tl;dr: What You Need to Know Before You Integrate
A bank account aggregator lets your app fetch a customer’s financial data only after the customer says yes. No passwords and no PDF uploads. Ask for the least data you need and explain why. Pair it with UPI for payments. Done well this cuts onboarding drop-offs and gives you cleaner data.
Why Indian Fintech Teams Are Looking at This Now
Think about your last onboarding screen.
Upload six months of bank statements. Wait. Drop off.Users hate it. Your ops team hates it too.
At Cuneiform Consulting I see this friction in almost every fintech app development brief that lands on our desk. Founders talk about growth but the real leak is the first five minutes.
The fix isn’t a prettier upload button. It’s consented data sharing. And UPI has already taught Indian users to trust fast digital rails.
This guide shows how the model works and how to build it. I’ll also point out where teams usually trip.
What Is an Account Aggregator in India?
An account aggregator is an RBI regulated entity that moves financial data between two parties with the customer’s consent. It doesn’t read the data. It doesn’t sell it. It acts as the pipe.
In casual talk people say bank aggregator but that undersells it. The framework extends beyond bank accounts. Think deposits, mutual funds, insurance and more.
Four players matter here:
- Customer: owns the data and gives consent
- FIP: the bank or institution that holds the data
- FIU: your app that wants the data
- AA: the regulated channel in the middle
Sahamati the industry alliance publishes ecosystem details and a list of participants on its official website. Bookmark it. You will use it often.
Teams that treat a bank account aggregator as just another API miss the point. It’s a consent system first and a data system second.
How the Consent Flow Works
Here is the flow in plain steps:
- Your app raises a consent request with purpose, data types, date range and duration
- The customer reviews it inside their AA app
- The customer approves or rejects
- The bank sends encrypted data through the AA
- Your app decrypts it with your own keys
- The customer can revoke consent anytime
That last point matters. Consent isn’t a one-time checkbox.
This is also the cleanest way to link bank account details without ever touching login credentials. No credential sharing means a much lower risk profile for you and for them.
AA vs Penny Drop vs Screen Scraping
I get this question every other week. Which method should we use?
| Method | How It Works |
|---|---|
| Screen scraping | Needs customer credentials and breaks often. I avoid it |
| PDF statements | Easy to edit and slow to review |
| Penny drop | Confirms account ownership but shows no history |
| Account aggregator | Structured and fresh data with clear consent |
If all you need is to verify bank account ownership before a payout then penny drop still does the job. If you need income or cash flow signals for credit decisions then AA wins.
Many of our clients use both. That’s fine.
Where UPI Fits In
AA reads data. UPI moves money. Most real products need both.
Two UPI pieces come up again and again:
- Recurring debits: a UPI AutoPay mandate works for EMIs, SIPs and subscriptions
- Collections: a UPI payment gateway handles one-time payments and refunds
NPCI explains the product basics on its UPI overview page. Mandate limits and rules change over time so check current NPCI and RBI circulars before you design flows.
One lesson from past projects. Don’t bolt on payment integration at the end. Plan it with your data flow from day one. Late changes cost real money.
The Integration Playbook
This is how I would run it with a team starting from zero.
-
Pick one use case
Lending underwriting. Wealth tracking. Expense management. Pick one. Every extra data type adds consent friction.
-
Check your regulatory route
FIUs are generally entities regulated by a financial sector regulator. If you aren’t one you may need to work through a regulated partner. Check this with your legal team at an early stage.
-
Choose AA partners
Integrating with more than one AA helps coverage. Compare approval rates and drop-off data before you commit.
-
Design the consent screen
This is where fintech product development gets human. Write the purpose in plain language. Show what you ask for and for how long. Tell people why.
-
Build for mobile first
Most Indian users will approve consent on a phone. Good mobile application development means smooth redirects and deep links. It also means a clear path back to your app after approval.
-
Handle the plumbing
Strong application integration services cover webhooks, retries, key management and logging. Plan for bank downtime. It will happen.
-
Test before launch
Use sandbox environments. Test rejected consent. Test expired consent. Test slow banks.
For the rules that govern this space read the RBI official site and look up the Account Aggregator master direction.
Mistakes I See Again and Again
- Asking for twelve months of data when six is enough
- Writing vague purpose text like “for service improvement”
- Ignoring consent expiry and revocation
- Storing more data than the use case needs
- Having no fallback when a bank is down
- Treating AA data as a magic credit score
Most trouble comes from rushing. A calm and boring bank account aggregator rollout beats a flashy one that gets paused.
A Note on Limits
Rules and technical specs change. Examples here are illustrative and not tied to any client result. Always check current official documents before you ship.
Conclusion
Account Aggregator integration helps fintech apps access financial data securely with customer consent, while UPI enables seamless payments. Start with one clear use case, prioritise data security and compliance, and build a frictionless user experience.
Cuneiform Consulting helps fintech teams plan reliable integrations that align with their product and business goals.
Frequently Asked Questions
What is an account aggregator in India?
An account aggregator is an RBI regulated entity that securely moves financial data from one institution to another with the customer’s consent. It doesn’t analyse or keep that data.
Do customers have to give their permission for account aggregator data sharing?
Yes. Nothing to be moved without explicit permission from the customer. The Customer is aware of the data that is requested and for how long. They may withdraw consent at any time.
Can an account aggregator approve a loan or keep my information?
No on both counts. It does not add anything to the data itself. The lender or app that’s getting the information decides on the credit decision.
What is the relationship between a fintech app and account aggregator network?
Your app registers as a data user via acceptable, regulated process. It is linked to one or more AAs and raises consent requests. It then gets encrypted data, and decrypts with its own keys. Use a technical partner when you are not familiar with this.
Is there a cost to the customers using an account aggregator?
No. Customers use the service free. Charges are normally levied on users of the data, i.e., the businesses.
