How It Works

Step 1: Consent Initiation by FIU

What Happens: A financial institution (FIU) — such as an NBFC lending platform or a bank's loan processing system — initiates a customer's consent request via OMS AA's API. The FIU specifies:

• Which financial data categories are needed (bank statements, income, investment details, etc.)
• The purpose(s) of data access (loan underwriting, insurance underwriting, etc.)
• The time period for which the FIU needs the data
• The validity period for the consent (e.g., 1 year, with auto-expiry)

• Specificity: Only the data needed for the stated purpose is requested, not blanket access
• Clarity: Purpose is clearly articulated in plain language
• Itemization: Each data category is listed separately so the customer sees exactly what's being requested

Step 2: Consent Presentation to Customer

What Happens: OMS AA displays the consent request to the customer via a secure, user-friendly consent interface. The consent artifact includes:

• Itemized Data Request: A clear list of every data category being requested (e.g., "Bank Statement (6 months)", "Income Details", "Loan Account Summary")
• Purpose Disclosure: Why the FIU needs this data (e.g., "To process your loan application" or "To verify your KYC information")
• Data Source Selection: If the customer has multiple accounts at different banks, they select which accounts to share
• Validity Period: How long this consent remains valid (e.g., "Valid for 1 year, or until revoked")
• Withdrawal Notice: Clear information that consent can be revoked anytime, instantly
• FIU Identity: Clear identification of the institution requesting the data

• Clear Affirmative Action: Customers must actively select each account and click "Approve" to give consent. No pre-ticked boxes, no bundled consent, no default acceptance.
• Plain Language: All disclosures are in simple English and regional languages as applicable.
• User Rights Information: Embedded reference to customer's rights under Sec 11-14 (access, correction, erasure, grievance, nomination).

• TLS encrypted connection
• Session timeout after inactivity

Step 3: Customer Approves Consent

What Happens: The customer reviews the consent request and makes a decision:

• Approve: Customer selects accounts to share and clicks “Approve” option
• Decline: Customer rejects the consent request entirely
• Consent can either be “Paused” or “Revoked”

• Timestamp of consent
• Exact data categories approved
• Selected accounts
• Validity period

This record is immutable and available for audit by RBI, DPBI, or the customer.

Step 4: OMS AA Facilitates Data Sharing from FIP

What Happens (Automated): Once consent is approved, OMS AA:

1. Sends a consent notification to the relevant Financial Information Provider (FIP), e.g., the customer's bank
2. The FIP verifies the consent (checks the digital signature, confirms the customer authorized it)
3. The FIP prepares the requested financial data from its systems
4. The data is transmitted to OMS AA via API using the ReBIT-specified protocols (from RBI AA Master Directions, 2025)

• Does NOT store or cache the customer's financial data
• Does NOT process, analyze, or modify the data
• Does NOT retain copies after the FIU receives it
• Does NOT use the data for any purpose other than this specific transfer

• “Customer information never resides with the NBFC-AA” (Para 14(7))
• “No use or access beyond the customer's explicitly requested business” (Para 36)

Step 5: OMS AA Presents Data to FIU

What Happens: OMS AA:

1. Receives the financial data from the FIP(s)
2. Transmits it to the FIU

• Every consent-based session is logged with timestamp, FIP, FIU, customer ID, and data categories
• Logs are maintained and retained per regulatory requirements
• Real-time monitoring for anomalies or unauthorized access attempts

Compliance Note (Para 8(4)): This is "presentation"—making the data available in a usable format, not analyzing or processing it.

Step 6: FIU Uses Data for Stated Purpose

What Happens: The FIU (bank, NBFC, fintech) receives the consolidated financial data and uses it for the purpose stated in the consent:

• Loan Underwriting: Assess creditworthiness based on income, existing liabilities, asset details
• KYC Refresh: Update customer information for regulatory compliance
• Insurance Underwriting: Verify income and asset details for premium calculation
• Credit Decisioning: Feed data into risk models for approval/rejection decision
• Customer Onboarding: Verify identity and financial capacity

• Use the data for any purpose other than the consented one
• Share the data with third parties without explicit customer consent
• Retain the data beyond the consent validity period
• Combine the data with non-consensual sources for unauthorized analysis

Compliance Note: The FIU is now a "Data Fiduciary" under the DPDP Act, 2023 and must comply with Sec 8 (data security, accuracy, retention, and erasure requirements).