Open banking lets you share your bank data with other companies on your terms

Open banking is a system that lets you give permission for companies outside your bank to see and move your money. Instead of keeping all your financial information locked inside your bank's walls, open banking creates secure channels so that apps, payment services, and financial tools can access what you authorize them to access. You stay in control — you decide which companies get permission, what data they see, and when that permission ends.

The system runs on secure connections called APIs (application programming interfaces). Think of an API as a controlled door between your bank and another company. Your bank doesn't hand over your password. Instead, when you authorize a third-party app, your bank opens that specific door for that specific company to see only the information you've approved. If you change your mind, you close the door.

Key Takeaways

  • Open banking requires your explicit permission each time — no company can access your accounts without you saying yes first.
  • You control which data gets shared, with which companies, and for how long; you can revoke permission at any time.
  • Common uses include budgeting apps that read your transactions, payment services that move money between accounts, and loan applications that verify your income.
  • Open banking is already required in Europe and the UK; the United States has no single federal mandate, though some states and regulators are moving in that direction.

How you authorize a third-party company to access your bank account

When you want to use an open banking service, the company walks you through an authorization flow. You'll typically see a screen that says something like "Connect your bank account" or "Link your financial institution." You choose your bank from a list, then you're taken to your bank's login page — not the third-party app's page. This is important: you log in directly to your bank, not to the other company.

After you log in, your bank shows you exactly what the third-party company is asking for. You might see "This app wants to read your transaction history for the past 90 days" or "This app wants to initiate payments on your behalf." You approve or deny each permission. Once you approve, your bank creates a secure token that lets that company access only what you said yes to. The third-party company never sees your password.

You can revoke permission anytime by logging into your bank's settings or the third-party app itself. When you do, the door closes immediately — that company loses access to your data.

What companies use open banking and why

Budgeting and personal finance apps are the most common users. Apps like those that track spending, build savings plans, or show you all your accounts in one place need to read your transaction history. Instead of asking you to enter your password, they use open banking to get that data securely.

Payment apps and money transfer services use open banking to move money between accounts without routing through credit card networks. This can be faster and cheaper than traditional transfers. Loan companies use it to verify your income and account history without asking you to upload bank statements. Insurance companies might use it to confirm your identity or assess risk.

The benefit to these companies is that they get real, current data without storing your password. The benefit to you is that you don't have to share your password with dozens of apps, and you can see exactly who has access to what.

The difference between open banking and screen scraping

Before open banking became standard, many apps used a method called screen scraping. You gave the app your actual bank password, and it logged in as you, looked at your screen, and extracted the data it needed. This was risky: the app stored your password, your bank couldn't tell the difference between you logging in and the app logging in, and if the app was hacked, your password was compromised.

Open banking replaces this. Your bank creates a secure, read-only connection that the app can use without ever touching your password. Your bank knows exactly which app is accessing your data and can cut off access instantly. Most major banks have moved away from allowing screen scraping, and regulators in Europe and the UK have banned it in favor of open banking.

Some older apps still use screen scraping, usually because they haven't updated their systems. If an app asks for your actual bank password, that's a red flag — it means they're using the old, riskier method.

Open banking rules in different countries

Europe and the United Kingdom have mandatory open banking. The EU's Payment Services Directive 2 (PSD2), which took effect in 2018, requires banks to open their data to authorized third parties. The UK has similar rules through its Open Banking Standard. Banks must provide access; customers must give permission; and the system is regulated.

The United States has no single federal open banking mandate. However, the Consumer Financial Protection Bureau (CFPB) has signaled interest in requiring it, and some states are moving forward on their own. Several major banks have voluntarily adopted open banking standards. The financial industry is moving toward it, but there's no hard deadline like there was in Europe.

Other countries including Australia, Canada, and Singapore have introduced or are planning open banking rules. The trend globally is toward requiring it, though the timeline and exact rules vary by region.

Risks and protections in open banking

The main risk is that a third-party app could be hacked or misuse your data. If you give a budgeting app permission to read your transactions, and that app is compromised, someone could see your transaction history. However, they still can't see your password, and they can't access your account directly — they can only see what you authorized them to see.

Your bank is responsible for making sure the connection is secure and that only authorized companies can access your data. In Europe and the UK, open banking is regulated, which means banks and third-party providers must meet security standards and can be fined for breaches. In the US, where there's no federal mandate, protections vary by bank and by state.

To protect yourself: only authorize apps you trust, check what permissions you're granting before you approve, review your connected apps regularly and disconnect ones you no longer use, and use strong, unique passwords for your bank account itself. Your bank account password is still your first line of defense.

What open banking means for refunds and payments

Open banking can speed up certain financial transactions. If a company owes you a refund and has your bank details, they can use open banking to verify your account and send money directly, rather than mailing a check or waiting for a wire transfer. Some insurance companies and retailers are starting to use this for faster refund processing.

For payments you're making, open banking-enabled payment apps can pull money directly from your bank account without using a credit card, which can be faster and cheaper. This matters for things like bill payments, peer-to-peer transfers, and online purchases where you want to avoid card fees.

The timeline for these transactions depends on your bank and the company sending the money, but open banking removes one layer of delay — the company doesn't have to wait for you to provide your account number or for a check to clear.

Frequently Asked Questions

Can a company access my bank account without my permission?

No. Open banking requires explicit permission from you each time. Your bank will show you exactly what the company is asking for before you approve it. If you didn't authorize it, the company has no access. If you're unsure whether you authorized something, log into your bank's app and check the list of connected apps or authorized third parties.

What happens if I revoke permission?

The company loses access immediately. They can no longer read your data or move your money. Any data they already collected stays with them, but they can't get new data. You can revoke permission through your bank's settings or through the third-party app itself, depending on how it's set up.

Is open banking the same as sharing my login credentials?

No. Open banking is specifically designed so you don't have to share your password. You log in to your bank directly, and your bank creates a secure connection for the third party. Sharing your actual login credentials is the old, riskier method called screen scraping, which most banks no longer allow.

Do I have to use open banking?

No. It's optional. You can still use apps that don't require open banking, upload documents manually, or handle transactions the traditional way. Open banking is an option that makes some tasks faster and more secure, but you're never required to use it.

What should I do if I don't recognize a connected app?

Log into your bank's app or website and look for a section called "Connected Apps," "Authorized Third Parties," or "App Permissions." If you see an app you don't recognize, disconnect it immediately. If you're concerned about unauthorized access, contact your bank directly — they can tell you when the permission was granted and what data was accessed.