Account Aggregator explained: what you agree to when you tap Allow
Loan apps now ask you to share bank data via an Account Aggregator. Here is how consent works, what to check on the screen, and how to stay safe.
Every few weeks, a loan app or investment platform asks you to "link your bank account through an Account Aggregator." It sounds technical, and many people tap "Allow" without reading. Here is what the system actually is, how consent works, and how to use it safely.
What is an Account Aggregator?
An Account Aggregator (AA) is a licensed middleman that helps you share your financial data with someone else, only when you say yes. In India, AAs are a category of non-bank finance company regulated by the RBI under its 2016 Master Direction. The government's Department of Financial Services describes it as a framework built around your explicit consent.
Think of it like a courier who carries a sealed parcel. The AA moves your data from the place that holds it (your bank, for example) to the place that needs it (a lender), but it is not supposed to read or keep the contents. Nothing moves until you approve.
Who is involved?
- You, the owner of the data.
- Financial information providers (FIPs): banks, NBFCs, insurers and similar institutions that hold your data.
- Financial information users (FIUs): lenders, wealth apps and others who want to see it, with your permission.
- The Account Aggregator: the licensed link between the two.
Sahamati is an industry alliance of Account Aggregators that promotes the ecosystem and works on standards. It is not the regulator; the RBI licenses the AAs.
How a typical flow works
- You apply for a personal loan on an app.
- The app offers to fetch your bank statement through an AA instead of asking you to upload PDFs.
- You pick an AA, verify with your mobile number and OTP, and choose which accounts to share.
- You see a consent request: what data, for what purpose, for how long.
- You approve, and your bank sends the data through the AA to the app.
The idea is that the lender gets verified statements quickly, and you skip the paperwork. The government has reported that over 220 million accounts had been linked on the framework by 30 September 2025, so this is no longer a niche feature.
The consent screen: what to read
Treat the consent screen like a rental agreement. Look for:
- Which accounts: share only the account that is relevant, not every account you own.
- What type of data: statements, balances, deposits, or something wider.
- Date range: a loan check may need a few months, not ten years.
- Duration: is it a one-time fetch or ongoing access for a year?
- Purpose: does it match what you actually applied for?
If the request asks for more than the task needs, you can decline and ask for another way to verify.
You can take consent back
Consent in the AA system is meant to be revocable. Most AA apps show a list of active consents, and you can withdraw them when the purpose is done. A good habit: once a loan is sanctioned or rejected, open your AA app and review what is still active.
Safety checklist
- Use only AAs licensed by the RBI. Check the list on the RBI or Sahamati websites before using an unfamiliar app.
- Never share your bank PIN, card PIN or full password. An AA flow uses your registered mobile number and OTP, not your UPI PIN.
- Be wary of calls or messages that push you to "link accounts urgently" to claim a prize or unlock a loan.
- Look at the app's name and the AA's name carefully. Scammers copy lookalike screens.
- Review your active consents every few months.
Where this helps, and where to be careful
Helpful: quicker loan checks, one place to see your consents, no emailing statements around.
Careful: the convenience can make you apply to several lenders at once. Each application can leave a trail on your credit report, so apply thoughtfully, and do not take credit just because it is a few taps away.
Practical takeaway
- Read the consent screen before tapping Allow.
- Share the minimum accounts and the shortest date range.
- Revoke consents when the purpose is over.
- Never enter a PIN to "receive" or "verify" anything.
- Keep your own monthly record of income and spending, so you know your numbers before a lender looks at them.
This is general information, not financial advice.
How Dhuddu fits in
Dhuddu does not use the Account Aggregator system; it works with your own data in other ways. You can sync Indian bank alerts from Gmail, or import a bank or card statement, and see your spending, budgets and EMIs in one place, free. That way you know your monthly picture before anyone else asks to see it. Try it at dhuddu.in or on Google Play.