An account aggregator is a regulated intermediary that transfers your financial data from one institution to another based on your explicit consent, without ever viewing or storing the data itself. India built the first formal framework for this in 2016 under Reserve Bank of India licensing, and by September 2025 more than 112 million users had linked accounts through the system, with over 2.2 billion financial accounts enabled for consent-based sharing.1Press Information Bureau, Government of India. Celebrating Four Years of Launch of the Account Aggregator Ecosystem Similar open-banking systems are now live or in development in the United States, the United Kingdom, and the European Union. The core idea is the same everywhere: you decide who gets your financial data, what they get, and for how long.
Why This Model Exists
Before regulated aggregation, most fintech apps and lenders pulled your bank data by screen scraping. You handed over your online banking username and password, software logged in on your behalf, and it copied your transactions and balances off the page. The problems were obvious. A third party held your actual login credentials. You had no control over what was pulled or how long access lasted. A breach at the aggregator could expose every linked account at once.
Regulators have been moving away from that model. In India, the RBI’s directions eliminated credential sharing by requiring encrypted, tokenized data flows. In the United States, the Consumer Financial Protection Bureau finalized a Personal Financial Data Rights rule in October 2024 that pushes the industry toward standardized developer interfaces, where banks share data directly through secure channels rather than through a scraper logging in as you.2Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services The practical difference for you is granular control: which accounts, which data fields, and for how long, rather than handing over the keys to everything.
The Three Parties Involved
Every account aggregator system has three roles, and understanding them is how you see why the model is safer than what came before.
The Financial Information Provider, or FIP, is the institution that holds your data. Banks, mutual fund companies, insurance firms, pension funds, and tax authorities all act as FIPs. They release data only after receiving a digitally signed consent authorization.
The Financial Information User, or FIU, is the institution that needs your data to provide a service: a lender evaluating a loan application, a wealth manager building a portfolio, a personal finance app showing your net worth. Banks and licensed fintech platforms can serve as both FIPs and FIUs depending on the transaction.3Department of Financial Services. Account Aggregator Framework
The Account Aggregator, or AA, is the regulated intermediary that manages consent and routes encrypted data between the FIP and FIU. The AA never sees, stores, or processes the content of your financial information. It handles only the consent workflow and the encrypted transmission channel.4Sahamati. Account Aggregators in India
This separation is the architecture’s main security feature. Because the AA cannot read your data, it cannot monetize or misuse it. And because data is encrypted using the FIU’s own key before it leaves the FIP, even a compromised AA would yield nothing usable. The FIU is the only party that can decrypt the information, and only for the purpose you authorized.
How Consent and Data Sharing Actually Work
The entire system runs on a digital document called a consent artefact. It is a machine-readable permission slip that spells out exactly what data you are sharing, with whom, for what purpose, and for how long. It gets digitally signed, creating a legally binding and auditable record.5Government of India – MeitY. Electronic Consent Framework – Technology Specifications Ver 1.1
The Flow, Step by Step
You start by registering with an AA platform and linking your accounts from various FIPs through a one-time authentication. This simply establishes which accounts are available for future sharing. No data moves yet.
When you apply for a financial product, the FIU sends a consent request through the AA. The request arrives on your AA app and lays out the specifics: which data fields, the time period covered, how long the FIU can retain the data, and the stated purpose. You review these details and either approve or reject the request, typically by entering a PIN or one-time password.6Sahamati. What Is an Informed Consent and Consent Artefact
Once you approve, the AA digitally signs the consent artefact and forwards it to the FIP as authorization. The FIP encrypts the requested information using the FIU’s public encryption key and sends it through the AA’s secure channel. Because the data is encrypted with the FIU’s key, the AA cannot decrypt it in transit. The FIU receives the package, decrypts it with its private key, and processes your information for the stated purpose.
Revoking Access
You can revoke consent at any time with a single action through your AA platform, cutting off the FIU’s access immediately. Every event in the process, from consent creation to data transfer to revocation, is logged using a standardized consent log artefact, giving both you and regulators a complete audit trail.5Government of India – MeitY. Electronic Consent Framework – Technology Specifications Ver 1.1
Access duration itself depends on the framework. India’s consent artefact can define anything from a single one-time fetch to ongoing periodic access. Under the U.S. framework being developed through the CFPB’s Personal Financial Data Rights rule, third parties would be limited to a maximum collection period of one year before needing your fresh authorization; if you do not re-authorize, the data provider can cut off access automatically.7eCFR. 12 CFR Part 1033 – Personal Financial Data Rights
What Data Can Be Shared
The scope is broader than most people expect. In India’s framework, regulators across banking, securities, insurance, and pensions have defined the data types that FIPs must support. As of 2025 these include:
- Bank accounts: savings and current account statements, fixed deposits, and recurring deposits.
- Investments: mutual fund holdings and demat (brokerage) account details.
- Insurance: life insurance and general insurance policies.
- Pensions: National Pension System balances.
- Tax data: GST returns filed with the government.8Sahamati. Data (FI Types) Available in the Account Aggregator Framework
The data arrives in a standardized format with profile information, an account summary, and detailed transaction history. That consistency is what makes the system useful for lenders: instead of asking you to upload PDF bank statements and manually parsing them, a lender receives clean, verified, machine-readable data and can underwrite a loan in minutes.
Under the U.S. rule, once it takes effect, covered data from checking accounts and credit cards would include at least 24 months of transaction history, current balances, terms and conditions like interest rates and fee schedules, upcoming bill information, and basic account verification details like your name and address.9Consumer Financial Protection Bureau. Required Rulemaking on Personal Financial Data Rights The U.S. scope is currently narrower than India’s, covering primarily deposit accounts and credit cards rather than investments, insurance, or tax records.
Where the Rules Stand by Country
India
India’s framework is the most mature implementation. The Reserve Bank of India issued its Master Direction for Non-Banking Financial Company Account Aggregators in September 2016, establishing AAs as a distinct category of licensed NBFC with business activity restricted exclusively to account aggregation — no lending, investing, or other financial activities on the side.3Department of Financial Services. Account Aggregator Framework The directions prohibit an AA from storing any customer financial information after transmission, from requesting or holding your banking credentials, and from using data flowing through its pipes as its own property. As of September 2025, 112 financial institutions operate as both data providers and users within the ecosystem, with another 410 operating solely as data consumers.1Press Information Bureau, Government of India. Celebrating Four Years of Launch of the Account Aggregator Ecosystem
United States
The U.S. does not yet have an operational equivalent. The CFPB finalized the Personal Financial Data Rights rule under Section 1033 of the Dodd-Frank Act in October 2024, which would require banks and credit card issuers to make your financial data available to you and to authorized third parties through secure developer interfaces at no charge.2Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services The original compliance timeline ran from April 2026 for the largest institutions through April 2030 for smaller ones.10Consumer Financial Protection Bureau. 12 CFR 1033.121 – Compliance Dates A court order has since stayed the compliance dates by 90 days, pushing the first deadline to June 30, 2026, and as of August 2025 the CFPB announced it is reconsidering the rule entirely, seeking public comment on whether to substantially revise it and extend the compliance dates further.11Federal Register. Personal Financial Data Rights Reconsideration In the meantime, the U.S. market relies on private-sector data aggregators like Plaid, Mastercard’s Finicity, Envestnet Yodlee, and MX Technologies, which have historically used screen scraping but are transitioning to direct API agreements with banks.
United Kingdom and European Union
The UK’s Competition and Markets Authority mandated open banking in 2016, requiring the nine largest banks to share customer data through standardized APIs with the customer’s permission. The EU took a similar path through the revised Payment Services Directive (PSD2), which came into force in January 2018 and required all EU banks to provide secure data access to licensed third-party providers.12Open Banking. Regulatory Both share the same structure as India’s AA system: consumer consent, encrypted API-based data transfer, and regulatory licensing for intermediaries. The EU is developing PSD3, which aims to expand the scope of shared data beyond payment accounts.
Risks to Weigh Before You Link Accounts
The model is a major improvement over screen scraping, but it is not risk-free. A few practical concerns are worth understanding before you approve a consent request.
Over-sharing by default. When an FIU requests your data, the consent artefact may ask for more than you think is necessary. A budgeting app requesting 24 months of transaction history across all your accounts, for instance, might be collecting far more than the service needs. Review the specific data fields and time ranges in every consent request before approving. You can often decline requests that seem disproportionate.
A breach at the FIU. The AA itself does not store your data, but the FIU that receives it does, at least for the duration specified in the consent. If the FIU suffers a data breach, your financial information is exposed. Encryption protections only cover data in transit through the AA; once the FIU decrypts, security depends entirely on the FIU’s own systems. In the U.S., financial institutions involved in data sharing must comply with the Gramm-Leach-Bliley Act’s Safeguards Rule, which requires encryption of customer data in transit and at rest, multi-factor authentication, and periodic review of access controls.13eCFR. 16 CFR Part 314 – Standards for Safeguarding Customer Information
Incomplete coverage. Not every institution participates. In India, some smaller banks and newer financial products are not yet integrated. In the United States, standardized API sharing depends on whether your bank has voluntarily adopted the Financial Data Exchange standard or entered into agreements with specific aggregators, since the regulatory framework is still unsettled.
Consent fatigue. As more services request your financial data, the volume of consent requests can lead to rubber-stamping approvals without reading them. The frameworks are designed for informed consent, but that only works if you actually review what you are authorizing. Periodically check your active consents through your AA platform or bank settings and revoke any you no longer need.