Integration Guides

Account Aggregator Explained: How Fintechs Fetch Financial Data with Consent

How India's Account Aggregator framework works: FIPs, FIUs, consent artefacts, who can participate, the integration flow and what to build for lending and wealth use cases.

Purushottam Kumar Suman

Founder & CEO, Drema AI

September 16, 20268 min read

X LinkedIn Instagram

Before Account Aggregators, a lender wanting six months of bank statements asked the applicant to upload PDFs, or worse, share net banking credentials. The Account Aggregator framework replaces that with a regulated consent pipe: the customer approves a request, and data flows directly from their bank to the lender, encrypted and machine-readable.

The three participants

The framework separates who holds data, who uses it and who carries consent.

The aggregator is a consent manager and a courier. It carries encrypted data it cannot open.

Financial Information Provider (FIP)Holds the customer's data: banks, NBFCs, mutual fund registrars, depositories, insurers, pension funds and the GST network

Financial Information User (FIU)Wants the data to provide a service: lenders, wealth managers, insurers, brokers

Account Aggregator (AA)An NBFC licensed by RBI that manages consent and transfers data. It cannot read, store or sell the data

The consent artefact

Every data request is governed by a consent artefact, a digitally signed record the customer approves in the AA's app or web flow.

PurposeFrom a standard list, such as loan underwriting or wealth management

Data typesWhich kinds of financial information: deposit accounts, mutual funds, equities, insurance and so on

Date rangeThe period of data requested

Fetch type and frequencyOne-time or periodic, and how often

Consent validityWhen the consent expires

Data lifeHow long the FIU may keep the data

Who can be an FIU

Only entities regulated by a financial sector regulator, RBI, SEBI, IRDAI or PFRDA, can be FIUs. A fintech without its own licence cannot pull data in its own name. It works as a technology service provider or loan service provider for a regulated entity, which is the FIU of record and remains responsible for the data.

The flow, step by step

From the customer's side it takes under a minute when it works well.

1. RequestThe FIU creates a consent request with the customer's mobile number and sends it to an AA

2. RedirectThe customer is taken to the AA's interface, signs in with OTP and sees discovered accounts

3. Link and approveThey link accounts at their banks by OTP and approve the consent

4. ArtefactThe AA notifies the FIU and the FIP with the signed artefact

5. Data requestThe FIU requests data with its encryption key material

6. TransferThe FIP encrypts data for the FIU and sends it through the AA

7. UseThe FIU decrypts, parses the standard schema and runs analytics

What to build

You can build the FIU module to the ReBIT specifications or use a technology service provider's gateway that connects to several AAs.

Consent request serviceAA redirection or SDKWebhook handlersKey generation and decryptionSchema parsers per data typeStatement analyticsConsent status trackingData deletion at data-life expiryMulti-AA routingFallback to PDF upload

Practical realities

Success rates vary by bank: some FIPs respond slowly or have downtime, and not every customer's bank or account type is live. Route across more than one AA, show clear progress, and keep a fallback. Honour the artefact strictly: use data only for the stated purpose and delete it when the data life ends. The DPDP Act's consent and purpose rules point the same way.

Regulated

Only regulated entities can be FIUs

Data-blind

AAs cannot read what they carry

Data life

Delete when the consent says so

Sources · last reviewed October 1, 2026

This article explains what to build, not legal advice. Rules change; confirm against the current official text before relying on it.

Written by

Purushottam Kumar Suman

Founder & CEO, Drema AI

Founder and CEO of Drema AI. Builds AI systems, SaaS platforms and industry software — and writes about what actually survives production.