India's Account Aggregator ecosystem has grown to over 70 million consent transactions as of mid-2026. Banks, NBFCs, fintechs, and embedded finance platforms are building AI credit scoring models, alternative credit assessment pipelines, and financial planning applications on the AA-consented data infrastructure. The AA framework — the RBI Master Direction and DEPA architecture — specifies how data is shared and on what consent basis. It says almost nothing about how the AI model using that data must be governed.
That governance comes from three other frameworks: MRMF June 2026 (for FIUs that are RBI-regulated entities), DPDP Act 2023 (for purpose limitation and consent revocation), and RBI FREE-AI (for fairness in credit AI). Together, they create a governance layer for AA-consented AI that no FIU operating at scale can ignore.
Banks, NBFCs, Insurers, Tax Authorities
- Hold customer financial data
- Registered FIPs under AA framework
- Share data only on valid AA consent
- RBI-regulated: MRMF binds FIP's own AI
- Examples: SBI (FIP), HDFC Bank (FIP), LIC (FIP)
Consent Broker
- RBI-licensed NBFC-AA
- Manages consent artefact lifecycle
- Routes data: FIP → FIU under consent
- Cannot store or use the data itself
- Examples: Finvu, OneMoney, Sahamati network
AI Model Owner — Governance Focus
- Receives AA-consented financial data
- Builds and runs AI models on this data
- MRMF-bound if FIU is RBI-regulated (bank, NBFC)
- DPDP-bound for all personal data use
- Constrained to consented purpose
Five Novel AI Governance Requirements from the AA Framework
Consent-Artefact-Aware AI Pipelines
The AA Framework's consent artefact is a machine-readable structured object specifying: the FIU entity, the purpose (e.g., 'loan assessment'), the data elements permitted, the data period (from/to dates), the consent expiry date, and the frequency of data access. FIU AI pipelines must be consent-artefact-aware — they must programmatically enforce the consent artefact's constraints. An AI credit scoring pipeline that receives bank statement data under a consent artefact specifying "loan assessment, 3 months statements, expires 30 days" must not use that data beyond the consent period, beyond the permitted purpose, or for additional AI training beyond the consented use case. This is a new kind of AI system requirement: the AI pipeline needs an access control layer that reads the consent artefact and enforces its boundaries at data ingestion, model inference, and model training stages.
DPDP Purpose Limitation for AI Training
DPDP Act 2023 purpose limitation means an FIU cannot use AA-consented financial data obtained for "loan assessment" to train a general credit scoring model, even if the immediate use was within the consented purpose. Model training is a separate processing purpose. FIUs building AI models on AA-consented data must establish separate, specific consent for model training purposes — or demonstrate that the training purpose is fairly contained within the original consented purpose. This requires a consent architecture review: map each AA-consented dataset to each AI training use and assess purpose alignment. Any gap between the consented purpose and the training use requires either a new consent or a decision to exclude that data from training.
Consent Revocation — Model Training Exposure
When a customer revokes AA consent, the FIU must stop using that customer's data. But if the FIU's AI model was trained on that customer's bank statement data, the revocation creates the derivation principle question: does the trained model retain a representation of the revoked customer's data that the FIU is no longer entitled to use? This is an emerging legal question — similar to the "right to be forgotten" debate in EU AI governance, which remains unresolved in India's DPDP Act. The prudent approach: FIUs should maintain training data provenance records that allow them to identify which model versions were trained on data that was subsequently revoked, and assess whether retraining is required on revocation at scale. For large-scale consent revocation (e.g., a FIP exiting the AA ecosystem), mass retraining obligations could be significant.
MRMF Model Governance for FIU Credit AI
FIUs that are RBI-regulated entities (banks, NBFCs) are MRMF-bound. Their AI credit scoring models using AA-consented data must comply with MRMF's full model governance framework: model documentation (training data provenance including AA consent records, feature documentation, architecture), independent validation, continuous performance monitoring, fairness assessment (RBI FREE-AI Fairness Sutra for caste/religion/language proxy discrimination in credit decisions), explainability for adverse decisions, and kill switch capability. The AA data source creates an additional documentation requirement: the model's training data provenance must document which data came through AA consent flows, which FIPs provided it, and under what consent artefact parameters.
Explainability for AA-Enabled Credit Denial
DPDP Act 2023 gives data principals the right to understand automated decisions made about them using their personal data. A customer who consented (through AA) to share their bank statements for loan assessment, and was then denied credit by an AI model analyzing those statements, has the right to an explanation of why the AI reached that decision — what features of their financial data drove the adverse outcome. This right is more specific in the AA context than in traditional credit: the borrower knows exactly what data was used (the AA-consented dataset), so the explanation must be specific to that data. Vague explanations ("insufficient credit history") that do not trace to the AA-consented data features will not satisfy DPDP's explainability right. FIUs must implement model explainability that can trace credit denial reasons to specific features in the AA-consented financial data.
AA-Enabled Credit for First-Time Formal Borrowers: Fairness Obligations Under FREE-AI and DPDP
The populations most likely to use AA-enabled credit scoring are those without traditional credit bureau histories: first-time formal borrowers in Tier 2/3/4 geographies, MSME owners, gig economy workers, women borrowers in self-help group programs, and agricultural sector borrowers. These populations are also the most likely to be affected by proxy discrimination in AI credit models using bank statement data.
- Transaction pattern proxy discrimination: bank statement data contains transaction patterns that correlate with caste, religion, and language — salary transfers (which community employer, which sector), merchant transactions (dargah/temple payments), regional transfer patterns, mobile recharge patterns (prepaid vs postpaid as income proxy). An AI model trained on bank statement features for credit scoring may encode these proxies. RBI FREE-AI's Fairness Sutra requires FIU AI models to test for and mitigate disparate impact on protected groups. INDIC-BIAS (IIIT Hyderabad, 85 identity groups) provides the testing framework for India-specific proxy discrimination.
- Data sparsity disparity: underserved borrowers have shorter banking histories and lower transaction volumes. AI models trained primarily on data-rich borrowers underperform for data-sparse borrowers — not because of risk, but because of signal scarcity. This creates disparate impact in credit decisions for the population AA was designed to reach. MRMF's performance monitoring requirements should explicitly include performance segmentation by borrower profile (urban/rural, banking history length, transaction volume quartile) to detect and remediate this disparity.
- GST return data in AA pipelines: AA enables GST return data from GSTIN to flow to FIUs for MSME credit scoring. GST returns contain business sector, location, and supplier/customer network information that may correlate with community identity in specific sectors and geographies. MSME credit AI using AA-consented GST data faces the same proxy discrimination risk as bank statement AI, with the additional dimension of business community identity proxies.