Let the story behind a payment travel.
FromA payment event→ToA consented evidence record
“Arjun paid” is the last line of a much longer story that the network already holds. This shift asks whether participants could own that story and share it, by consent, with any provider they choose.
Four cycles of evidence instead of none
By her fourth cycle, Meera wants to finance a larger order through a trade-finance provider she has never worked with illustrative. The network holds the whole history: her decisions, the supplier, Arjun’s commitments, Farida’s fulfilment records and the retailers’ payments.
She chooses to share it with the new provider, for this purpose and for a set period. The provider starts from four cycles of evidence instead of none.
From a payment to the chain behind it
“Arjun paid ₹X.”
The chain of decisions and commitments behind the payment
| Today | On an open network |
|---|---|
| The payment | The chain behind it |
| Data held by each institution | Evidence held and shared by the participant |
| Periodic review | Continuous underwriting |
The participant owns the story. The provider reads it only when invited.
How it would work
Consented evidence sharing. Participants own the evidence their transactions generate and share it by consent: a stated purpose, a named provider and a set period, with clear rules for correction and retention.
That makes continuous underwriting possible, and it starts a flywheel:
- More trade on the network
- more evidence
- better understanding of risk
- better use of capital
- more financeable trade
Go deeper
What already exists
Consent-based data sharing is already live in India’s finance. Under the Account Aggregator framework, people share financial data between institutions only with their consent, and can give or revoke access at any time[1]. Sahamati estimates that data shared this way enabled about ₹3.82 lakh crore of loan disbursals, across 3.68 crore loans, in FY26[2]. This shift extends the principle from financial data to commercial evidence.
Scope. Account Aggregator covers regulated financial data. We haven’t checked whether it, or a data-protection consent manager, could carry commercial evidence such as fulfilment records.
Rules
India’s data-protection law requires consent for a lawful purpose, lets consent be withdrawn at any point and gives rights of correction and erasure[3]. The Rules under it were notified on 14 November 2025, and most obligations take effect around May 2027[4].
The layer carries evidence, not money. Under the Reserve Bank’s digital-lending rules, a loan is disbursed to the borrower’s own account and repaid directly into the lender’s, with no pass-through or pool account of a third party[5].
Getting it right
Make consent real: specific, time-limited and easy to withdraw. A provider should say what it would offer without the evidence, so that sharing is a choice and not a toll.
Let people correct the record. A wrong entry that follows someone does harm.
Keep evidence and money apart.
Who it helps. Meera walks into a new provider’s office with four cycles of history instead of an introduction. Providers decide faster and with more to go on. Arjun and Farida can build records of their own.
What could go wrong
- Consent that isn’t really a choice.If finance is available only to those who share everything, sharing is not voluntary, so providers state what they would offer without it.
- A wrong record that follows someone.Errors travel, so participants can correct and dispute entries.
- A staged history.A record can be manufactured, so evidence comes from the parties who would know (Shift 6).
- Sensitive commercial data.Shared records are limited to a stated purpose and period.
How we’d test it
With participants who agree to share, give a first-time provider the shared record.
- The test
- Shared record against none
- What we would measure
- Compare decision time and loss prediction with first-time relationships that start from nothing, and check that participants actually use their consent controls.
- What would end the idea
- Shared evidence doesn’t shorten decisions or improve loss prediction for first-time providers, or participants don’t use their consent controls.
Sources
- [1]Sahamati, What is an Account Aggregator?Checked
- [2]IANS, India’s Account Aggregator ecosystem drives Rs 3.82 lakh crore loans in FY26 (27 August 2026), reporting a Sahamati reportChecked; Sahamati’s own estimates, as reported by a news agency
- [3]PRS Legislative Research, The Digital Personal Data Protection Bill, 2023Checked; a summary of the Bill as passed by Parliament in August 2023
- [4]SCC Online, Digital Personal Data Protection Rules, 2025: key highlights (26 December 2025)Checked via a legal summary; the Rules’ own text not read
- [5]Reserve Bank of India, Reserve Bank of India (Digital Lending) Directions, 2025 (RBI/2025-26/36, 8 May 2025), paragraph 9Checked; the Reserve Bank’s text
Spotted a source we missed or a rule we misread? Tell us what we got wrong.
Now the evidence can travel. Can the risk travel with it?