Account aggregation is the gathering of financial data from several accounts, held at different institutions, into a single place where it can be viewed, analysed or used by another service. A household might see its current account, credit card, savings and pension balances on one screen; a company might see the cash in every bank it uses. The firms that do the gathering are called aggregators, or sometimes a banking aggregator.
Aggregation began in the late 1990s, long before open banking rules existed, with services that logged in to bank websites on the customer's behalf. Today it is the most common use of open banking and open finance data: in the European Union and the UK it is the regulated activity called an account information service. Aggregators usually sell their connections to other firms, such as budgeting apps, lenders and accounting software, rather than only to consumers. In the United States, a handful of large aggregators supply most of the connections that consumer finance apps rely on.
Account aggregation in plain terms
Picture someone who keeps money in four different piggy banks in four different houses. To know how much they have, they would need to visit every house and count. Account aggregation is a helper who visits all four houses each morning, counts what is inside and writes the totals on one sheet of paper. The owner never has to make the rounds.
The important question is how the helper gets in. In the old way, the owner handed over copies of every house key. In the newer way, each house has a special visitor's door that opens only for an approved helper, only for counting, and only for as long as the owner allows.
How account aggregation works
There are two main technical methods:
- Screen scraping. The customer gives the aggregator their online banking username and password. Software logs in as the customer and reads data from the web pages. It works with any bank but breaks when pages change, gives the aggregator full access, and often breaches bank terms of use.
- API access. The bank provides a dedicated bank API. The customer authenticates with the bank, which issues the aggregator a limited token. Data is structured, permissions are narrower and the customer can revoke them. This is the model behind PSD2, the UK open banking standard and most newer frameworks.
After collection, the aggregator cleans and labels the data, for example sorting transactions into categories, identifying salary payments or matching merchants. Many aggregators also offer bank account verification, balance checks before a direct debit and income verification built on the same connections.
India's Account Aggregator framework
India took a different route. In 2016 the Reserve Bank of India issued Master Directions creating a licensed class of non-bank financial company, the NBFC-Account Aggregator. These firms act as consent managers: they move encrypted data from financial information providers (banks, insurers, securities and pension entities) to financial information users, but cannot read, store or sell it. Every transfer needs a digital consent artefact stating the purpose, the data and the period. The system went live with major banks in 2021 and is coordinated by an industry body, Sahamati. By 2026, according to Sahamati, more than two billion financial accounts could share data through the framework. It complements India's public digital infrastructure, such as UPI.
Uses of account aggregation
- Personal finance. Apps combine balances and spending to help people keep a budget and spot recurring charges.
- Lending. Lenders read cash flow for underwriting and affordability checks, a key input to digital lending.
- Business treasury. Companies use multi-bank aggregation for cash positioning and bank reconciliation.
- Wealth management. Advisers see client assets held at several firms in one report.
- Onboarding. Firms confirm account details and identity during KYC.
Risks and regulation
Aggregation concentrates sensitive data in a few firms, which makes them targets and raises data security and privacy concerns. Under screen scraping, customers who share passwords may lose fraud protection if their bank argues they breached its terms. Regulators have therefore tightened rules: in the EU and UK aggregators must be authorised and use strong customer authentication journeys, and the US Section 1033 rule, finalised in 2024 but being rewritten in 2026, aims to shift the market to secure interfaces under financial data access rights. Critics also question how aggregators use data beyond the service a customer signed up for, such as selling insights to a data broker, and whether long-lived permissions are reviewed often enough. Good practice is to request only the data a service needs, refresh consent at set intervals and delete data when a customer leaves.