An account aggregator is a regulated intermediary that moves your financial data from one institution to another based on your explicit consent, without ever viewing or storing the data itself. It replaces the old practice of handing your bank username and password to a fintech app. Instead, you approve a specific, time-limited data request through a secure interface, and the aggregator routes encrypted information from the institution that holds your data to the one that needs it. India built the first formal Account Aggregator framework under Reserve Bank of India licensing in 2016, and by September 2025 more than 112 million users had linked accounts through the system, with over 2.2 billion financial accounts enabled for consent-based sharing.1Press Information Bureau, Government of India. Celebrating Four Years of Launch of the Account Aggregator Ecosystem Comparable open-banking frameworks are live in the United Kingdom and European Union and are being finalized in the United States.
The Three Parties Involved
Every account aggregator system separates three roles. That separation is the whole point of the design.
- Financial Information Provider (FIP). The institution that holds your data. Banks, mutual fund houses, insurers, pension funds, and tax authorities act as FIPs. They release data only after receiving a digitally signed consent authorization.
- Financial Information User (FIU). The institution that needs your data to provide a service. A lender assessing a loan application, a wealth manager building a portfolio, or a personal finance app calculating your net worth all function as FIUs.2Department of Financial Services. Account Aggregator Framework
- Account Aggregator (AA). The regulated intermediary that manages the consent workflow and routes encrypted data between the FIP and FIU. The AA never sees, stores, or processes the content of your information.3Sahamati. Account Aggregators in India
Because the AA cannot read your data, it cannot monetize or misuse it. Data is encrypted using the FIU’s public key before it leaves the FIP, so only the FIU can decrypt it, and only for the purpose you authorized. A single institution can be both an FIP and an FIU depending on the transaction: your bank shares your data in one direction and receives another customer’s data in the other.
How Consent and Data Sharing Actually Work
The system runs on a digital document called a consent artefact. It is a machine-readable permission slip that spells out what data you are sharing, with whom, for what purpose, and for how long. Once you sign it, it becomes a legally binding and auditable record.4Government of India – MeitY. Electronic Consent Framework – Technology Specifications Ver 1.1
You start by registering with an AA platform and linking your accounts from various FIPs through a one-time authentication. No data moves yet; you are just establishing which accounts will be available for future sharing.
When you apply for a financial product, the FIU sends a consent request through the AA. The request lands in your AA app and lays out the specifics: which data fields, the time period covered, how long the FIU can retain the data, and the stated purpose. You review the details and either approve or reject the request, typically with a PIN or one-time password.5Sahamati. What Is an Informed Consent and Consent Artefact
If you approve, the AA digitally signs the consent artefact and forwards it to the relevant FIP. The FIP encrypts the requested data with the FIU’s public key and sends it through the AA’s secure channel. The AA cannot decrypt it in transit. The FIU receives the package, decrypts it with its private key, and processes your information for the stated purpose.
You can revoke consent at any time from your AA platform, and access is cut off immediately. Every event — consent creation, data transfer, revocation — is logged, giving you and regulators a complete audit trail.4Government of India – MeitY. Electronic Consent Framework – Technology Specifications Ver 1.1
What Data Can Be Shared
The scope is broader than most people expect. Under India’s framework, regulators across banking, securities, insurance, and pensions have defined the data types that FIPs must support. As of 2025, the covered categories include:
- Savings and current account statements, fixed deposits, and recurring deposits
- Mutual fund holdings and demat (brokerage) account details
- Life and general insurance policies
- National Pension System balances
- GST returns filed with the government6Sahamati. Data (FI Types) Available in the Account Aggregator Framework
The information arrives in a standardized format with a profile section, an account summary, and detailed transaction history. That consistency is why the model is useful for lenders. Rather than asking you to upload PDF bank statements and parsing them manually, a lender receives clean, verified, machine-readable data and can underwrite a loan in minutes.
The U.S. rule, when it takes effect, would cover a narrower set: checking accounts and credit cards, with at least 24 months of transaction history, current balances, terms including interest rates and fee schedules, upcoming bill information, and basic account verification details.7Consumer Financial Protection Bureau. Required Rulemaking on Personal Financial Data Rights Investments, insurance, and tax records are not part of the initial U.S. scope.
Where the Framework Exists Today
India
India’s is the most mature implementation. The Reserve Bank of India issued its Master Direction for Non-Banking Financial Company Account Aggregators in September 2016, creating AAs as a distinct category of licensed NBFC that can only conduct account aggregation and nothing else.2Department of Financial Services. Account Aggregator Framework AAs are prohibited from storing customer financial information after transmission, from holding banking credentials like passwords or PINs, and from treating data flowing through their pipes as their own property. As of September 2025, 112 financial institutions operate as both data providers and users within the ecosystem, with another 410 operating solely as data consumers.1Press Information Bureau, Government of India. Celebrating Four Years of Launch of the Account Aggregator Ecosystem
United States
The U.S. does not yet have an operational equivalent. In October 2024, the CFPB finalized the Personal Financial Data Rights rule under Section 1033 of the Dodd-Frank Act, which would require banks and credit card issuers to share your data with you and with authorized third parties through secure developer interfaces at no charge.8Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services
The original compliance timeline ran from April 2026 for institutions with at least $250 billion in assets through April 2030 for smaller ones.9Consumer Financial Protection Bureau. 12 CFR 1033.121 – Compliance Dates A court order then stayed the compliance dates by 90 days, pushing the first deadline to June 30, 2026. In August 2025 the CFPB announced it was reconsidering the rule entirely, seeking public comment on whether to substantially revise it and extend the compliance dates further.10Federal Register. Personal Financial Data Rights Reconsideration The legal foundation exists in the U.S., but when banks must actually comply remains uncertain.
The U.S. rule would also cap third-party data collection at one year before requiring your fresh authorization. If you do not re-authorize, the data provider can cut off access automatically.11eCFR. 12 CFR Part 1033 – Personal Financial Data Rights India’s framework lets each consent artefact define its own duration, from a single one-time fetch to ongoing periodic access.
United Kingdom and European Union
The UK’s Competition and Markets Authority mandated open banking in 2016, requiring the nine largest banks to share customer data through standardized APIs with the customer’s permission. The EU followed through the revised Payment Services Directive (PSD2), which came into force in January 2018 and required all EU banks to provide secure data access to licensed third-party providers.12Open Banking. Regulatory Both frameworks share the same architecture as India’s system: consumer consent, encrypted API-based transfer, and regulatory licensing for intermediaries. The EU is developing PSD3, which would expand shared data beyond payment accounts.
Why This Replaced Screen Scraping
Before regulated account aggregation existed, fintech apps and lenders reached your bank data through screen scraping. You handed over your online banking username and password, and software logged in on your behalf, read the page, and copied your transactions and balances. A third party held your actual credentials, you had no control over what data was pulled or how long access lasted, and a breach at the aggregator could expose every linked account at once.
API-based systems fix all three problems. You never share credentials. You choose which accounts, which data fields, and for what duration. And because the AA is data-blind, even a compromised aggregator would yield nothing usable. The CFPB’s 2024 rule explicitly moved the U.S. industry toward this model, requiring standardized developer interfaces where banks share data directly through secure channels rather than through credential-based scraping.8Consumer Financial Protection Bureau. CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services
Risks Worth Knowing Before You Link Accounts
The account aggregator model is a real improvement over what came before, but it is not risk-free. A few practical concerns are worth understanding.
Over-sharing by default. An FIU may request more data than it truly needs. A budgeting app asking for 24 months of transactions across every account may be collecting far more than the service requires. Always read the specific data fields and time ranges in the consent request. You can decline requests that feel disproportionate.
Breach at the FIU. The AA does not store your data, but the FIU that receives it does, at least for the retention period you approved. If the FIU is breached, your information is exposed. Encryption protections only cover data in transit; once the FIU decrypts it, security depends on the FIU’s own systems.
Incomplete coverage. Not every institution participates. In India, some smaller banks and newer products are not yet integrated. In the United States, standardized data sharing depends on whether your bank has voluntarily adopted an industry API standard or entered agreements with specific aggregators, because the regulatory rule is not yet in force.
Consent fatigue. As more services request financial data, the volume of consent prompts can push people into rubber-stamping approvals. Informed consent only works if you actually read what you are authorizing. Check your active consents through your AA platform or bank settings periodically and revoke any you no longer need.
Even with those limits, the shift from password-sharing to consent-based, encrypted data transfer gives you visibility and control that simply did not exist when aggregators logged into your bank account on your behalf. If you understand the consent artefact in front of you before you sign it, and revisit your active permissions from time to time, the model works largely as advertised.