Sharing data through account aggregators: Rights, risks and how to stay in control

Representative image

Account aggregators or AAs are changing the way Indians share financial information with lenders, fintechs, and investment platforms. Instead of uploading bank statements or income proofs, you can give digital consent for secure data transfer directly from your bank to a verified institution. However, many users do not fully understand what they actually share, how long-term access will last, or how to revoke consent once it is no longer needed. Knowing them can keep you in control of your financial information.

What you actually share through AA

When you approve an AA request, you permit the requesting institution to access certain data types, such as bank statements, transaction history, tax data, insurance details, or investment records. Only the categories you select are ever shared, nothing else. No one gets to view your passwords or login credentials, and AAs never store data; they only securely pass it from one Financial Information Provider (FIP) to a Financial Information User (FIU).

How consent works

Consent is the basis on which the AA system operates. Every request specifies the purpose for which the data is sought (say, loan assessment), the type of data, the duration of access, and whether it is a one-time or recurring pull. You have to approve each request through your AA app or SMS verification. A lender, fintech or investment platform cannot actually change the scope later without a fresh approval from you.

How long your data will remain available

In case of one-time consent, your data is fetched only once. In case of recurring, for instance, a month-on-month update of transactions within a credit line, the FIU can fetch data only for which you consented and for a period you chose. When that period expires, your consent will automatically expire. You can also see all your active consents at any time inside your AA app.

How to withdraw consent immediately

You can revoke consent at any point through your AA app, even if the original duration hasn't ended. Revocation immediately blocks further data access for the FIU. The AA also sends a notification confirming the withdrawal. After revocation, the FIU cannot request or pull fresh data unless you approve a new consent.

FAQs

Can a bank or lender view my entire financial history?

No. They see only the specific data fields you approved in the consent request.

Does revoking consent remove already-shared data?

No, revocation stops future access. Anything that has been shared will remain with the FIU unless you ask them to delete it directly.

Is the AA system safer than uploading PDFs or screenshots?

Yes. AA transfers are encrypted end-to-end, avoid document tampering risks, and prevent oversharing.