Open banking, explained — and why it is safe

What open banking replaced

Before open banking, an app that wanted to see your transactions had one option: ask for your internet banking username and password and log in as you. That pattern is called screen scraping, and it worked, but it asked you to hand over the keys to everything in order to share one thing. It also gave you no way to see what the app was doing, and no way to switch it off except by changing your password.

Open banking replaces that with a regulated handshake. You authorise the connection inside your own bank’s official login flow, the bank issues the app a limited, revocable permission, and no credential ever passes through the app at all. The improvement is not only technical — it is that the arrangement becomes visible and reversible, listed in your banking app alongside every other permission you have granted.

The result is the same useful outcome with a much smaller surface: an app that can read what you agreed to share, for as long as you agreed to share it, and nothing else. That is why the connection is worth understanding before you make one — not because it is risky, but because knowing what it can and cannot do is what makes the choice an easy one.

How the connection actually works, step by step

Start the connection in the app and pick your bank. The app does not ask for your details; it redirects you to your bank’s own authorisation page or app, where the address bar shows your bank’s domain. That redirect is the whole security model in one step — you type your credentials only where you always type them.

Your bank then shows you exactly what is being requested: which accounts, which kinds of data, and for how long. You approve or decline, account by account. If you approve, your bank sends the app a token — a limited permission slip that names the app, the accounts and the scope, and expires on a date. The app stores the token and never sees the password that produced it.

From then on the app uses that token to request transactions on a schedule, and the ongoing sync is simply that request repeating. If you change your banking password, the token keeps working, because it was never derived from your password in the first place.

Fin sits outside these accreditation regimes, and is upfront about it. Bank data reaches Fin through a read-only feed you connect yourself with a key you own — BankSync or SimpleFIN, or Akahu, Up Bank, Monzo or Starling in the desktop app — or through a CSV or XLSX statement or a Google Sheet feed. The connection flow and the ongoing sync describe how that works in practice; either way, your banking password is never handed to Fin.

What "read-only" means in practice

A read-only connection can see transaction history and balances on the accounts you named. It cannot move money, set up a payment, add a payee, change your details, or open or close anything. It is the same category of access as looking at a statement, and the payment side of open banking is a separate permission with its own, much louder authorisation step that a data connection never touches.

It is also narrower than "your bank". You approve specific accounts, so an everyday account can be shared while a mortgage offset or a joint account stays out of scope entirely. Adding another account later is a new approval rather than an extension of the old one, which is worth knowing if you expect a second account to appear on its own and it does not.

What the app receives is descriptive rather than complete: dates, amounts, balances and the descriptor text the bank puts on each line. That descriptor is often abbreviated and occasionally cryptic, which is a genuine limitation rather than a security one — what a tool can read from a transaction is bounded by what the bank chose to send.

Who is allowed to ask

Access is not open to anyone who wants to build it. In every jurisdiction with a live regime, the app on the other end has to be authorised, and the authorisation carries obligations about security, data handling, complaints and breach reporting. That gate is what turns "an app can read your bank data" from a worrying sentence into an ordinary one.

The shape varies by country. Australia runs the Consumer Data Right, with data recipients accredited by the competition regulator and privacy obligations overseen alongside it. The United Kingdom built its regime under a competition order, with the firms involved authorised by the financial regulator. The European Union set the rules through payment services legislation that obliges banks to offer regulated third parties access. India uses a licensed Account Aggregator sitting between you and your institutions, and Brazil runs a central-bank-led Open Finance programme.

Others are still arriving. Canada has been legislating a consumer-driven banking framework, New Zealand has been building its own regime, and the United States has been developing rules for personal financial data rights under its consumer protection law. Where a regime is not yet live, connections in that market usually still run through an established data provider under contract with the banks, which is a different legal basis with a similar practical effect.

Consent: scope, duration and how to switch it off

Consent under these regimes is specific rather than general. It names the data, the purpose and a period — often up to a year, sometimes shorter — and it expires on its own unless you renew it. That expiry is a feature: a connection you set up and forgot does not quietly run forever, which is the failure mode a shared password had.

You can revoke it from either end, and both work. In the app, disconnecting the account stops the requests and, under most regimes, obliges the provider to delete or de-identify the data it collected under that consent. In your banking app, there is a list of the data-sharing arrangements you have granted, and withdrawing one there stops the token from working immediately regardless of what the app does.

It is worth checking that list once a year in the same spirit as checking your subscriptions — not because anything is wrong, but because the arrangements are yours to hold. If you want to know precisely what happens to data on your side of that boundary, how the data is stored and protected sets it out, and running the software entirely on your own machine is available if you would rather no connection existed at all.

When open banking is not available

Coverage is real but not universal. Smaller institutions, some business accounts, most payment platforms and nearly every credit product outside the major banks sit outside the regimes today, and a regime that covers personal accounts does not always cover business ones. That gap is normal and worth planning around rather than waiting out.

The fallback is your own statements. Every bank in the world will give you an export — CSV, Excel, OFX or a PDF — and a good tool should read those as first-class input rather than as a degraded mode. Importing a long stretch of statements gets an account that no feed reaches to exactly the same place as one that a feed does reach, which matters when the account outside the regime is the one your business actually runs on.

Whichever route the data takes, the value only appears once it is sorted, and that is where the habit side begins: bookkeeping for freelancers covers what to do with a feed once you have one. A connection is a starting point rather than an outcome — the point of removing the typing is that the deciding gets your attention instead.