Account Aggregator: Consent-Based Data Sharing in Indian Finance

An account aggregator carries financial records from the arrangement holding them to an arrangement the record holder has named, under a consent that person grants and can withdraw, and it cannot read a single thing it carries. An aggregator makes no record of its own and keeps none. A consent route changes what an arrangement can be shown, and decides nothing at all.

Everything that follows turns on where the records are. An arrangement deciding whether to begin asks for evidence of what has been earned, what is held and what has been repaid. Almost all of that already exists somewhere. The records were written down by the arrangements that handled the money at the moment the money moved, and they have been sitting with those arrangements ever since. The threshold is therefore not whether the records exist, but whether they can be moved from where they sit to where they are being asked for, quickly, and on terms the person the records are about actually sets. A consent route is the arrangement built for that one job and for nothing else.

What problem does a consent route actually solve?

Take an arrangement that will not begin until it can establish three or four facts. The list of required facts is its thresholdThe list a service requires to be satisfied before it opens at all. Somebody wrote that list, it sits inside the service, and it is taken apart in full where the barriers in this subject are worked., and every item on it has to come from somewhere. The question is where that somewhere is. Suvarna Commercial Bank Limited, an invented bank, reports deposits of Rs 1,92,000 crore and advancesMoney a bank has lent out and expects back, carried on the asset side of its balance sheet. How a lender makes money on an advance is settled separately. of Rs 1,44,000 crore. Behind the Rs 1,92,000 crore and the Rs 1,44,000 crore sit records of individual movements, and the bank made every one of them itself, in the ordinary course of handling the money. Nobody had to go and create them for the purpose. The evidence an arrangement asks for has mostly already been written down, by whoever handled the money, at the time it moved.

The problem is therefore not a shortage of records at all. Before a route existed to move those records, the work of assembling them fell on whoever needed to prove something: one arrangement at a time, one form at a time, one printout at a time, each in its own format and each collected by hand. The records were never the scarce thing. Movement was. The till roll at a market stall has the same shape. The roll records exactly what the stall took and is perfectly accurate. No arrangement exists by which a copy of it reaches anyone else, so the roll is completely invisible to anybody not standing at that stall. Multiplied by every place a person's money has ever passed through, that is the shape of the problem a consent route exists to work on.

So be precise about what the route changes and what it does not. A consent route changes what an arrangement can be shown, and it changes nothing whatever about what the arrangement then decides. The threshold on the other side is untouched. The facts it asks for are the same facts. The route moves the cost and the delay of getting the evidence in front of that threshold. Cost and delay are not small things, and neither of them is a decision.

What does a consent carry, and what are its particulars?

Keep two questions apart before going further. Establishing who somebody is happens through the know-your-customer checkThe identification step an arrangement runs before it will deal with somebody, comparing what is presented against a record already held elsewhere. The process, its layers and what an electronic version changed are worked separately., and that is a different exercise with its own evidence and its own conditions, settled on its own. A consent settles the second question: once it is clear who is asking and on whose behalf, what may be shown to them, and on what terms.

A consent is a document with contents rather than a button, and it carries five particulars. Who is asking, named. The material being asked for, described exactly rather than in general. Why, being the purpose the records are wanted for. For how long the permission stays live. How often it may be acted on while it is live. Read those five as a list and they look administrative. Read them as a sentence and they are the entire agreement: this named party may see this described material for this stated reason, for this long, this often.

Every one of the five is a sentence in a document that the person whose records they are can read before agreeing and read again afterwards. Being told afterwards what was collected is a different arrangement altogether. The five share that property, and it is the reason a consent is worth reading as a document at all. The Reserve Bank of India at rbi.org.in sets what a consent must carry and the periods it may run for, and revises both from time to time.

Why is a consent a standing permission rather than a single act?

Here is the trap, and almost everybody walks into it once. Agreeing once does not move records once. Agreeing opens a window, and while that window is open the records may be fetched again, on the terms the consent already carries. The agreeing was the act. The window is what was agreed to.

Compare a single ticket with a season pass and the shape becomes obvious. A single ticket is used once and is finished. A season pass is live for a period, and inside that period it can be used again and again without anybody agreeing to anything further. The pass buys a duration, not a journey. A consent is the second of those two things, and reading it as the first is the error that costs most.

Now do the arithmetic yourself. The whole idea takes one line. A permission live for 6 months, acted on once a month, is six separate movements of records from one agreement; the same permission live for 24 months, at the same frequency, is twenty four. Nothing clever happened in between. The duration was multiplied by the frequency. A standing permission always resolves to exactly that.

The amount that moves is decided by the duration and the frequency written into the consent, rather than by the act of agreeing. The rule is worth carrying away, and it has an uncomfortable corollary: the two particulars a reader is most likely to skim past are the two that decide the size of what happens. Everything a screen puts in large type, being the name of the party asking and what it wants, sets the scope. The two lines further down set the volume.

Moving it once produces two readings a table could not deliver. The first is that the marks accumulate in a straight line. Each extra month is another occasion by construction, so there is no point at which lengthening the window stops adding movements. The second appears only when a month is pressed. Withdrawing partway leaves every mark to the left of the cut exactly where it was, and removes every mark to the right of it.

What does revoking a consent stop, and what does it not undo?

Exactness matters more here than reassurance. Being kind in this one place would mislead. Withdrawing a consent closes the window, so nothing further is fetched under it from the moment it is withdrawn. Every occasion that had not yet arrived simply does not arrive. If the permission had eight months left to run at once a month, eight movements of records stop happening, and no further step is needed to make that true.

Withdrawal does not reach back and unsend the records that already moved. The records that already moved sit with the receiving arrangement, and no instruction given afterwards can make an arrangement not have received something. So revocation is a tap being turned off rather than water being pulled back, and the difference between those two pictures is the whole point. The records that already arrived raise a genuinely separate question with a separate answer: what a receiving arrangement may do with data obtained on a consent, and how long it may keep it, is set by the Reserve Bank of India at rbi.org.in, and it moves.

Why can the party that moves the records not read them?

Now the property that makes the whole arrangement work, and treat it as the design rather than as a feature bolted onto it. The records pass through the moving party in a form that party cannot read, so at no point in the journey does it hold a readable copy of anything. What goes in is sealed, what comes out is sealed, and only the arrangement the consent named can open it.

A promise would be weaker than that property, and the reason is worth stating slowly. A party that could read what it carries would have to be trusted not to. Trust of that kind has to be extended, monitored, audited and withdrawn, and every one of those is expensive and slow and imperfect. A party that cannot read what it carries does not have to be trusted not to, and a design that removes the need for trust is stronger than any assurance about how trustworthy somebody is. Think of a sealed envelope handed to a courier who has no way of opening it. The envelope is safe because of the seal, not because of the courier, and that distinction is the entire architecture in one sentence.

Four things follow from that property, and readers usually assume the opposite of every one of them. The carrying party does not score anybody, does not decide anything, does not keep a copy of what it moved, and does not build a picture of its own. It has nothing to build one from. Its records are records of movements it performed, being that a consent existed and was acted on at a moment, and not records of what moved. The carrying party runs a narrower business than most people expect when they first hear that something is moving their financial records around, and the narrowness is the point rather than a limitation of it.

What can this route reach, and what can it never reach?

Take the mechanism first. The case only makes sense once the mechanism is in place. A route that moves records reaches exactly as far as records were made, and not one step further. Any registerAny place where a fact about somebody was written down and filed by somebody. A register holds what was put into it and nothing else, and it has no way of knowing about anything that was never entered. holds what was entered into it and nothing else. A register cannot be queried for an event that nobody wrote down. There is nothing in it to find. The limit is not a shortcoming of any particular route; it is what a route is.

Now the case that follows from it, and it is the sharpest thing in this whole subject. Money that moved as cash created no record of itself. A note handed across a counter is complete when it is handed across: the transaction has happened, the money is where it was going, and nothing anywhere has been written down about it. So where earnings arrived in cash over several years, there is simply nothing for a route like this to move. Not a partial record, not a thin record. Nothing.

A payment made in cash is not a behaviour and it is not an omission. It is a way money moved, chosen by whoever was paying at least as often as by whoever was being paid, and it does not write anything down. An arrangement asking for a record of earnings in that situation is asking for a line that the method of payment never wrote. The request says something about the method and something about the arrangement's own list of acceptable evidence, and nothing whatever beyond those two.

Which leaves a question rather than a verdict, and this is the part worth being careful with. Where no record was ever made, the arrangement faces the next question itself: what other evidence will its threshold accept? That is a sentence in a document somebody wrote, it can be rewritten, and rewriting it moves the threshold without anything else in the world having to change. A threshold that accepts only one kind of evidence reaches whoever has that kind of evidence. A threshold that accepts three kinds reaches further, at whatever cost of checking the extra two brings with it, and that trade is the arrangement's to make and to price.

What does the arrangement receiving the records do with them?

An account of plumbing turns quietly into an account of decisions here, if nobody is watching. Records arrive: entries for movements that actually happened, readable by the receiving arrangement, for the purpose the consent named and no other. Records are not a verdict, not a score and not a credit recordThe standing history of borrowing and repayment that is assembled and held about somebody by a separate arrangement, and which is built, corrected and read in a way covered separately.. A credit record is a different artefact, assembled by a different arrangement and covered separately.

The receiving arrangement uses what arrives to establish the facts its own threshold asks for, and then it decides, with its own money and at its own risk of loss. That last clause is the one that keeps this honest. Nothing about the route makes the decision easier to get right; it makes the evidence cheaper and faster to obtain. An arrangement that reads the evidence badly reads it badly whether it arrived in a day or in three weeks.

And where the records arrive but the fact still cannot be established, there are exactly two things the arrangement can do, and both are decisions about its own exposure. The arrangement either declines to begin, or it carries the uncertainty itself and prices for the uncertainty it is carrying. There is no third option that makes the uncertainty go away, and noticing that is what stops a reader treating a data route as a machine that produces answers. The route changed what could be shown. Every decision on the other side of it is still the arrangement's own.

How does a lender on the receiving side actually read this?

Who sets the conditions this whole arrangement runs under?

Every condition in this subject that sounds as though it should have a number attached to it does have one, and the number lives with an authority rather than in any description of the arrangement. Six conditions have been touched along the way, and each of them is set by an authority, revised by that authority from time to time, and published by that authority at an address that can be visited. Five of the six belong to the Reserve Bank of India at rbi.org.in, and the sixth belongs to the Securities and Exchange Board of India (SEBI) at sebi.gov.in for the same arrangement where the records sit with a market intermediaryA party registered to act between buyers and sellers in the securities market, such as a broker or a depository participant. Which activities require registration, and on what conditions, is covered separately..

One of those six conditions deserves saying out loud. The control above moves a period from 1 month to 24 months, and the periods a consent may actually run for are set by the authority in the second row and they move. The range of that control was chosen to make a shape visible and is not a statement of what any arrangement permits.