AA Community Guidelines - Consent Request Management

Once such a citizen chooses the AA he/she wishes to use, the FIU may send a consent request to that AA, using the “Mobile Number@AA_Identifier” in the “Customer Identifier” attribute of the consent request.

This guideline is anchored on the principle that a citizen, wishing to use an AA service, is in possession of a mobile device and an active SIM card.

One can anchor this too on the principle that a corporate citizen, wishing to use an AA service, must be in possession of a PAN. The same attribute MUST then be part of the corporate citizen VUA issuance (registration) workflow of every AA.

This is to be discussed further in the ecosystem.

It is understood that there may be adverse consequences in terms of service availability from an FIU, if the consent provided to that FIU is revoked. The same is expected to be dealt with separately between the FIU and the FIU’s customer.

All consent requests placed in the AA ecosystem are deemed revocable.

This is however different from the “Data storage” policy that the FIU has. This policy stems from existing regulations and defines the maximum period that the FIU is expected to keep the data, to aid in any queries, grievances or disputes that may arise later, much beyond the period for which the data is being processed.

The AA guidelines do not, in any manner, influence existing data storage policies.

As of August 2022, this feature is not currently implemented in the AA ecosystem. However, this needs to be discussed further and implemented.

As of August 2022, this feature is not currently implemented in the AA ecosystem. However, this needs to be discussed further and implemented.

TERM-DEPOSIT (e.g.)

E.g. If on August 1st 2022, the consent is being sought, for data to be fetched for 6 months prior and till 12 months into the future, the FI Data Range will be “From Jan 1st 2022” and “To July 31st 2023”.

A unit of “2” and Value of “Day” is to be interpreted as “Twice a day”.

The computation of time-units is to follow “Calendar” time, i.e. a day is to be deemed as starting 12 midnight, an hour is to be defined as per the system clock, a month is to be defined as per the system calendar.

Thus, if “Twice an hour” is the frequency for which consent is provided at 10:30 AM, it implies “two times” in each hour, starting 10-11 AM, 11-12 Noon and so on.

This interpretation is true for both Data Life and Frequency attributes.

It is therefore best for the AA to enable a simple “Reject” option, which the citizen can exercise in case he/she does not agree to any parameter value in the consent request placed.

The FIU is then expected to send a fresh, corrected consent request. The interaction between the FIU and the customer, to do so, is outside of the purview of the AA’s role.

In case different digital channels offer a different duration currently, the maximum available duration is to be taken as a benchmark for a citizen to avail of, via an AA as well.

This is to be discussed within the community.

6.5 At the time of obtaining consent, the Account Aggregator shall inform the customer of all necessary attributes to be contained in the consent artefact as per paragraph 6.3 above and the right of the customer to file complaints with relevant authorities in case of non-redressal of grievances.

The “inform customer of all necessary attributes” is to be implemented on AA client (web app, mobile app, e.g.) screens in a manner which neither overwhelms the citizen nor makes it incomprehensible.

The community has devised a draft set of norms which have to be Finalised.