Sharing your bank account with an app: how open banking access works and how to revoke it

Sooner or later an app asks to connect to a bank account. A budgeting app wants the transactions so it can sort them into categories, an accounting tool wants them to match payments against invoices, and a lender wants to see what comes in each month. The request usually arrives as a button marked with the bank’s logo and a screen full of permissions that most people scroll past.

In the European Union those connections are regulated, and the rules are the main reason it is now safe to say yes to some of them. They also make it possible to say no later.

Reading an account and paying from it

The revised Payment Services Directive, PSD2, which has applied since January 2018, created two separate services that a company other than the bank can offer.

• Account information: the provider may read balances and transaction history for the accounts the customer picks. It cannot move money.
• Payment initiation: the provider may start a payment from the account, one the customer approves with the bank’s usual confirmation.

A company offering either one has to be authorised or registered by a financial regulator, and it may use the data only for the service the customer asked for. Most connections an ordinary user meets are the first kind. A budgeting app has no reason to ask for the second, and a request for it deserves a closer look.

How the connection is made

A regulated provider has to keep the bank login out of reach of everyone else, the app that asked for the connection included. The customer picks the bank, signs in through a screen run by the bank or by the provider, and confirms with the same second step the bank always asks for, such as a code in the banking app. The provider then reads the account through an interface the bank is required to offer.

Banks build those interfaces to a technical standard, and in Poland many of them use a common one, PolishAPI, drawn up by the Polish Bank Association with banks, credit unions and payment firms. It covers both kinds of access plus a third, a yes or no answer to whether a payment can be covered, so an app built against it can talk to many banks in the same way.

The access does not last forever. Since July 2023 the rules call for the customer to confirm the connection again with full two-step authentication at least every 180 days, which is why a budgeting app periodically asks to reconnect. Until then the provider can refresh the balance and recent transactions without asking each time.

Who asks, and why

Personal finance apps and accounting software ask for it all the time. Lenders use the same access to check an applicant in minutes instead of asking for paper statements. Wandoo Biznes, which handles short business loans for sole traders in Poland, verifies the applicant’s account this way: the bank login is typed into a window run by Kontomatik or Transaction Link, authorised open banking providers, and the service says it receives only the information needed to assess the application, with no access to the money in the account. That distinction is the one to look for whenever a service asks for a connection. Reading an account is not the same permission as paying from it, and the consent screen should say which one is being granted.

Before tapping the button, check four things on that screen:

1. The name of the provider doing the reading, which is often not the app’s own name.
2. Which accounts are included, where the screen offers a choice.
3. What is shared: balance, transaction history, account holder details.
4. How long the access lasts, and whether it is a single check or an ongoing connection.

A one-off check for a loan application and a standing connection for a budgeting app look alike at the start. Only the second keeps reading after the first day.

Seeing and withdrawing the access

Consent can be taken back at any time, from either side of the connection.

1. In the app or the provider’s account settings, look for connected banks or data sharing and remove the bank.
2. In the bank’s internet or mobile banking, look in the settings for a list of consents given to outside providers. Banks name it differently, and a consent removed there ends that provider’s access.
3. If neither shows the connection, the bank’s helpline can withdraw it.

Withdrawing access stops future reading. It does not delete what the provider has already collected. That is a separate request to the provider under data protection law, and its privacy notice says where to send it.

A short review twice a year is enough for most people: open the list in the banking app, remove every provider that is no longer in use, and leave the one or two that still earn their place.