Account Aggregator vs. PDF Bank Statements: What Lenders Should Use for Underwriting

In financial year 2024-25, loans worth about ₹1.07 lakh crore were disbursed across 12.2 million loans using data shared through India’s Account Aggregator framework, according to the industry alliance Sahamati. NBFCs alone accounted for roughly 60% of completed consents.

Yet in most credit teams, the PDF bank statement has not gone away. Borrowers drop off during consent, some banks are not fully live, and many files still arrive as password-protected PDFs from DSAs and partners.

So the real question for lenders is not which source wins. It is when to use each, and how to combine them. This guide explains how the Account Aggregator framework works, compares it with PDF statements on the factors that matter in underwriting, and sets out a practical hybrid strategy.

What Is an Account Aggregator?

An account aggregator is an RBI-regulated NBFC that moves a customer’s financial data from one institution to another, only with the customer’s explicit consent. The framework was created under the RBI’s Master Direction on NBFC-Account Aggregators, issued in September 2016.

Three parties are involved:

• Financial Information Providers (FIPs) hold the data, such as banks, mutual funds, and insurers.
• Financial Information Users (FIUs) request the data, such as lenders and wealth managers.
• The account aggregator carries the data between them based on the customer’s consent.

The aggregator cannot read or store the data it carries. It is designed to be data-blind, which separates it from screen-scraping or credential-sharing methods.

How the Account Aggregator Framework Works

1. Consent request. The lender, as FIU, raises a request specifying the purpose, the accounts, the date range, how often data may be fetched, and how long it will be kept.
2. Customer approval. The borrower logs in to their chosen aggregator, links their bank accounts, and approves the consent. This creates a digital consent artefact.
3. Data fetch. The bank, as FIP, sends the requested data, encrypted and digitally signed, through the aggregator.
4. Delivery and use. The lender receives structured data, usually JSON, verifies the signature and analyses it.
5. Ongoing access, if consented. For monitoring use cases, the consent can allow periodic fetches during the loan tenure.

Because the data is signed by the bank and never passes through the borrower’s hands as a file, it cannot be edited in transit.

Where Adoption Stands

Adoption has grown quickly. According to the Department of Financial Services, citing Sahamati data as of 30 September 2025:

• More than 2.61 billion financial accounts were enabled to share data on the framework.
• 223.32 million users had linked accounts.
• 126 financial institutions were live as both FIP and FIU.
• Seventeen companies held RBI registration as account aggregators.

By December 2025, Sahamati reported more than 34 crore consents fulfilled and over 24 crore individuals using the framework.

How PDF Bank Statements Fit In

A PDF bank statement is downloaded by the borrower from net banking or obtained from a branch, then shared with the lender directly or through an intermediary.

It remains the default for several reasons. Every bank produces one, borrowers understand it, DSA and partner workflows are built around it, and it is available even when an account aggregator journey fails.

Its weakness is integrity. Because the file passes through the borrower’s hands, it can be edited, stitched,d or fabricated. That is why PDF analysis must be paired with tampering detection, as covered in our guide to detecting fake bank statements.

Account Aggregator vs PDF: Head-to-Head Comparison

Factor	Account Aggregator data	PDF bank statement
Data integrity	Digitally signed by the bank; tampering in transit is not practical	Can be edited, stitched or fabricated; needs integrity checks
Format	Structured JSON in a standard schema	Hundreds of bank layouts; needs extraction and OCR
Coverage	Depends on the bank being live and stable as an FIP	Available from every bank
Borrower effort	Aggregator registration, account linking and consent approval	Download and upload a file
Completion rate	Drop-offs at linking and consent steps; varies by bank and journey	High, since borrowers are used to it
History depth	Limited to the range requested and what the bank provides	Whatever the borrower downloads
Ongoing monitoring	Possible through periodic fetch, if consented	Requires the borrower to resubmit
Consent and privacy	Purpose, duration and retention defined in a consent artefact	Consent captured separately by the lender
Best fit	High-integrity underwriting and monitoring	Universal fallback, DSA and partner channels

The pattern is clear. Account aggregator data wins on integrity, structure and monitoring. PDFs win on coverage and borrower familiarity.

The Limits of Account Aggregator Data

AA data is not a complete answer, and lenders should design for its gaps.

• Consent journey drop-off. Every added step loses some borrowers. Industry discussions on improving AA success rates show that completion remains a live operational challenge.
• Bank-side reliability. FIP downtime or slow responses can fail a fetch at the moment of application.
• Incomplete coverage. Smaller cooperative banks and some account types are less consistently available.
• Multiple accounts. Borrowers may link only the account they choose, leaving others unseen.
• It does not stop behavioural fraud. Window dressing, circular transfers and mule activity occur inside genuine accounts. AA data proves the statement is real, not that the activity is honest. See our guide to mule accounts.
• It still needs analysis. Structured data still needs categorisation, metric computation, and policy rules before it informs a decision.

A Practical Hybrid Strategy for Lenders

Most lenders get the best outcome by treating the two sources as complementary.

1. Offer AA First, With a PDF Fallback

Present the account aggregator route as the default, especially in digital journeys. If consent fails or the bank is unavailable, accept a PDF without forcing the borrower to restart.

2. Apply Tampering Checks to Every PDF

PDFs should never go straight into underwriting. Run integrity checks on metadata, balance arithmetic, and narration formats before analysis.

3. Use AA to Verify High-Risk PDFs

For larger tickets, DSA-sourced files or PDFs that raise integrity flags, request an AA fetch for the same period. A mismatch between the two is strong evidence of manipulation.

4. Run One Analysis Engine for Both

Use a bank statement analyser that produces identical metrics, including FOIR inputs, ABB and bounce counts, whether the input is AA JSON or a PDF. Otherwise, credit policy is applied inconsistently across channels.

5. Use AA Consent for Monitoring

Where the borrower agrees, periodic AA fetches during the loan tenure provide early warning of stress without asking for new documents.

Regulatory Alignment

The RBI (Digital Lending) Directions, 2025 align lenders’ data handling with the Digital Personal Data Protection Act, 2023. The AA consent artefact, which records purpose, scope, and retention, makes that alignment easier to demonstrate. For PDFs, lenders need their own clear consent capture and retention policy.

Key Takeaways

• The Account Aggregator framework delivers bank-signed, structured data with explicit, scoped consent.
• Adoption is substantial: by September 2025, more than 2.61 billion accounts were enabled, and over 223 million users had linked accounts.
• AA data wins on integrity and monitoring; PDFs win on coverage and completion.
• AA proves a statement is genuine, but not that its activity is honest. Behavioural analysis is still required.
• The strongest approach is AA first, PDF fallback, tampering checks on every PDF, and one analysis engine for both.

Frequently Asked Questions

Conclusion

The account aggregator framework has given Indian lenders something they never had at scale: verified, consented, structured bank data on demand. It has not made the PDF obsolete, and it does not remove the need for careful analysis.

The lenders who benefit most will use AA wherever borrowers complete it, verify PDFs rigorously wherever they do not, and run both through the same analytical lens.

FinEye analyses Account Aggregator data and PDF statements in one consistent report, with tampering detection on every PDF. Book a demo to see both inputs side by side.