For an existing customer, an account aggregator can rely on FIU’s authentication by an account aggregator. For example, for an existing customer, if an FIU places a consent request and uses an AA client to approve consent, AAs must verify the customer first before allowing the customer to approve/reject the consent request. As per ReBIT, Account Aggregators must independently authenticate the customer’s identity during any interaction with the customer, be it a first-time interaction or a repeat interaction. The AA cannot delegate authentication to the FIU.