Fintech

Account Aggregator Framework: The Next UPI for India

The Broken State of Financial Data Sharing

To understand the revolutionary impact of the Account Aggregator framework, Product Managers must first understand the nightmare it replaces. Historically, if an Indian user wanted a personal loan, the lending app needed to underwrite their risk by analyzing their cash flow. The app would ask the user to provide their last 6 months of bank statements.

This led to two terrible user experiences. The first was the "PDF Upload." The user had to leave the app, log into their bank's clunky net-banking portal on a mobile browser, figure out how to generate a custom date-range PDF, download it to their phone, and upload it back to the lending app. If the PDF was password-protected, the flow broke. This caused upwards of 70% drop-off in the onboarding funnel.

The second workaround was "Screen Scraping" via aggregators like Yodlee. This required the user to type their actual bank username and password directly into the third-party lending app. It was a massive security vulnerability and legally gray. The Account Aggregator framework, regulated by the RBI and supported by the Sahamati alliance, eliminates both of these issues permanently.

The FIP → AA → FIU Architecture Explained

The AA ecosystem is a tri-party network. As a Product Manager, you must understand exactly where your app sits within this architecture to design the correct UX.

1. FIP (Financial Information Provider)

The FIP is the institution that legally holds the user's data. Currently, this includes all major public and private sector banks (SBI, HDFC, Axis, ICICI, etc.). However, the network is rapidly expanding to include mutual fund RTAs (CAMS, KFintech), insurance companies, and even the GST Network (GSTN) for business data. FIPs are mandated to expose their data via standardized APIs to the network.

2. FIU (Financial Information User)

This is you. Your app (the lending platform, the personal finance manager, or the wealth-tech advisory tool) is the FIU. You are requesting access to the user's data so you can provide a service. You must be registered as an FIU with the RBI, or work through a licensed intermediary.

3. AA (Account Aggregator)

The Account Aggregator (e.g., OneMoney, Finvu, Anumati) is the consent manager. It acts strictly as a "blind pipe." When your FIU requests data, the request goes to the AA. The AA presents a consent screen to the user. If the user approves, the AA fetches the encrypted data from the FIP and passes it to your FIU. The AA cannot decrypt, read, or store the data. They merely route the encrypted packages based on user consent.

Designing the FIU Consent Architecture (UX Best Practices)

As a PM building an FIU flow, your primary challenge is designing the consent screen. The RBI mandates absolute transparency. You cannot use "Dark Patterns" to trick the user into giving you perpetual access to their data. Your consent request must explicitly state:

• Purpose Limitation: Exactly why are you asking for this data? (e.g., "To underwrite your ₹50,000 personal loan").
• Data Scope: Exactly what data are you pulling? (e.g., "Transaction history for the last 6 months").
• Duration: Is this a one-time pull, or are you asking for recurring access to monitor their portfolio daily?
• Data Life: How long will your servers retain this data before deleting it?

The Product Growth Lever: The best FIUs frame this consent not as a legal hurdle, but as a magical UX moment. Instead of saying "Authorize Data Transfer," the UI should say "Instantly verify your income to unlock a 2% lower interest rate." Tie the friction of the consent directly to the financial reward the user is about to receive.

Technical Implementation and Data Standardization

Before the AA framework, if an FIU managed to get users to upload PDFs, they had to employ complex, error-prone OCR (Optical Character Recognition) engines to extract the tabular data from thousands of different bank PDF formats. It was an engineering nightmare.

Under the AA framework, the data delivered from the FIP to the FIU is structured in a strictly standardized, machine-readable JSON or XML format defined by ReBIT (Reserve Bank Information Technology). This means your engineering team writes one parser, and it works flawlessly whether the data is coming from SBI, HDFC, or a regional cooperative bank. This allows for instant, algorithmic loan underwriting in under 3 seconds.

Privacy, Revocation, and the User's Power

Unlike the old scrape-based methods where your app effectively held the user's net-banking password forever, AA consent is highly granular and entirely controlled by the user. Users can download their chosen Account Aggregator app (like the OneMoney app) and see a unified dashboard of every FIU they have ever granted access to.

With a single click, they can revoke your app's access to their bank feed. This means your product must continuously provide value. If you are a Personal Finance Management (PFM) app, and the user stops finding your insights useful, they will revoke your AA token, cutting off your data supply instantly.

The Future Timeline: Beyond Banking

While Phase 1 of the AA rollout focused entirely on bank accounts (CASA), Phase 2 is already underway. The integration of GSTIN data allows B2B lenders to instantly underwrite MSME working capital loans based on live invoice data rather than audited annual financials. The integration of Equities and Mutual Funds will allow wealth-tech apps to build comprehensive "Net Worth" dashboards with zero manual entry.