Content authored by practitioners with experience at Amazon India, Intuit QuickBooks, and the Tata Group. Meet the team →
Borrowers approve Account Aggregator consents without knowing which data they are sharing, for how long and for what purpose.
Each consent records the recipient, the accounts, the data type, the date range, the fetch frequency, the expiry and the purpose; the borrower can revoke it at any time.
Read the consent screen before approving: check the lender name, the accounts selected, the date range, one-time or periodic fetch, and the expiry date.
An informed consent that shares only what the loan needs, with a clear record the borrower can later revoke.
An Account Aggregator (AA) consent names who may see your bank data, which accounts, what kind of data, the date range, how often it is fetched and for how long. You can approve it, reject it or withdraw it later, and the lender may use the data only for the purpose the consent states.
Think of it as a permission slip with every condition written on it. Nothing moves from your bank until you approve it.
Who is involved in an AA consent?
There are three parties. Your bank holds the data and is called the Financial Information Provider. The lender wants the data and is called the Financial Information User. The Account Aggregator, an NBFC licensed by the RBI, carries the data between them in encrypted form and cannot read it.
The rules sit in the RBI Master Direction for NBFC Account Aggregators, issued on 2 September 2016 and last updated on 6 September 2024. Paragraph 6.3 lists what a consent must contain and paragraph 6.6 requires aggregators to let you revoke it.
What does each part of the consent mean?
| Consent field | What it means in plain words | Illustrative value |
|---|---|---|
| Requester | The lender that will receive the data | ABC Finance Ltd |
| Purpose | Why the data is wanted | Loan underwriting |
| Accounts | Which of your accounts are shared | Current account and savings account |
| Data type | What kind of information | Transactions and balance |
| Date range | Which period the data covers | Last six months |
| Frequency | How often data may be fetched | One-time |
| Consent expiry | When the permission ends | 30 days after approval |
| Data life | How long the lender may keep the data | As stated by the lender |
Read the date range and frequency carefully. A one-time fetch of six months is very different from a periodic fetch every month for a year.
What happens to the data after the loan decision?
The lender uses the data to check income, existing EMIs, bounced payments and cash flow. After that, it can keep the data only within the data life and purpose you approved, and within the Digital Personal Data Protection Act, 2023 (DPDP Act 2023). Many lenders also keep a copy in the loan file because the RBI expects them to show how they reached a credit decision.
What changes if you withdraw consent?
Withdrawal stops any future fetch under that consent. It does not delete what the lender already received for a loan already decided. If you withdraw before the lender has fetched the data, the application will usually stall, and the lender will ask for a fresh consent or a PDF statement instead.
Worked example: twelve months, two accounts, fetched once
Meena runs a garments shop and applies for a ₹12,00,000 working-capital loan. She approves a consent that asks for:
- Two accounts: a current account with average monthly credits of ₹4,20,000 and a savings account with ₹65,000.
- Twelve months, from 1 October 2025 to 30 September 2026.
- A one-time fetch, purpose loan underwriting, expiring after 30 days.
What the lender can do: fetch both accounts once, read twelve months of transactions, total about ₹50,40,000 of current-account credits (₹4,20,000 × 12), check EMI and cheque-return entries, and keep the result in the credit file.
What the lender cannot do: fetch a third account she did not select, fetch again in month two, read data before 1 October 2025, or use the data to market an unrelated product. If Meena revokes the consent on day 10 after the fetch, no new fetch can happen, but the twelve months already received stay in the loan file.
How does consent-based access change the lender’s file?
A PDF only shows what the borrower chose to upload. An AA file comes with a consent record that shows exactly what was asked for and approved, which makes the lender’s compliance trail cleaner. The difference between reading a statement for credit and checking it for integrity is covered in bank statement analysis vs bank statement audit.
What to read next
- Next in this series: What do RBI’s digital lending rules require from a lender?
- Bank statement analysis vs bank statement audit
- Bank statement OCR in India
- Account Aggregator bank statement analysis
TransactIQ reads consented AA data and uploaded statements into one review for lenders, and is designed with a DPDP Act 2023 consent architecture on AWS Mumbai.