Breaking barriers,
building bridges
Paving the way for a flourishing Account
Aggregator ecosystem in India
Based on the collective ideation of large FIUs
in the Account Aggregator ecosystem
Table of contents
1. Executive summary 01
2. Introduction 02
3. About Setu 04
3.1 Quick background of the Homebrew Fintech Club
3.2 Account Aggregator workshop by the Homebrew Fintech Club
4. Challenges in the Account Aggregator ecosystem 06
4.1 Product specs
4.2 Performance
4.3 Onboarding & compliance
4.4 User experience
4.5 Awareness and adoption
4.6 Commercials and business models
5. Way forward and conclusion 16
6. Acknowledgements 17
7. References 17
1. Executive summary
This whitepaper presents a experience of the account aggregator
comprehensive analysis of the ecosystem requires enhancement
challenges facing the account through a more user-friendly interface
aggregator ecosystem in India across and personalized offerings.
six key themes—
The adoption of the account
1. Product specifications aggregator ecosystem is hampered by
2. Performance a lack of understanding of its concept
3. Onboarding and Compliance and potential benefits among potential
4. User experience users and data providers. Finally, the
5. Awareness and adoption commercial and business models for
6. Commercials and Business models account aggregators need refinement
to ensure the financial viability of the
The insights presented in this ecosystem while balancing the interests
whitepaper were obtained through of all stakeholders.
a workshop attended by financial
information users in the account To overcome these challenges,
aggregator ecosystem. effective collaboration and
coordination among regulators,
The whitepaper identifies the lack of account aggregators, data providers,
standardized product specifications as and financial information users are
a major impediment to interoperability, necessary. Setu’s Homebrew fintech
leading to integration issues between club provides an ideal platform for such
various data providers and financial collaboration and community building
information users. In addition, the among ecosystem participants.
performance of the account aggregator
ecosystem is impeded by the need In summary, this whitepaper presents
for secure and reliable data transfer crucial insights into the challenges
mechanisms and the large volume of and opportunities of the account
data being processed. aggregator ecosystem in India. We
hope that it serves as a useful guide for
The onboarding process for data industry executives and stakeholders
providers and financial information to navigate the complex landscape of
users is plagued by complex account aggregation and foster the
compliance requirements that need growth of the ecosystem in India.
to be streamlined for a more efficient
experience. Furthermore, the user
Challenges in the AA ecosystem: An FIU perspective 01
2. Introduction
Figure 1 : A high-level network diagram of the key participants in the AA ecosystem
The Account Aggregator framework With 10 AAs, 170+ FIUs (Financial
was envisioned and brought to life Information Users), and 40+ FIPs
by the master directions of the RBI (Financial Information Providers) live,
on Account Aggregators, in 2016. the ecosystem has begun to have a
Since its inception as a concept note real-world impact on the way. More
with regulatory guidelines, it has than 7.74 million citizen accounts have
come a long way. Today, the Account been linked with various account
Aggregator framework now a aggregators.
full-fledged ecosystem that enables
real-time and consent-based sharing of
diverse financial data.
02
Figure 2 : Chart depicting cumulative count of accounts linked by account owners
Nonetheless, it’s still the early days of workshop with financial institutions and
this ecosystem. Most industries are only fintech startups that are some of the
beginning to wake up to the power of largest participants in the ecosystem.
this innovation, with lending institutions This whitepaper will expand upon
and banks at the forefront. As with some of the challenges and potential
all innovations, however, there are solutions in the account aggregator
failures, teething issues, and ecosystem ecosystem that were unearthed from
grievances among other challenges. the workshop, namely from the FIU
or Financial Information User point of
On March 2nd, 2023, The Homebrew view.
Fintech Club—by Setu—hosted a
Challenges in the AA ecosystem: An FIU perspective 03
3. About Setu
Setu enables API-based access to and services. We provide pre-built,
financial services such as payments, embeddable, and customizable
KYC, and data products to any screens that enable regulated financial
company. Setu builds developer- institutions to seamlessly take
friendly APIs that make interfacing customer consent and fetch their data,
with banks and financial institutions to power use cases such as income
easier for fintech entrepreneurs and verification, loan monitoring, spend
institutions alike. analysis, personal finance management,
wealth management, insurance, and
Setu partners with licensed account several more. Setu also provides
aggregators, as a technical service insights on top of account aggregator
provider (TSP). We collaborate with data.
FIUs and FIPs to deliver AA products
04
Quick background of the Homebrew Fintech Club
3.1 Quick background of the Homebrew Fintech Club
The Homebrew Fintech Club is an Club will continuously host a series of
exclusive community of Product high-profile activities, including but not
Managers, Designers, and Engineers limited to Design Thinking workshops,
who collectively solve some of the Product Roundtables, or Jeffersonian
most pressing challenges in the Indian Dinners.
fintech space. The Homebrew Fintech
3.2 Account Aggregator workshop by the Homebrew Fintech Club
The objective of the workshop was The principle is: to share the
to come together as fellow industry information you receive, but do not
operators and collectively discuss the reveal the identity of who said it. In
challenges and solutions that we all the spirit of this, we too, will not be
face today. revealing the names of any attendees,
which companies they represent, or
The workshop followed Chatham other details.
House Rules. It is used around the
world to encourage inclusive and open
dialogue in discussions, and create a
trusted environment to understand and
resolve complex problems.
Challenges in the AA ecosystem: An FIU perspective 05
4. Challenges in the Account
Aggregator ecosystem
From the discussion that lasted more As the group of 20 operators &
than 4 hours, we collectively realised practitioners gathered, a few major
two important things – (i) We share themes emerged. They are listed
more challenges in commons than we below:
expected (ii) These challenges reveal
broad patterns.
06
their financial information from
4.1 Product specs these accounts.
The ‘spec’ or specifications of the 2. Data-fetch APIs: Anything that
account aggregator ecosystem, its enables an account aggregator
protocol and the standardized API to receive encrypted financial
interfaces behind it were set by ReBIT information from FIPs and pass
(Reserve Bank Information Technology it on to an FIU with consumer
Private Limited). Much of the design consent.
was focused on designing an
interoperable network connecting the 3. Notification APIs: All
three main entities in the ecosystem (i) communication, status updates,
Financial Information Users (ii) Financial error updates, and notifications
Information Providers (iii) Account between the three parties in the
Aggregators account aggregator ecosystem.
The specifications ensure that an AA
‘client’ or consent manager – acts as As with all interoperable networks,
the mode through which a ‘citizen’ or despite the comprehensiveness
end-user can share their data, which of the system, the realities of the
lies within the systems of FIPs. This is financial system today, technical
“Fetched” by account aggregators, who incompatibilities and on-ground
then pass on their financial information challenges are inevitable. The working
to the FIUs, so they are able to provide group of the HomeBrew Fintech Club
citizens with a financial service. surfaced a few key challenges. They
are as follows:
There is a set of APIs that cover a
few main constituent aspects of the
data transfers, defined by the ReBIT Interoperability and availability of
specifications. For simplicity, we have participants
clubbed them into 3 parts and added A key challenge in the ecosystem
brief descriptions of the sub-parts or has been with respect to the
APIs onboarding and service delivery
Financial Information Providers.
While adoption by these institutions
1. Consent management & Consent- is a massive challenge, given the size
related APIs: Anything related to and complexity of enabling these
the citizen creating an account systems, it is not speed that seems
with an AA, discovering accounts to be the issue but interoperability
with FIPs and consenting to sharing and effective enablement. A number
Challenges in the AA ecosystem: An FIU perspective 07
of FIPs have raised concerns that acknowledged as temporary issues,
despite there being 10 operational until financial information providers
account aggregators, at the start of an are accustomed to the ecosystem and
FIPs journey, it is noticeable that they robustness and scalability has been
integrate with only a select few account brought to their FIP modules, there is
aggregators. scope for improvement.
Secondly, the inability to effectively Purpose code ambiguities and
test “Live transactions” or test these limitations
systems in real-life environments For auditability and clarity on the
without exposing FIUs to breakages, purpose of data requests from any
teething issues, and initial, unintentional FIU, ReBIT has created a fixed list of
errors, has led to both – limited “Purpose Codes”. These are codes to be
availability and access to FIPs as well as specified in any consent request that
disrupted services for the initial period. is being made to a citizen of FIUs’ end
While these are universally user. They are below:
Figure 3 : The complete list of purpose codes FIUs can use to fetch customer data in the AA ecosystem
The main challenges here are with A simple example is related to the
respect to their broad nature and largest use-case in the ecosystem today
compartmentalzation that leaves - loan underwriting. The appropriate
FIUs uncertain about what purpose purpose code for the underwriting is
code to use, given the quickly blurring “103 - Aggregated Statement” which
boundaries in the nature of financial isn’t obvious to most lenders.
services today.
08
Similarly, newer use-cases like income The consent object and approved
estimation for life insurance premium consent management
suggestions or use-cases that span Once any consent is approved, it is
across two core areas -for example, visible as an approved consent in the
a continuously evolving line of credit “Consent Manager” application of the
that depends on one’s spending habits, account aggregator the citizen used for
make for a confusing decision on which the consent. Consents once given have
purpose code to apply. This raises the a few main challenges for FIUs
question of whether there should be
multiple purpose codes allowed in a Consent validity, renewal and duration
single consent, but is at odds with the are a source of ambiguity for FIUs
norm in the ecosystem of “Purpose for a few key reasons - firstly, there
Limitation”, more simply - one purpose are no specific guidelines on consent
and consent, for one use-case. duration between customers and
FIUs. In todays’ world where customer
Consent flow related challenges relationships can be across small
The consent flow is arguably the most as well as large spans of time, the
well-defined of the aspects of the ability to have indefinite or long-term
AA ecosystem. There are a range of consents that match the duration
guidelines on web or SDK (Software of a financial service usage by the
Development Kit) redirection, to the AA customer is needed. As a result, FIUs
client, and on interfaces where a citizen often take arbitrary and conservative
has to provide consent for financial consent durations, even if they need to
information sharing. However, there be longer for the convenience of the
are still a few key challenges highlighted customer.
by FIUs
Second, what of “consent renewal”
Next, is OTP quantum and OTP reading in the above cases? Often, especially
- The widely accepted mode of in cases like loans (with moral hazard
OTP-based login and account linking risks) renewal of consent may pose
means that there is a large number as an uphill task for FIUs to get from
of OTPs that new-to-AA customers their end-users and this may hamper
need to enter, in order to consent to delivery of the financial service.
data sharing. This leads to confusion
and reduced conversion as these add Lastly, there is the concern of
friction to the consent flow. What’s “Frequency” of data fetching. Currently,
more is the redirection from a host FIU there only exists the options of a unit -
app means auto-reading of OTPs is not hours, days, weeks, months and years.
possible in most cases. As well as a value - a numerical value
that can apply to these units. This is
Challenges in the AA ecosystem: An FIU perspective 09
highly limiting as often, there may be a statement ‘Profile’, ‘Summary’ and
a variable data fetch requirement that ‘Transactions’.
would lead to not only possibly more Lastly, with respect to fetching the
judicious use of data fetches, but also a data, the current mode is “Pull-based”
simpler process for FIUs. The ideal need which depends on the FIU creating a
here is an “On-demand” frequency with fetch request and waiting for the data
requisite guardrails and caps to this. preparation on the FIPs’ end. Due to
early ecosystem issues - like timeouts,
Data fetching and format related outages, and time taken to prepare the
challenges data, there are often errors and misses
The final section on specification- in data fetch flows, leading to lower
related challenges is to do with the successes. A “Push-based” mechanism
data or financial information received. by AAs or FIPs is needed for certain
We’ll take a look at some of the cases where data preparation is time-
limitations noticed in the ecosystem consuming or errors are likely.
below:
“Masked account numbers” are high on
4.2 Performance
the list of problems listed by FIUs. Given
that the “Data Principal” or end-user As with all new innovations, the real
who owns the data is giving consent litmus test of their success is their
to share their data, there isn’t a strong performance and service delivery.
reason to mask account numbers. While this has been improving
This is a challenge for FIUs who often over the past year, there are still
need this information for verification a few challenges that FIUs notice.
purposes. Resolving these key challenges can
lead to increased adoption and
Within a statement that is being better outcomes for all players in the
fetched, the inability of FIUs to ecosystem.
dynamically select the specific parts of
a statement that they wish to fetch also Latency issues
acts as a limitation. This can also lead Latency is the first and foremost
to cost savings for FIPs and AAs. Take challenge in this aspect. There is a high
for example a verification use-case that variance in the latency of data delivery
only needs a few details in the profile by FIPs leading to variance in service
of the customer such as holder name, delivery for FIUs.The performance
account number, and age of account. tuning and scaling of systems to handle
This is not possible in today’s account higher volumes of data transfer is the
aggregator spec, since FIUs can only need of the hour.
choose 3 large sections to fetch from
10
Fidelity and completeness of data Gating criteria
Due to either variance from the The eligibility criteria to become an FIU
specifications of the data format, has been a limiting factor to ensuring
uncertainty on how to handle certain widespread adoption of the account
error states (for example, missing data aggregator ecosystem. Today, only a
in a statement), or errors - there have limited list of entities who are licensed
been challenges related to erroneous by any of the financial regulators of
data or denial of service. These often India can become an FIU. More open
mean that FIUs are unable to serve criteria similar to “KYC” for payments
customers who otherwise might have or “Permits”, with a review process,
been served through alternate methods can provide a lot of unregulated yet
of verification and data sharing. trustworthy and verifiable entities
access to the ecosystem to leverage AA
Transparency on performance and and drive better outcomes for citizens.
grievance redressal
The above two problems, while not Another key challenge highlighted that
rampant, need to be better addressed is notably common is the conundrum
through clear SLAs, transparent of Loan service providers and digital
performance measurement of lending apps which often are an
various players, and clear and prompt interface to acquire customers, act as
grievance resolution mechanisms. the front-facing application, and own
Some of these needs are being the relationship with the customer.
addressed today, for example, with the Since they are not typically regulated
SaaNS dashboard by Sahamati which entities and partner with a regulated
is used to monitor FIP performance. entity like a bank or NBFC, they often
However, there is room to improve need to run consent flows in the name
in these areas - to ensure a more of their regulated partner, and data is
accountable and reassuring experience only passed to the regulated partner.
for citizens and FIUs alike.
This, is despite the fact that (i) The
customer only often knows of the
4.3 Onboarding LSP or DLA they are getting a loan
and compliance from (ii) The LSP & DLA often being
an integral part of the operations like
While the previous two sections underwriting. This makes for both a
focused on the functional-technical tedious onboarding process for NBFCs
aspects of the ecosystem, there are a with multiple LSP and DLA partners, as
set of challenges focused on the legal- well as a confusing experience for the
operational aspects. Some of them are end-user..
listed here:
Challenges in the AA ecosystem: An FIU perspective 11
It is however, important to acknowledge here by FIUs. We’ll explore the UX of
that this may be because the consent activities.
ecosystem is in its early days and this
may change with time, clarity, and legal Disallowing Auto-Discovery of FIP
tailwinds like the data protection law Accounts
in India that brings accountability to One of the most common challenges
unregulated entities on data access of faced is with respect to the “auto-
their customers. discovery” of end-users financial
accounts via the consent flow. The
Cross-sectoral and purpose limitation- FIPs strongly advocate for asking
related challenges users to manually select every bank,
These are a source of confusion for insurer, securities provider, and pension
many FIUs today. Today’s quest for institution and then link and consent to
“super-apps” and “One-app-for- share these.
everything” means that licenses in their
current form and their limitations can Typically this is done to minimize stress
be a challenge. There is a need to have on FIP systems, however, often this
templates for what kinds of consent comes at the cost of user experience to
parameters, and for what purposes end-users. For example, most users are
an FIU can request data via account unaware of who or what a depository
aggregators as there is no guidance on is – since they are the FIP in such cases,
this currently. this makes for a confusing experience
and drop-offs in consent flows related
Third-party fraud to personal finance management.
Lastly, concerns have been raised Similarly, flows in the same area of
by FIUs wherein fraud related to personal finance management need
social engineering is a concern being many if not all of a user’s accounts
raised, considering the OTP-based to be selected in order to effectively
authentication mechanisms. Through offer them the service. Asking users
concerted efforts and collaboration to to manually select accounts in such a
build consumer awareness, these need case is tedious and error-prone.
to be tackled to bring clarity and trust
to the ecosystem. Resistance to engage in auto-discovery
One of the most common challenges
faced is with respect to the “auto-
4.4 User discovery” of end-users financial
experience accounts via the consent flow. The
FIPs strongly advocate for asking
In this section, we focus on the end- users to manually select every bank,
user and the challenges noticed insurer, securities provider, and pension
12
institution and then link and consent to The current guidance and challenges
share these. here are largely around the multiple
OTPs required in a consent flow – first
Typically this is done to minimize stress to authenticate the user and begin the
on FIP systems, however, often this AA consent flow and next, to link each
comes at the cost of user experience to financial account. There is a mixed
end-users. For example, most users are signal in the market of never having
unaware of who or what a depository to share OTPs and users now being
is – since they are the FIP in such cases, exposed to not just a new concept of
this makes for a confusing experience account aggregators but also having
and drop-offs in consent flows related to provide multiple OTPs to a “feet-on-
to personal finance management. street” salesperson.
Similarly, flows in the same area of
personal finance management need The challenges here range from the
many if not all of a user’s accounts confusion around OTP provision, to
to be selected in order to effectively whether a “feet-on-street” onboarding
offer them the service. Asking users professional going through the consent
to manually select accounts in such a flow on behalf of the customer
case is tedious and error-prone. constitutes consent in the first place.
Guidelines not being present for this
Guidelines around client-side means it is ambiguous and lastly, this
redirection also has its problem rooted in the next
Here there are challenges, especially theme – consumer awareness (or the
related to the customization of UI. lack of it).
Clarity is often sought on exactly what
can be handled by an FIU versus what
has to be handled on the AA entities’ 4.5 Awareness
digital infrastructure.
and adoption
Assisted journeys challenges
Coming to the final challenge brought
up around UX, which also has partly Continuing with our theme of user-
to do with our next theme, is “assisted related challenges - we follow it up
journeys”. Much of low-income and with large consumer awareness and
new-to-credit financing, insurance, adoption challenges seen in the
and other financial services tend to ecosystem.
involve assisted application and sales
processes, since customers may either General consumer awareness
be savvy or low in their understanding The first and foremost is awareness
of financial services. of an account aggregator itself. The
Challenges in the AA ecosystem: An FIU perspective 13
lack of awareness among the general explicit mention of onward sharing
public means this method, despite its to the consumer-facing. While the
clear outlining of RBI licensing in the explicit consents are truly transparent,
consent flows, means it is a challenge the specific guidelines on using only
to get users to both adopt this as a entity names or certain logos of FIUs
data-sharing method and see high mean that consumers are leaving the
conversion rates on consent. While environment of an entity they believe
this isn’t a rampant challenge this they are engaging with and then being
does contribute to the teething issues asked to share data with an entity they
noticed in the ecosystem. don’t truly interact with. This has been
a significant cause of drop-offs and
Multiple OTPs or one-time passwords challenges for FIUs and is a pain point
in the consent flow as mentioned given the regulations.
above tends to fly in the face of current
awareness programs that explicitly
try to minimize sharing and accepting 4.6 Commercials
requests to use an individual’s OTPs.
What’s more is the sheer number of and business
OTPs in the flow often has by its nature models
a chance of errors from both FIPs
and the end-users, as well as drops in Lastly, comes the financials and
conversion due to the effort involved. commercial structures in the
ecosystem. We’ll dive into some points
Branding guidelines for FIUs of discussion brought out by FIUs here.
Finally, a challenge clearly brought
out was branding guidelines. Since it is The biggest challenge FIUs have noted
only regulated entities that can be FIUs is the stability and performance of FIPs.
in the ecosystem, there is a huge gap While this has come a long way and is
with respect to entities like LSPs (Loan now at a state that can serve millions of
Service Providers), marketplaces for customers, FIUs truly believe enabling
insurance, and unregulated partners FIP accountability will come through
to these entities as well as their market-based incentives.
consumer-facing nature.
FIP incentives
Often, a consumer is only aware of The lack of FIP monetization can be
the brand they face and not the entity a major contributing factor to FIP’s
behind the scenes, even if that is performance and adding compensation
the regulated entity conducting the towards them will not only incentivize
financial service. Guidelines mandate and create bandwidth for their
the use of FIU logos as well as the performance but also generate
14
accountability mechanisms that other is the ambit of an AA/TSPs activity
parties enforce on them, given they with respect to data sharing versus
are now providing a service rather than what constitutes value-added services
enabling their services for free. such as analytics needs to be clearly
outlined by the regulators. Often
Outlining a TSP versus AAs activities these are sold as a package and
and scope even mentioned as mandatory to use
Finally, a word of AAs, TSPs & what together when this isn’t the case.
Challenges in the AA ecosystem: An FIU perspective 15
5. Way forward and conclusion
The purpose of this document and their purview and as per a recognized
the workshop that enabled it was to standard for performance.
bring out the specific challenges that
FIUs want to see addressed in the Massive end-user education and
ecosystem. Through working together solutioning to improve experience
with all parties involved – FIPs, FIUs, Firstly, focusing heavily on awareness
AAs, TSPs, Sahamati & the regulators in and promotion of this new concept to
open and transparent dialogue, we can citizens. Consistently being in touch
enable concerted efforts to solve these with the end users of the applications
problems as a community that wishes of these appication to understand
to bring millions of Indians into the fold their frustrations and user experience
of formal finance. and how to better it. Working on
innovations the improve delivery and
Some clear themes emerge from mediums for end-users.
the above problems and some of
the common solutions that can be While this document doesn’t list out
implemented include: solutions in depth, this is an intentional
move to ensure solutions involve
Governance, guidelines, and iterative the voices of all players and aren’t
improvements brought out from a limited perspective.
Bringing in a set of policies, processes, The hope here is to bring greater
and procedures put in place to ensure awareness to the challenges on the
the proper management, control, and consumer front of the ecosystem and
monitoring of APIs. Also, consistently be able to solve them in a manner that
reviewing on-ground challenges accommodates other players in the
that cause problems due to the way network as well.
the specifications are designed and
improving them iteratively to smoothen
account aggregator service delivery.
Performance monitoring, incentives,
and accountability
Similar to our example of the SaaNS
dashboard in section 3.2, bringing in
transparency on the performance of
participants and monitoring to ensure
each player is acting in accordance with
16
6. Acknowledgments
We at Setu would like to thank, from for the benefit of all players in an
the bottom of our hearts – all of the ecosystem and most importantly – the
FIUs who took out the time from their citizens of this country was a great
busy schedules to spend a dedicated experience and we hope this document
day just to discuss challenges in the serves as a testament to that.
account aggregator ecosystem. Last but not least, we would like to
thank Sidharth Shetty, co-founder of
We had participants from various DigiSahamati Foundation for attending
sub-sectors of the financial services this and listening to the points intently
industry, ranging from fintech, to and with an open mind. The dedication
traditional NBFCs, to insurers. To have of him and other members in this
competitors sit side-by-side in a room forum to bringing improvements to the
with the selfless notion of contributing, ecosystem makes this possible.
7. References
https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=10598
https://sahamati.org.in/
https://sahamati.org.in/aa-uniform-code-of-conduct/
https://api.rebit.org.in/
https://specifications.rebit.org.in/NBFC-AA%20API%20Specification_Core_
Final_08Nov.pdf
https://api.rebit.org.in/purpose
https://github.com/Sahamati/security-standards
https://github.com/Sahamati/aa-common-service
https://github.com/Sahamati/aa-redirection-guidelines
https://sahamati.gitbook.io/aa-common-service/central-registry/overview
https://github.com/Sahamati/certification-framework
https://sahamati.gitbook.io/aa-redirection-guidelines
https://docs.setu.co/data/account-aggregator/overview
Challenges in the AA ecosystem: An FIU perspective 17
https://setu.co
