grows, or persists as a structural ceiling, will ultimately be a more accurate measure of the framework’s success than the enablement figures that dominate official messaging.

FY2023 data also recorded approximately $750 million disbursed through AA-enabled lending, with close to half directed to the MSME sector (World Bank, 2024). This remains a credible indicator of impact, though more recent, comparably detailed lending-volume figures are not readily available in the public domain, a gap in disclosure that itself merits attention.

Impact

The most clearly demonstrated impact of the AA framework lies in MSME and thin-file lending. Cash-flow-based underwriting using AA-sourced bank statements and GST data enables lenders to assess borrowers who lack collateral or an established credit history, a segment the formal banking sector has historically struggled to serve profitably. Lenders using the framework report disbursal timelines shrinking from weeks to days, alongside the ability to monitor a borrower’s cash flow post-disbursement to catch early signs of repayment stress, a substantive underwriting improvement rather than a procedural convenience.

This speaks to a larger problem in Indian finance: millions of viable small businesses cannot get formal credit, not for lack of creditworthiness, but because they cannot produce the collateral or years of financial statements traditional underwriting demands. By letting lenders verify real-time cash flow instead of static paperwork, the AA framework brings a previously invisible segment of borrowers into view.

Development finance researchers have found modest but measurable reductions in borrowing costs for small enterprises as a result, since verified data reduces the risk premium lenders would otherwise price in. This has also extended formal credit to women-led microenterprises and gig workers who previously relied on moneylenders or unregulated lending apps, some of which have drawn regulatory scrutiny for predatory practices, making the framework’s impact partly competitive: a formal, auditable alternative that can crowd out exploitative credit channels.

The framework’s reach extends beyond credit too. Personal finance and wealth advisory apps increasingly use AA rails to consolidate a user’s bank, mutual fund, and pension data, a use case growing alongside AMC and depository onboarding. Insurance remains underdeveloped for now, reflecting slower insurer onboarding, but represents a plausible next frontier for usage-based or income-linked products.

The framework’s impact as a governance template is less settled. It has been cited in G20 documentation as a model for consent-based data architecture, a characterisation that should be applied cautiously given how far user-side adoption still trails technical capacity. There is also a systemic risk worth noting: concentrating data movement through a small number of licensed AAs enables auditability, but means any breach or failure at one entity would carry consequences for the whole ecosystem, not just that institution.

Taken together, the framework’s impact is strongest at the level of individual lending transactions, still forming at the level of financial inclusion outcomes, and largely aspirational at the level of governance-model replication abroad.

Emerging Issues

• Low FIP-to-FIU conversion at the user level. As shown in the performance table, fewer than 1 in 10 enabled accounts are actually linked by users. This is arguably the single most important unresolved problem with the framework, more than any single technical or regulatory issue below.
• Regulatory overlap with the DPDP Act. The AA framework is regulated as an NBFC category under the RBI, while the Digital Personal Data Protection Act separately defines “Consent Managers.” How these two regimes will be reconciled, so AAs are not caught between two sets of compliance obligations, is still unsettled.
• Uneven institutional participation. Banks have onboarded well; insurers, pension funds, and some public sector entities remain comparatively slow to go live as FIPs, which limits how complete a financial picture the system can actually offer a lender.
• Usability and language barriers. Consent flows are reported as intimidating for first-time or low-literacy users, particularly outside metro areas, and the interface is largely English-first. For a framework meant to serve MSMEs and individuals without formal credit histories, this is a direct barrier to the population it is supposed to help most.
• Technical reliability. Data-pull failures from certain banks and thin transaction histories for informal-sector borrowers reduce the practical usefulness of AA data for underwriting in exactly the segment the framework targets.

Way Forward

• Insurance and Pension Sector Onboarding – Banking data dominates the ecosystem while insurers and pension funds remain underrepresented as FIPs. A defined onboarding timeline, set jointly by the RBI, IRDAI, and PFRDA, would give this sector a clear target rather than leaving participation open-ended.
• Regulatory Clarity with the DPDP Act –  It remains unclear whether Account Aggregators must separately register as Consent Managers under the DPDP Rules or whether their existing RBI licence is sufficient. A joint clarification from the RBI and the relevant ministry would resolve this before it becomes a compliance dispute.
• Vernacular Access and Usability – Adoption remains concentrated among digitally literate, English-speaking users. Following UPI’s precedent by prioritising regional-language consent interfaces would likely do more for adoption than further supply-side bank onboarding, which already appears to have outpaced demand.
• Data Reliability and Institutional Accountability – Data-pull failures from certain FIPs are known within the ecosystem but not formally tracked or disclosed. A minimum performance benchmark for FIPs, with periodic public disclosure of pull-success rates, would create a clearer basis for accountability.
• Transparency in Usage Reporting – Public data is currently released mostly as cumulative totals around anniversaries, making it hard to track real trends. A structured, regularly published dataset, disaggregated by loan type, sector, and state, would allow for more accurate ongoing assessment.

Conclusion

The Account Aggregator framework has genuinely changed how financial data moves in India, replacing an opaque, paper-heavy system with a consent-based, auditable one, and its impact on MSME lending in particular is well documented and credible. But the framework’s own numbers point to a system still in the process of proving itself at the user level: enablement has scaled far faster than actual adoption, and closing that gap, not adding more banks to the network, is the real test of whether the AA framework becomes India’s next UPI-scale success or remains a well-designed system that most of its intended users have yet to actually use.

References 

Press Information Bureau, Ministry of Finance. (2025, September 2). Celebrating four years of launch of the Account Aggregator Ecosystem – India’s Digital Public Infrastructure (DPI). https://www.pib.gov.in/PressReleasePage.aspx?PRID=2162953

Department of Financial Services, Ministry of Finance, Government of India. (2026). Account Aggregator Framework. https://financialservices.gov.in/account-aggregator-framework

Reserve Bank of India. (2016). Master Direction – Non-Banking Financial Company – Account Aggregator (Reserve Bank) Directions. https://www.rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=10598

Rao, R. (2021, September 2). Regulatory framework for account aggregators. Reserve Bank of India, via Bank for International Settlements. https://www.bis.org/review/r210916e.htm

World Bank Blogs. (2024, March). India’s digital transformation could be a game-changer for economic development. https://blogs.worldbank.org/en/developmenttalk/indias-digital-transformation-could-be-game-changer-economic-development

Accion. How India’s account aggregator framework is changing MSME lending. https://www.accion.org/article/how-indias-account-aggregator-framework-is-changing-msme-lending/

Observer Research Foundation. Data Empowerment and Protection Architecture: Concept and Assessment. https://www.orfonline.org/research/data-empowerment-and-protection-architecture-concept-and-assessment

SCC Online. (2026, June 26). Fragmented Consent and Fractured Rights: Resolving the Account Aggregator–Consent Management Paradox under DPDP Rules in Light of the Booming Fintech Sector. https://www.scconline.com/blog/post/2026/06/26/account-aggregator-consent-manager-paradox-dpdp-rules-fintech-sector/

About the Contributor

Divya Natarajan is a Research and Editorial Intern at IMPRI and a recent Economics graduate from Stella Maris College, Chennai. She has experience in public policy research, editorial writing, and policy analysis through internships with think tanks and research organisations. Her interests include public policy, governance, and development economics.

Acknowledgements

I would like to extend my gratitude to IMPRI for this opportunity. I also extend my sincere thanks to  Madhuritha D and Kavin Adithya for their constructive reviews and editorial support. 

Disclaimer

All views expressed in the article belong solely to the author and not necessarily to the organisation.

Read more at IMPRI:

Jammu and Kashmir Disaster Management Plan 2022-23

Female Education and Workforce Participation (PLFS 2017–18 to 2023–24): Evidence from the U-Shaped Worker Population Ratio in India