You fill in your PAN, verify your phone number, and then the app asks you to connect your bank account. Plenty of people pause at that screen, and they are right to. Handing over months of transactions feels very different from sharing a payslip. It helps to know why the lender wants this data, how it reaches them and what they do with it once it arrives.
Why the lender wants your bank data
Every lender is trying to answer one question: can this person repay? A payslip or an income tax return gives part of the answer, but both are snapshots, and both may be out of date by the time you apply. A bank statement shows what actually happened. It records when money came in, where it went and how close the balance ran to zero before the next credit.
Speed is the other reason. An instant loan is usually decided in minutes, often without a credit officer reading through PDFs. The system needs your transactions in a clean, structured format it can analyse straight away, which is why the bank access request comes so early in the application.
How the connection works
In most cases, the data now travels through the Account Aggregator framework. Account Aggregators are companies licensed by the Reserve Bank of India to move financial data between institutions with your consent. When you choose this route, a consent screen shows which account will be shared, how many months of history, how long the consent lasts and how often the lender can fetch data. You approve it, and the bank sends the data to the lender in encrypted form. The aggregator passes it on but cannot read it.
The alternative is uploading a PDF statement, which the lender’s software then reads. Either way, you should never type your net banking password into a lending app or share an OTP from your bank with anyone who calls about a loan. A legitimate consent flow does not need your password.
What the lender actually reads
Income comes first. The system looks for salary credits: how much arrives, on what date and whether the narration shows the same employer each month. For self-employed borrowers, it looks at how steady business receipts are across the months shared.
Next come your obligations. EMIs usually appear as NACH debits, and credit card payments and rent transfers are easy to spot too. Bounced EMIs or return charges stand out quickly and count against you. The checks are much the same whether you borrow a small amount for a few weeks through a pocket loan app or a larger sum from a bank. Only the depth of the review changes.
Then there is behaviour. Lenders look at your average balance, how often the account nearly empties before payday and whether money from other lending apps arrives and leaves in quick cycles. That last pattern can suggest someone taking new loans to repay old ones, and it is one of the clearest warning signs a lender can find in a statement. The lender also confirms that the account is in your own name and matches your KYC details, because under RBI rules the loan has to be paid straight into an account you hold.
What it should not access
Consent has limits. The lender receives only the account, the period and the data type you approved on the consent screen, not your whole banking history. RBI’s digital lending rules also limit which phone permissions a lending app can ask for. Apps should not read your contacts, call logs or files and media, and access to the camera, microphone or location should be one-time and only for purposes such as KYC, with your consent. A lender asking for your contact list is a red flag, however the request is worded.
The same rules require a lender to tell you what data it collects and why, and to let you withdraw consent and ask for your data to be deleted. You can also check an app before sharing anything. The regulated bank or NBFC behind it must list the lending apps it works with on its own website, and RBI maintains a public list of the lending apps that regulated lenders have reported to it. If the app is missing from both, stop there.
Before you tap “allow”
Read the consent screen properly, because most people approve it in two seconds. Check the period first. Six to twelve months of history is common for a loan, and a request for several years deserves a question. Check the frequency too. A one-time fetch is enough for most loan decisions, so if the consent allows the lender to pull data every month for a year, ask why.
Share only the account that actually receives your income. If you keep a separate account for savings or family transfers, the lender rarely needs it, and connecting it only adds noise to your assessment. Once the loan is approved or declined, open the Account Aggregator app you used and check which consents are still active. Revoking one usually takes a few taps, and it keeps a one-off loan application from turning into a standing view of your finances.