Account Aggregator India: consent and revoke - citizen guide 2026

You linked your bank to get a loan faster, and now you want that data tap switched off. With an Account Aggregator you can revoke that consent yourself in a few taps, and the lender stops getting fresh data the moment you do.

An Account Aggregator is a special non-banking financial company licensed by the Reserve Bank of India. It acts as a secure consent manager between the institution that holds your financial data and the one that wants to use it. The AA carries the data through, but cannot read, store, or sell it.

The framework has three players, and you are the most powerful one.

1. You, the customer. You own the data and you control every consent. Nothing moves without your tap.
2. FIP (Financial Information Provider). The institution that already holds your data, such as your bank, mutual fund registrar, or insurer.
3. FIU (Financial Information User). The institution that wants your data to give you a service, such as a lender checking your bank statements before a loan.

The AA sits in the middle as a pipe with a lock. When an FIU asks for data, the AA shows you a consent request. If you approve, the AA fetches the data from the FIP and delivers it to the FIU. Per RBI's NBFC-AA Master Direction, 2016, no financial information of the customer accessed by the Account Aggregator from the providers shall reside with the Account Aggregator. In plain words, the AA is data-blind.

1. Choose an RBI-licensed AA. The current, official list of licensed Account Aggregators is published by Sahamati at https://sahamati.org.in/account-aggregators-in-india/ . Well-known consumer apps include Finvu, OneMoney, CAMS Finserv, Anumati, and NADL.
2. Register using your mobile number that is linked to your bank accounts.

1. Inside the app, search for your bank or institution and link the account. The AA discovers accounts tied to your registered mobile number.
2. Linking only creates the connection. It does not share any data yet. Data moves only after a separate consent.

1. When an FIU needs your data, you get a consent request showing the purpose, the exact data types, the FIU name, and how long the access lasts.
2. Read it carefully, then approve only if the purpose and duration match what you expect. Per the Master Direction, this standardised consent must state the purpose, the nature of the information, the recipient, and the consent expiry date.

1. Open your AA app and go to the consents or active consents section.
2. Select the consent you want to stop and tap revoke. The AA must give you a feature to revoke consent, including the ability to revoke parts of it.
3. Once revoked, no fresh data is shared with that FIU under that consent. The data flow stops at that point.

1. You can revoke any time. The RBI rules require every AA to give you a working revoke feature.
2. The AA cannot see your data. It is a blind pipe, not a reader. The data does not reside with the AA.
3. Consent is purpose-bound and time-bound. Each consent carries a stated purpose, data types, an FIU name, and an expiry date.
4. No consent, no data. No financial information is retrieved, shared, or transferred without your explicit consent.
5. You can link and unlink freely. Linking an account is not the same as sharing it.

1. Approving without reading the duration. A consent can run for months. Check the validity period and shorten it if the app allows.
2. Confusing linking with sharing. Linking is just a connection. Watch for the separate consent screen before any data moves.
3. Using an unlicensed app. Only use AAs on the Sahamati list. If a name is not there, do not link your accounts.
4. Ignoring purpose mismatch. If an FIU asks for far more data than the service needs, decline and ask why.
5. Forgetting old consents. Review your active consents every few months and revoke any you no longer need.
6. Sharing OTPs outside the app. A genuine AA flow never asks you to read out an OTP to a caller.

If your AA app is down and you need a written record, you can send a short note to the AA support team. Keep a copy for yourself.

To: Support, [Name of your Account Aggregator]
Subject: Request to revoke consent and stop data sharing

Dear Team,

I am a registered customer of your Account Aggregator service.
Mobile number: [registered number]
Consent reference / handle: [consent ID if shown in app]

I wish to REVOKE the following consent with immediate effect:
- FIU (recipient): [name of lender or institution]
- Purpose stated: [for example, loan assessment]
- Linked account: [bank name, last 4 digits]

Please stop all further data sharing under this consent and
confirm the revocation in writing to this mobile number.

Thank you,
[Your name]
[Date]

Yes. An AA is a non-banking financial company licensed by the Reserve Bank of India under the NBFC-AA Master Direction, 2016. Only RBI-licensed companies may run an AA service.

No. Under the Master Direction, the data accessed by the AA does not reside with it. The AA is a data-blind pipe that moves data only between the provider and the user you approve.

An FIP (Financial Information Provider) holds your data, like your bank. An FIU (Financial Information User) wants your data to give you a service, like a lender assessing a loan.

Open your AA app, go to the consents section, select the active consent, and tap revoke. RBI rules require every AA to provide a working revoke feature. After revoking, no fresh data is shared under that consent.

No. Linking only creates the connection. Data is shared only after you approve a separate consent that names the purpose, data types, recipient, and duration.

Use only those on the official list published by Sahamati. Names you may see include Finvu, OneMoney, CAMS Finserv, Anumati, and NADL. Always verify the current list before linking.

For most consumers the AA flow inside a lender or app is free to use. The AA earns from the institutions, not usually from you. Check the app before you proceed.

Revoking stops future data sharing under that consent. Data already delivered to the FIU is governed by that institution's own privacy and retention rules, so you may also ask the FIU to delete it.

1. Reserve Bank of India, Master Direction Non-Banking Financial Company Account Aggregator Directions, 2016: https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=10598
2. Department of Financial Services, Ministry of Finance, Account Aggregator Framework: https://financialservices.gov.in/
3. Sahamati, Account Aggregators in India: https://sahamati.org.in/account-aggregators-in-india/

1. The RTI Act, 2005
2. AI tool to draft your RTI
3. First Appeal Builder
4. The RTI Playbook