Exploring the account aggregator framework : potential for agency and inclusion

Abstract

Data sharing has become an integral part of modern-day life, even so in the financial sector, as it enables the provision of personalized and efficient financial services. However, concerns regarding data privacy, security, and consent management have also emerged. The Account Aggregator (AA) framework has emerged as a potential solution to address these challenges by facilitating secure and controlled data sharing among financial institutions. This dissertation aims to examine the role of consent management, and the implications of the Account Aggregator framework on agency and financial inclusion.

The research begins by examining the manifestation of the Principal-Agent Problem within the AA framework. Through a comprehensive analysis of the roles and relationships of data principals, Financial Information Providers (FIPs), and Financial Information Users (FIUs), it becomes evident that the data principal is not treated as the principal in this ecosystem. This asymmetry of power raises concerns regarding data ownership, control, and the potential for exploitation.

Furthermore, the study explores the regulatory and policy implications of the AA framework. The research also highlights the limitations and feasibility issues faced by the AA framework in fulfilling its goals of providing agency and financial inclusion. High dormancy of bank accounts and the absence of comprehensive financial histories in formal settings pose significant barriers to achieving true financial inclusion. Additionally, the lack of participation from a diverse range of FIPs undermines the framework's ability to serve the needs of all stakeholders.

Based on the findings, this dissertation recommends several measures to address the identified challenges. These include establishing accountability mechanisms for FIUs, clarifying the fiduciary responsibilities of Account Aggregators, establishing market safeguards to balance power dynamics, creating a more inclusive consent artefact, and developing comprehensive data protection laws that govern the operation of the AA ecosystem.