What is account aggregator in India, and what can it not see?

The rules are in the Reserve Bank's Master Direction on NBFC account aggregators, published at https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=10598, issued in 2016 and shown there as updated on 6 September 2024. It names three roles.

The Financial Information Provider, or FIP, holds your data: a bank, an NBFC, a mutual fund company, a depository or participant, an insurer, the NPS record-keeper, the GST network. The Financial Information User, or FIU, wants it, and the direction defines an FIU as an entity registered with and regulated by a financial sector regulator: the Reserve Bank, SEBI, IRDAI, PFRDA or the Department of Revenue. The Account Aggregator, or AA, is an NBFC holding a Reserve Bank certificate for this business and barred from running any other.

The flow: the FIU asks through an AA, and the AA shows you a consent request. If you approve, the AA presents the consent to the FIP, which checks its validity, the dates and use it covers, and the AA's credentials. The FIP digitally signs the data and sends it on; the AA verifies the FIU's identity before handing it over. Nobody types your net-banking password.

Paragraph 6.3 of the direction requires a standardised consent artefact containing your identity, the nature of the information requested, the purpose, the recipients, an address to be notified each time the consent is used, the creation and expiry dates, and the AA's digital signature. The screens you see also spell out the date range and how often data may be fetched, which is where the size of a request lives. An illustrative request for a personal loan might read like this.

What the direction closes off: the aggregator may not request or store the credentials that log you in to your bank, such as passwords, PINs or private keys. None of your financial information may reside with it. It may not support transactions, so it cannot move money, and it may share your information only with you or the recipient your consent names. The provider signs what it sends, and each consent has to be capable of being logged, audited and verified.

What it leaves to you: once delivered, the data sits under the recipient's policy. A consent that asked for twelve months of every account delivered twelve months of every account; a secure pipe does not make the request smaller. Before any first consent, check the aggregator appears on the Reserve Bank's published list of NBFCs registered as account aggregators, since the direction bars anyone from this business without its certificate.

Before the framework, an app wanting your transactions could ask for your net-banking login and read the pages itself. The gap between that and a consent is not one of degree.

A password carries everything you can do. Its holder sees every account under that login and, with an OTP, can act on them. It has no purpose, no end date and no log you can inspect, and banks' terms generally put the consequences of sharing it on you. Taking it back means changing it everywhere.

A consent carries only what it names: chosen accounts, a date range, a recipient and an expiry, revocable in part, with each use logged, and no power to move money. The one thing both share is that whatever was delivered stays delivered. The four ways a tracker can get your transactions, set side by side on secrets held and upkeep, are on the page about tracking expenses without a bank login.

Take one illustrative household for a month: a salary account at Bank A with 40 UPI debits, an EMI, a SIP, an insurance premium, a cash withdrawal and rent by NEFT; a second account at Bank B with 12 UPI debits and a mandate; and three credit cards with 25, 10 and 8 purchases. That is 101 outflows and ₹1,14,000, of which the cards carry ₹44,000: 38.6 percent of the rupees and 42.6 percent of the lines.

The direction's list of financial information names bank deposit accounts, NBFC deposits, securities, mutual fund units, insurance policies, NPS balances and GST returns among others. It does not name credit card accounts. So assume, as this household finds, that the consent screen shows both banks and none of the cards.

The framework's protection lives in reading each consent screen, and that is the part that wears out. The first consent gets read. By the fourth, in a year of loan shopping and insurance quotes, approval happens on recognising the logo. That is not carelessness; it is what any safeguard that asks for attention every time turns into.

A request is easier to judge in lines than in months. This household's two bank accounts produce 61 debit lines a month, counting the three card bill payments. A 12-month range hands over 732 of them before a single salary credit; a 6-month range hands over 366. The extra 366 lines are history the recipient may not need, set by the range field, not the purpose field.

Three habits keep fatigue from becoming exposure: decide the accounts before the screen appears, so you are unticking rather than reading; treat any fetch frequency other than once as a question; and set a reminder a week after a loan decision to confirm the one-time consent shows as expired or revoked.

Revocation is written into the direction, not extended as a courtesy. Paragraph 6.6 requires the aggregator to let you revoke a consent, in whole or in part, and paragraph 10 requires it to show you a record of the consents you have given and who received your information. Most aggregator apps also offer a pause, which stops fetches without ending the consent; that is an app feature rather than a right in the direction.

Go to the aggregator's app or website, not the app that asked, because the consent lives with the aggregator; uninstalling the requesting app ends nothing. Revoke whatever has served its purpose, then read the fetch history to see whether a one-time consent was used more than once. Revoking stops future fetches. It does not delete what was already delivered, which the recipient's own policy and regulator govern.

If a complaint goes unresolved, the direction requires the aggregator to dispose of it within 1 month and to tell you that you may then appeal to the Reserve Bank; NBFCs covered by the Integrated Ombudsman Scheme of 2021 must also follow that scheme.

The framework's real strength is authenticity. Because the provider signs what it sends, a lender knows the data has not been edited, which a PDF emailed by the borrower cannot promise. It also pulls history on day one, as far back as the consent range allows. Loan underwriting, where an edited statement is the risk, is the job it fits.

Tracking your own spending needs card merchant detail, every account including ones off the network, and debits as they happen. The alerts you already receive cover those: this household got every outflow from SMS on Android and 81 of 101 from email alone, with statements filling gaps at a month's lag and 60 uploads a year. How a parser turns one alert into a transaction is shown on the SMS expense tracker page, and what an app with inbox access can see is the subject of the page on connecting Gmail to a finance app.

So a consent is the right route when someone needs verified data from the source, and one of several when you want to see where your money goes. For that second job, ask whether an app shows your card purchases merchant by merchant. If it cannot, its route is missing the spending you most need to see.

The gap this page kept finding was card spending that reaches a bank-only view as one lump bill payment, and accounts a route does not reach at all. Unyfy works from the channels that already carry every line: it reads bank and card transaction emails and, on Android, transactional SMS, and it parses statement PDFs from Axis, HDFC, ICICI, Kotak and Federal Bank. It never asks for your bank password or UPI PIN, and every payment is one you authorise.

What you see is each card purchase as its own transaction, read from that card's alert, rather than only the single bill payment on your bank account, and UPI debits with the payee handle turned into a merchant name from a database of about 10,000 entries. A debit that arrives as both an SMS and an email is counted once, so the second channel adds coverage without doubling your spending.

For an account whose bank sends UPI alerts only by SMS, upload its statement and those debits join the ledger. Install Unyfy on Android, or use the web app at app.unyfy.co.in on an iPhone.