Who uses Account Aggregator data, and where does the consent funnel break?
The evidence shows deep enterprise adoption and an unresolved question about consent.
Start with demand. Sahamati's most recent category breakdown, as of March 2025, shows NBFCs accounting for roughly 61% of fulfilled consents, followed by registered investment advisers (12%), stockbrokers (11%) and private banks (9%). Public sector banks contributed under 1%.
Adoption is wide at the top and thin underneath. All 12 public sector banks and all 24 life insurers were live as data users. Yet only 318 of roughly 9,400 non-banking financial companies (NBFCs), housing finance companies (HFCs) and allied entities had joined, alongside 183 of more than 9,100 SEBI-regulated intermediaries, and none of Pension Fund Regulatory and Development Authority’s 53 regulated entities. The user count has since risen to 1,076, but the long tail of mid-sized lenders remains largely off the rail.
Value tells a different story from volume. Sahamati's H2 FY26 lending impact report finds banks accounted for 47.3% of AA-enabled lending by value, nearly matching NBFCs. Home loans and loans against property reached ₹20,777 crore in FY26. The likely reading: NBFCs pull data often for small tickets, banks pull less often for larger, secured exposures.
Now the funnel. Of 2.8 billion enabled accounts, customers have linked about 338 million, roughly 12%. Further down, Sahamati's own figures show about 1.97 billion consents raised against 493 million fulfilled. That is one in four. The public data does not split the gap into customer rejection, abandoned journeys, expiry or provider-side failure. That blind spot is the CFO's problem. A 75% leak between request and data is a customer experience issue, a technology issue or a trust issue. Each carries a different fix and a different cost.
What does Sahamati's SRO status mean for banks and NBFCs?
The collective body governing this rail is Sahamati, which now operates with Self-Regulatory Organisation standing. RBI recognised Sahamati as the SRO for the AA ecosystem on 5 June 2026, making it India's first SRO to cover a cross-sectoral ecosystem answerable to several financial regulators.
Its mandate spans operational and technical standards, dispute resolution, interoperability and ecosystem discipline. Expect codes of conduct, performance norms and tighter certification to follow. For data users and providers, that means obligations arriving through an industry body as well as through circulars, and a forum where poor provider response rates can finally be escalated. Budget for both.
The DPDP clock: under six weeks
The second rulebook arrives sooner. Under the DPDP Rules, 2025, Rule 4 on the registration and obligations of consent managers comes into force on 13 November 2026. The obligations will look familiar to anyone in AA: the platform must not be able to read the data it routes, and consent records must be kept for at least seven years. Broader duties on notice, consent, security and breach reporting follow in May 2027, completing the 18-month phased timeline.
AAs already act as RBI-regulated consent managers for financial data. How the two consent regimes will interlock in practice is not yet settled, and financial institutions sit in the middle. Consent remains an architecture problem before it is a legal one. A consent artefact holds no legal weight unless your underlying systems reliably log its creation, enforce its boundaries, and execute its expiration.
How does Account Aggregator participation cost and benefit a financial institution?
Participation becomes a two-way commitment. RBI requires its regulated entities joining as data users to also join as data providers if they hold the relevant financial information. API uptime, response latency and grievance handling become recurring operating costs, and Sahamati already publishes an API health dashboard for the ecosystem.
Against that sits the return. Provider data arrives digitally signed, which removes the doctored-PDF problem. Cash-flow data opens thin-file segments: new-to-credit borrowers made up 18.2% of AA-enabled originations at the institutions Sahamati analysed. Recurring consents allow continuous portfolio monitoring.
What should CFOs in financial services do about Account Aggregators now?
- Measure your own funnel. Track consents raised, approved, delivered and converted into decisions. If you cannot beat one in four, find out where customers drop.
- Price the data honestly. Compare cost per fulfilled consent against manual statement collection, verification effort and fraud losses.
- Move beyond onboarding. Recurring consents for early-warning signals and limit reviews are where credit-cost benefits compound.
- Treat provider obligations as a budget line. Uptime will be visible to the SRO and to peers.
- Run one consent governance programme. Map AA consent artefacts against DPDP notice, retention and withdrawal duties now, not in May 2027.
CFOs who build the measurement first will find the case for investment far easier to argue. Those waiting for a revenue line will wait a long time.
