Linking a budgeting app to your bank used to mean handing over your online banking username and password and letting the app log in as you. Open banking replaces that with a permission system: you approve a specific app to see specific data, or to start a payment, and the bank gives it limited access without ever revealing your credentials.
How a connection works
The flow looks much the same across countries. You choose a service, such as a budgeting app or a lender, and decide to connect an account. The service sends you to your own bank’s website or app, where you sign in using the bank’s normal security. The bank shows what the service is asking for and you approve. The bank then lets the service access the data, or start the payment, through a standardized interface called an API, within the limits you approved. You can usually review and withdraw the permission later.
In the UK’s terminology, two types of third-party provider use these interfaces: account information service providers, which read data for services such as budgeting, and payment initiation service providers, which start payments from your account without a card.
Why the UK and EU have it
In both places, regulators created it. In the UK, the Competition and Markets Authority required the nine largest retail banks to open up customer data using secure standards, and to create an independent body to build the common interface. The standardized read and write interfaces were required to be working by 13 January 2018. The legal right for authorized providers to access payment accounts, with the customer’s explicit consent, comes from the Payment Services Regulations 2017, which implemented the EU’s second Payment Services Directive. UK government documents have counted more than 330 regulated firms in the ecosystem.
The European rules went a step further on the old practice. The European Banking Authority’s technical standards, which have applied since 14 September 2019, require banks to offer a dedicated or adapted interface for these providers, and the authority concluded that access without identification, often called screen scraping, would no longer be allowed once the transition period ended.
The United States
The US took a different path. Instead of a market-wide mandate, the Consumer Financial Protection Bureau finalized a personal financial data rights rule in October 2024, with compliance dates staggered by institution size. It has not settled. The bureau opened a reconsideration in August 2025, and a court order has pushed the compliance dates back, with further changes expected. Current status is best checked with the bureau directly, and in the meantime many US banks and data aggregators operate under their own agreements.
What it enables
| Use | What happens |
|---|---|
| Budgeting and money management | Accounts from several banks appear in one view |
| Lending and affordability checks | Income and spending data speed up decisions |
| Payments from your account | A merchant is paid directly, without a card |
| Verification | An app confirms account ownership for sign-ups and payouts |
| Business accounting | Bank transactions flow into bookkeeping software |
Account-to-account payments can run on the real-time networks described in our guide to instant payments.
Staying safe
Permissioned access is safer than sharing a password, but the risks have shifted rather than vanished.
Scammers can imitate a legitimate service to trick people into approving a connection, which makes the phishing techniques described in our article on AI-assisted phishing relevant here. Old permissions can stay active long after you stop using a service. And what a company does with data once it has it is governed by its privacy policy and the law, not by the technical connection.
Sensible habits follow from that. Use services that are authorized where you live and check official registers if unsure. Start from the app you trust, and make sure the sign-in page belongs to your bank. Read the consent screen for what data is requested, for how long and for what purpose. Review active connections in your banking app now and then. Protect your own sign-in with strong methods such as passkeys, and never share one-time codes with anyone who contacts you.
Coverage is uneven, since not every bank or account type is included, and connections can break when banks change their systems. The idea behind it is simple: your financial data is yours, and you should be able to decide who sees it.
This is general information, not financial, investment, tax or legal advice.
