Account Aggregator Integration for Fintech: The Developer's Playbook

The Account Aggregator framework, designed to give Indians one-tap consented access to their financial data, went from concept to infrastructure in about three years. If you're building anything in lending, wealth, or insurance in India today, integrating AA is no longer optional. Here's the developer view that the regulatory documents skip.

Key takeaways

• AA is a federated, consent-driven framework where licensed Account Aggregators sit between Financial Information Providers (FIPs, banks, mutual funds, insurers) and Financial Information Users (FIUs, lending apps, wealth platforms).
• You integrate as an FIU. Choose one AA partner (Finvu, OneMoney, CAMSFinserv, Anumati); the integration model is the same across them.
• The flow: user grants consent in the AA app, you get a token, you fetch financial data programmatically.
• The hard parts are consent UX, retry handling, FIP coverage gaps, and audit logging.

Why this matters

Pre-AA, lending apps screen-scraped bank statements or asked users to upload PDFs. Both are slow, fraud-prone, and don't scale. AA reduces the bank-statement step from days to seconds, with consent that's regulator-verified. The fintech lending companies who integrated AA first are the ones now writing the next round of underwriting models on richer, fresher data.

How the protocol works

When your app needs a user's bank statement, you call your AA partner's API with the user's mobile number and the data type (DEPOSIT, EQUITIES, MUTUAL_FUNDS, etc.). The AA app prompts the user to grant consent. Once granted, you receive a consent handle. You then call the AA's data fetch API with that handle, and the AA fetches data from the relevant FIPs, normalizes it, and returns it to you in the standard Aggregator JSON format.

Data is delivered in an encrypted form using ECC keys you publish. Decrypt server-side; never ship private keys to clients.

FIU and FIP roles

You're nearly always an FIU (consumer of data). If you're a bank or insurer providing data, you're an FIP, which is a separate regulatory licence with separate infrastructure obligations. For most lending startups: FIU only.

What FIP coverage looks like today

Major Indian banks are live. Public sector banks have varying API uptime. Mutual fund houses are coming online. Insurance is the laggard. Always confirm with your AA partner which FIPs are live for the data type you need before promising coverage to your users.

Consent UX patterns that work

The biggest conversion lever is the consent flow. Best practices:

• Show the user exactly which data you'll access, for how long, and why, before redirecting to the AA app
• Use deep-linking that returns the user to your app cleanly after consent
• Handle the "user cancelled" path gracefully, many users will need a second attempt
• Cache the consent handle locally; don't re-trigger AA for every read

The hard parts

Consent expiry. Consents have lifecycle states (REQUESTED → ACTIVE → REVOKED/EXPIRED). Your state machine has to track them. Don't assume an ACTIVE consent yesterday is still ACTIVE today.

FIP uptime. Some FIPs are slow or intermittent. Build retries, fallback patterns, and clear user messaging if data fetch fails.

Aggregator JSON quirks. Field semantics vary subtly across FIPs. Build a normalization layer in your code.

Audit logging. Every consent action and data fetch must be logged. Plan for inspectors asking for these logs months later.

Common pitfalls

The first is treating AA as a one-shot REST integration. It's a state machine with consent lifecycles, callback handling, and audit obligations. Build for that.

The second is choosing an AA partner purely on price. The differences in FIP coverage and reliability between Finvu, OneMoney, CAMSFinserv, and Anumati are real and worth more than a 5% pricing difference.

The third is shipping without testing the cancel/retry/expired-consent paths. Your real users will hit these regularly.

What we recommend

Allocate 4-6 weeks for a clean AA integration. Get a sandbox account with your chosen AA partner in week 1. Spend week 2 building the consent flow with real UX testing. Weeks 3-4 on data fetch, normalization, and audit. Weeks 5-6 on edge cases and load testing. Go live after a small pilot.

FAQs

Which AA partner should we pick? All four are viable. Finvu and OneMoney have the broadest market presence; pick on FIP coverage for your specific data needs.

Can we cache fetched data? Subject to consent terms and your privacy policy. Short-lived caching is generally acceptable; long-term storage requires explicit user consent.

What does it cost? AA fees are typically per-data-fetch, around ₹1-4 per request. Plan unit economics accordingly.

If AA is on your roadmap, Techpuvi's BFSI practice handles the full integration, partner selection, sandbox, consent UX, audit. Smaller engagements welcome.