India's Account Aggregator turned bank-statement sharing into a consent API

Getting a loan in India long meant assembling paper proofs — bank statements, income records — one application at a time. The blockage was worst for MSMEs, whose financial lives sit scattered across institutions; RBI Deputy Governor M. Rajeshwar Rao said Account Aggregators could consolidate exactly that cash-flow data. The Reserve Bank had sketched the model in 2015: licensed non-banking finance companies acting as neutral, fiduciary data conduits rather than data owners.

The ecosystem went live on 2 September 2021 before an audience of 900-plus fintech players. Eight banks representing 40% of India's bank accounts joined, with HDFC Bank, ICICI Bank, Axis and IndusInd already live; the licensed aggregators were Finvu, OneMoney, CAMS Finserv and NESL. Every transfer rides on a consent artifact the user grants and can revoke — and the aggregator itself cannot store or read the data it moves, a deliberate design choice that keeps the pipe neutral.

Adoption then compounded. CGAP reports 120 million accounts linked through Account Aggregators by December 2024, up from 39 million a year earlier, with over 570 regulated financial entities in the ecosystem and more than $10 billion in loans disbursed since launch — half of it in the six months to September 2024. In CGAP's customer survey, willingness to share bank data for a better loan offer jumped from 33% in 2023 to 71% in 2024, with convenience and trust in the bank as the stated reasons.

Make consent itself the thing that travels

MSMEs were the blockage: with financial records scattered across institutions, no single paper trail could prove cash flow to a lender.

The middleman is deliberately blind — aggregators cannot read or retain what they move — which removes the surveillance bargain other data-sharing models demand.

Consent is machine-readable and revocable, so trust scales by design rather than by contract.

The eight launch banks were both suppliers and buyers of the same data, so nobody had to move first alone.

Open data rails work when nobody owns the pipe: regulation writes the consent grammar, competition fills in the apps, and the middleman moves data it is never allowed to see or store.

The framework spread beyond lending into personal-finance management apps, and its architects floated telecom-bill and health-data extensions. The RBI later recognized Sahamati as the ecosystem's self-regulatory organization as consent volumes kept climbing through 2025. CGAP's follow-up research flagged the unfinished work: awareness and adoption gaps by gender and education, with benefits so far skewed toward salaried, urban users.