An account aggregator in India is an RBI-regulated company that moves your financial data from one institution to another, but only when you approve each request. A lender, for example, can ask to see six months of your bank statements. You approve the request in the account aggregator’s app and the statements flow to the lender in encrypted form, without PDFs, passwords or shared login details.
This guide explains how the system works, what an account aggregator can and cannot do, how to revoke consent and how it differs from a payment aggregator. It draws on the RBI’s Master Direction for account aggregators, the Department of Financial Services and Sahamati, the industry body for the network, all checked on 10 October 2026.
How an account aggregator works
The framework comes from the RBI’s Master Direction – Non-Banking Financial Company – Account Aggregator (Reserve Bank) Directions, 2016, dated 2 September 2016. It sets up three roles:
- Financial information providers hold your data: banks, mutual funds, insurers, pension funds and other regulated institutions.
- Financial information users want to see it: lenders, wealth managers and other regulated entities offering you a product.
- The account aggregator sits between them and manages your consent.
The process runs in four steps:
- You register with an account aggregator, usually through its app or through a lender’s app that hands you over to it, and link your accounts.
- A financial information user sends a consent request: what data it wants, for what purpose, for which period and for how long it will be able to fetch it.
- You approve or reject the request in the aggregator’s app, and can choose which linked accounts to include.
- If you approve, the aggregator collects the data from the provider and passes it to the user in encrypted form.
The Department of Financial Services says registering with an account aggregator is “fully voluntary” and that the RBI has granted a certificate of registration to seventeen companies. Each one must be registered as an NBFC-AA, so check the company name against the RBI’s list of registered NBFCs before linking accounts.
Is an account aggregator safe?
The rules are designed so that the aggregator itself never holds or reads your data:
- No storage. The Master Direction says no financial information accessed from providers “shall reside with the NBFC-AA”. Sahamati’s participation terms add that data may not be kept longer than needed for delivery, and never more than six hours.
- Data blind. Data travels encrypted and is decrypted only by the regulated user that you approved. Sahamati’s FAQ says aggregators are not allowed to store, process or sell customer data.
- No passwords. Aggregators may not access or store your login credentials for the banks and funds you link.
- No other business. An NBFC-AA may not run any business other than account aggregation, which removes the incentive to use your data for something else.
- A record you can check. The aggregator must let you see every consent you gave and every user your data went to.
The weak point is the consent you give. A request can cover a long period, repeated fetches or more accounts than a loan needs. Read the purpose, the date range, the frequency and the expiry date before approving, and decline anything you do not understand.
Can an account aggregator take money from my account?
No. Paragraph 14(3) of the Master Direction says plainly that an NBFC-AA “shall not support transactions by customers”. It can carry information such as balances, statements and holdings, but it cannot debit an account, make a payment or move investments. If anyone asks for your UPI PIN, card details or one-time password while claiming to be an account aggregator, it is a scam. Report it on 1930 or at cybercrime.gov.in; our guide to cyber fraud complaints explains how.
How to revoke consent
The Master Direction requires every aggregator to let you revoke consent, including for part of the information. Open the aggregator’s app, find the active consent, check which institution holds it, and revoke it. The provider then receives a fresh consent artefact and must stop sharing.
Revoking stops future data fetches. It does not make the user delete data it has already received for a product you are using. Sahamati’s participation terms say that if the user has not provided any product or service, the revocation takes effect “without any consequences” and the user must purge your data unless the law requires it to keep it. If you have an active loan that depends on account monitoring, revoking may have consequences under your loan agreement, so check them first. You can also deregister from an aggregator, which delinks all your accounts and revokes active consents subject to the same conditions.
Account aggregator vs payment aggregator
The names are similar, but the jobs are not.
| Account aggregator | Payment aggregator | |
|---|---|---|
| What it handles | Your financial information, with your consent | Payments from customers to merchants |
| Moves money? | No; the RBI bars it from supporting transactions | Yes; it collects funds and settles them with merchants |
| Who uses it | You, and regulated lenders or advisers you approve | Online shops and other merchants |
| RBI framework | NBFC-AA Master Direction, 2016 | RBI guidelines on payment aggregators and payment gateways, first issued on 17 March 2020 |
Complaints
Each aggregator must name a grievance redressal officer on its website and settle complaints within one month. If it does not, the Master Direction tells customers they can approach the Reserve Bank. NBFCs covered by the RBI’s ombudsman scheme are subject to it, and our guide to the RBI Ombudsman explains how that route works.
