Authenticating the customer while authorising the customer’s act of approving (or rejecting) a consent request is the prime responsibility of an AA as an RBI-licensed entity.
Once the AA has authenticated the customer (employing multi-factor authentication on the AA client the customer is using, be it an AA mobile app, web app or an SDK), the AA authorises the customer’s approval of the consent request. It then creates a Consent Artefact and passes it to the FIP through the standard FIP API exposed by the FIP.
The FIP’s role is only to authenticate and authorise the AA (using the API key issued by the FIP to the AA) and to further verify the integrity of the message contents by validating the digital signature received as part of the contents.
The FIP trusts the AA to have done the necessary customer authentication for authorising consent request approval as a fundamental aspect of the AA architecture.
In the AA ecosystem, approval from the customer is sought by AA through the APP or web interface. Only after the customer approves will AA generate the signed consent artefact, which will then be posted to the FIP.