What are FIU obligations for AI credit models using Account Aggregator data under NBFC-AA Directions 2025?

The NBFC-AA Directions 2025 establish that Financial Information Users (FIUs — banks, NBFCs, insurance companies) must use AA-fetched financial data only for the purpose stated in the consent artifact granted by the data principal. For AI credit models, this creates specific obligations: (a) model training data lineage must be tagged to the consent artifact that authorized the data collection — an AI model retrained on pooled historical AA data must have documentation showing each data record in the training set was obtained under a consent that authorized use for the model's stated purpose; (b) features derived from AA data used in production inference must remain within the consent scope — if the consent was for 'personal loan underwriting' and the FIU subsequently uses the model for credit-linked insurance underwriting, a new consent with that stated purpose is required; (c) data accuracy obligations under DPDP Act Section 8(3) apply to FIUs — if the AA-fetched data contains errors and an AI credit model produces an adverse decision based on that error, the FIU has a data accuracy obligation; and (d) the FIU's AI model documentation under MRMF must record which consent artifact scope the model's data inputs fall within, as evidence of DPDP compliance.

What is consent-scope drift in AI model retraining and why does it violate DPDP Act Section 6?

Consent-scope drift in AI model retraining occurs when an AI model trained on data obtained under a specific consent purpose learns patterns that extend beyond that stated purpose. A practical example: a FIU obtains customer bank statement data under a consent for 'personal loan underwriting.' The AI model trained on this data learns, among other features, that certain transaction patterns (regular evening transactions at specific merchant categories) are predictive of default. Those patterns are not 'loan underwriting' features in the traditional sense — they are behavioral profiling outputs the model derived from the transaction data. When the model is retrained with updated data, this behavioral signal becomes increasingly refined. The model has effectively repurposed the data from 'loan underwriting' to 'behavioral profiling for credit decisioning' — a purpose not stated in the original consent. DPDP Act Section 6 requires that personal data be processed only for the specified, clear, and lawful purpose for which consent was given. Processing for an unstated purpose — including purposes derived through AI pattern recognition — violates Section 6. Governing this requires: (a) explicit feature scope documentation in the model card — which features are within the stated consent purpose; (b) model audit for purpose-derived features that emerged from training rather than explicit design; and (c) a consent review trigger when model retraining produces new features beyond the original consent scope.

How does MRMF PSI/CSI monitoring work when AA training data is consent-revocable?

RBI MRMF Section 6 requires Production Stability Index (PSI) and Characteristic Stability Index (CSI) monitoring to detect model drift. The PSI threshold is: below 0.10 no concern, 0.10–0.25 investigation required, above 0.25 examination finding. For AI credit models trained on AA-aggregated data, consent revocability creates a specific PSI/CSI complication. When a data principal revokes their AA consent, the FIU must stop using their data — including removing their records from future model training batches. If consent revocations are clustered in a particular customer segment (bureau-thin customers, customers who experience credit denial and then revoke consent, customers in geographic regions with high AA awareness), the effective training population shifts between retraining cycles. This population shift produces PSI signals that look like model drift but are actually consent churn effects. Governing this requires: (a) tagging training data records with consent status; (b) tracking the proportion of consent revocations in each retraining cycle and segmenting PSI/CSI analysis to distinguish consent-churn PSI from true behavioral drift PSI; (c) establishing a consent revocation rate threshold above which model revalidation is required, independent of PSI scores; and (d) maintaining a stable shadow dataset of consented records that does not lose records to consent revocation, to provide a stable PSI/CSI baseline.

Does AA data use in AI credit scoring disadvantage new-to-credit or Jan Dhan account holders?

This is a FREE-AI Pillar 5 (Fairness and Equity) question that has a specific answer for the Indian context. AI credit models trained on AA-aggregated bank statement and transaction data have a potential structural disadvantage for two populations: (a) new-to-credit (NTC) customers who have limited transaction history — their AA-fetched data shows less behavioral signal, meaning the model may systematically score them lower not because of higher credit risk but because of data sparseness; and (b) Jan Dhan account holders whose account activity pattern differs from mainstream banking customers — lower transaction frequency, fewer merchant category diversity signals, more cash-in-cash-out patterns that are neutral for credit risk but may create negative feature values in models trained on mainstream customer behavior. FREE-AI Pillar 5 requires that FIUs test their AA-powered AI credit models for differential approval rates and false rejection rates across these segments. A model that systematically produces lower approval rates for NTC customers and Jan Dhan account holders relative to their actual credit risk is exhibiting proxy discrimination — discriminating on the basis of banking history rather than creditworthiness. MRMF's INDIC-BIAS testing framework should be applied to AA-powered credit models specifically for these segments.

AI Governance · Account Aggregator · FIU · DPDP · MRMF · India BFSI

Account Aggregator AI Governance India: FIU Credit Model Obligations, Consent-Scope Drift, and the DPDP–MRMF Intersection

India's Account Aggregator framework has crossed 100 million consents. FIUs — banks, NBFCs, insurance companies — use AA-aggregated financial data in AI credit models. Three critical governance gaps are unaddressed in any regulatory guidance: consent-scope drift in AI model retraining, model drift when training data is consent-revocable, and FIU AI obligations under NBFC-AA Directions 2025. DPDP Act Section 6 and MRMF both apply. Zero global competitor coverage.

Zytra Research Team · October 2026 · 13 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's Account Aggregator (AA) framework is one of the most architecturally significant financial data infrastructure projects in the world. The AA ecosystem — built on RBI Master Direction DNBR.PD.009/03.10.119/2016-17 and now governed by the NBFC-AA Directions 2025 — enables data principals (customers) to share their financial data across institutions through a consent-based framework. FIPs (Financial Information Providers — banks, tax authorities, insurance companies) hold the data; AAs manage consent; FIUs (Financial Information Users — lenders, insurers, advisers) receive the data after consent is established.

The AA ecosystem crossed 100 million consents in 2025. FIUs are using AA-aggregated bank statement data, investment account data, insurance policy data, and tax return data in AI models for cash-flow-based credit underwriting, portfolio monitoring, customer lifecycle management, and risk-based product pricing. This is exactly what the AA framework was designed to enable.

What no regulatory guidance has addressed is what happens to AI governance when these models use consent-governed data. Three specific gaps create compliance risk that FIUs are currently accumulating without regulatory clarity.

Gap 1: Consent-Scope Drift in AI Model Retraining

An AA consent artifact specifies: the FIU requesting the data, the FIP providing the data, the data types being shared, and the purpose of the data use. DPDP Act Section 6 requires that personal data be processed only for the specified, clear, and lawful purpose stated in the consent.

AI model retraining introduces a subtle but legally significant problem: models trained on historical AA data can learn patterns that extend beyond the original consent purpose. This is not a design choice — it is a consequence of how gradient-based learning works. The model optimizes on the labeled outcome (credit default, prepayment) and in doing so will use any predictive signal in the training data, regardless of whether that signal was explicitly sought.

Consider a FIU that built a personal loan underwriting model using AA-fetched bank statement data. The model learns that consistent evening grocery transactions at a particular price point, combined with specific salary credit patterns, are predictive of credit behavior. These transaction patterns constitute behavioral profiling — characterizing the customer's lifestyle and spending habits in ways that go beyond "personal loan underwriting." The AA consent was for underwriting; behavioral profiling for credit decisioning is a distinct purpose that was not disclosed in the consent artifact.

Governing consent-scope drift requires:

Feature registry with consent-scope tags: every feature in the AI model's feature set should be documented with the consent purpose it falls within. Features the model learned during training (emergent features not explicitly designed) should be reviewed against the consent scope before deployment.
Consent review trigger on retraining: when model retraining produces new features or materially changes feature importance weights, a consent review should assess whether the changed model remains within the original consent scope or requires updated consent with expanded stated purpose.
Per-purpose model segregation: rather than reusing a single model's output across multiple products (e.g., using the personal loan model's score as an input to insurance underwriting), maintain separate models with separate consent bases for each stated purpose.

Gap 2: Model Drift When Training Data Is Consent-Revocable

MRMF Section 6 requires Population Stability Index (PSI) monitoring: PSI above 0.25 is an examination finding requiring model review. Standard PSI monitoring assumes stable training population and deployment population — the metrics detect drift in the deployment population's feature distribution.

AA data's consent revocability introduces an additional PSI driver that MRMF's guidance does not address: consent churn effects. When data principals revoke their AA consents, their records are removed from future training batches. If revocations are non-random — if customers who experience credit denial revoke consent at higher rates, or if customers in specific segments revoke in clusters — the effective training population shifts between retraining cycles even when the deployment population has not changed.

This creates artificial PSI signals: the PSI metric rises not because market conditions have shifted but because the training population composition has changed due to consent churn. A governance framework that treats this PSI signal as model drift and triggers revalidation is doing the right thing operationally but may be attributing the cause incorrectly — and the remediation (retraining on the remaining consented population) may systematically shrink the training dataset in ways that reduce the model's performance for the segments most prone to consent revocation.

Governing this requires:

Tagging each training data record with consent status and tracking consent revocation events
Computing a "consent-adjusted PSI" that distinguishes consent-churn-driven population shifts from behavioral drift
Establishing a consent revocation rate threshold — above which model revalidation is required regardless of PSI scores, because the training population has become materially unrepresentative
Maintaining a stable holdout dataset of consented records as a PSI baseline that does not change with consent churn

Gap 3: FIU AI Obligations Under NBFC-AA Directions 2025

The NBFC-AA Directions 2025 establish FIU data use obligations but do not address downstream AI models that use AA-fetched data. The gap is that the Directions prohibit use of AA data beyond the consent-stated purpose, but do not create a specific obligation for FIUs to govern AI models that process AA data. MRMF and DPDP Act together fill this gap, but neither instrument was written with the AA-specific data architecture in mind.

The combined obligations from the three frameworks:

Obligation	Regulatory Source	AA-Specific Application
Purpose limitation for AI model training and inference	DPDP Act Section 6 + NBFC-AA Directions 2025	Consent-tagged training data lineage; feature scope within consent purpose
Model validation for credit AI	MRMF Section 3	Validation on consented population subset; blind-spot analysis for under-represented post-revocation segments
Data accuracy for AI inputs	DPDP Act Section 8(3)	FIU must verify AA-fetched data accuracy before using in AI model; AI decision on erroneous AA data is FIU liability
PSI/CSI monitoring	MRMF Section 6	Consent-adjusted PSI to distinguish churn drift from behavioral drift; consent revocation rate as additional monitoring metric
Explainability for adverse decisions	FREE-AI Pillar 4	AA-powered AI adverse decision must be explainable without revealing other customers' consented data used in training
Fairness testing	FREE-AI Pillar 5 (INDIC-BIAS)	Test for differential approval rates for NTC and Jan Dhan account holders whose AA data is sparse relative to mainstream customers

Account Aggregator AI Governance Checklist

☐ Consent-tagged training data lineage: each training record tagged to the consent artifact scope that authorized its use; lineage auditable for MRMF and DPDP compliance
☐ Feature registry with consent-scope audit: all model features reviewed against stated consent purpose; emergent features from training assessed for consent-scope drift
☐ Per-purpose model segregation: separate models for separate consent purposes; no cross-purpose reuse of model outputs without consent basis
☐ Consent review trigger on retraining: process to assess whether retrained model remains within original consent scope; escalation to DPDP review if scope drift detected
☐ Consent revocation tracking: revocations logged; per-training-cycle revocation rate tracked; revocation threshold for triggering revalidation defined
☐ Consent-adjusted PSI: PSI computation methodology accounts for consent churn; consent-churn PSI distinguished from behavioral drift PSI
☐ AA data accuracy validation: process for verifying AA-fetched data accuracy before model inference; error detection for common FIP data quality issues (duplicate transactions, incorrect account type classification)
☐ DPDP data accuracy liability protocol: process for handling AI adverse decisions that were based on erroneous AA-fetched data; borrower remediation pathway
☐ INDIC-BIAS testing for NTC and Jan Dhan account holders: differential approval rates and false rejection rates tested for data-sparse segments
☐ MRMF model card includes AA data governance: consent artifact scope, revocability risk, consent-adjusted PSI methodology — all documented in the model's MRMF model card