What Is Open Banking? PSD2, Consent and Data | Cash Book

People hear open banking and picture the bank handing their data around. Some version of: there is an arrangement, the apps are on a list, the transactions are already out there somewhere. It is close to the opposite. The whole thing runs on consent you give, to one named provider, for a named scope, for a limited time, and you can take it back. The banks did not volunteer any of it either. Regulators made them build the door, and it only opens when you say so.

Two roles, and a regulator behind each

In the European Union the legal basis is the second Payment Services Directive, Directive (EU) 2015/2366, known as PSD2. It created two regulated roles, and the difference between them is the difference between reading and writing. An account information service provider reads: balances, transaction history, account details. A payment initiation service provider writes: it instructs a transfer from your account without a card in the middle. Budgeting apps want the first. Checkout buttons want the second. Both need authorisation from a national regulator, and both need your explicit consent for each connection. PSD2 is due to be replaced by a successor package: a directive on licensing alongside a directly applicable regulation carrying the open banking and fraud rules. The European Commission publishes the current state of play.

The United Kingdom arrived by a different road. The Competition and Markets Authority investigated retail banking, found that customers rarely switched and that challengers struggled to compete, and its remedy order required the nine largest current-account providers, the CMA9, to build a common API standard and fund a central body to write the rules and police them. That body was the Open Banking Implementation Entity. It now trades as Open Banking Limited, and the Financial Conduct Authority authorises the firms that use the standard.

Worth holding on to, because a lot of people get it backwards: the connection is with a third party operating under its own authorisation. Your bank is providing access. It is not endorsing the app.

The redirect, and the company you did not pick

The flow feels the same under both regimes. You choose a provider inside an app, you are redirected to your bank, you authenticate the way you always do, you approve a named scope of access, and you are sent back. The app never receives your banking password. That part is genuinely good design.

Consent is time-limited. The PSD2 technical standards originally required fresh authentication every 90 days for continued data access, and a later amendment extended that window, which is why bank connections inside budgeting apps periodically stop delivering data and ask you to log in again. It is not the app being difficult.

Then there is the detail almost nobody reads closely. Very few consumer apps hold the licence themselves; they buy access from an authorised aggregator such as Plaid, TrueLayer or Tink, which holds the permissions and runs the connections to thousands of institutions, so a bank sync toggle usually means your transaction history passes through a fourth company you never chose, named on the consent screen and nowhere near the marketing page. Revoking is a two-place job for the same reason. Turn the consent off inside the app, then open your bank's own app, which keeps the list of connected third parties and a control to revoke them, because deleting something from your phone does not reliably tell the bank to close the door behind it.

A feed tells you what left, not what it was for

Open banking answers one question well. What left the account. It does not answer the question a budget actually turns on, which is what the money was for, and no amount of API quality fixes that, because a feed hands you a merchant string, an amount and a date, and deciding that an unreadable card descriptor was a work lunch rather than groceries is still yours to do. Leave it four days and you will not remember. That is why synced trackers end up so reliably with a large, useless uncategorised bucket at the end of the month.

Timing is the second limit. Card transactions arrive pending and settle later, sometimes at a different amount, which means a connected balance is not the same thing as money you can spend, and cash flow timing is a separate problem from the figure on the screen. Cash withdrawals arrive as a single line hiding five purchases. Coverage has holes too: good for current accounts in the EU and UK, thinner for savings, credit cards and smaller institutions.

So a feed is a decent reconciliation tool and a poor awareness tool. It tells you afterwards. The moment that changes behaviour is the moment you are standing at the till, which is the case the expense tracking guide makes at length.

The other side of the trade

Cash Book never connects to a bank. That is a deliberate choice and it costs something real: nothing arrives on its own, ever. What comes back in exchange is that there is no consent screen, no aggregator in the middle, no 90-day re-authentication and no copy of your transaction history sitting on anyone's server, because the data lives on the iPhone and, if you switch it on, in your own iCloud account, which is what iCloud sync and privacy covers.

Speed of entry is what replaces the feed. Voice logging turns a spoken sentence into one or several transactions; the receipt scanning guide covers photographing a bill instead of typing it; and Apple Pay auto-logging uses Apple's Shortcuts automation so a card tap logs itself, as the Apple Pay guide sets out. Apple provides no API for card taps. The Shortcuts trigger is the only route any app has.

A synced app gives you completeness and asks you to categorise later. A manual-first app gives you attention and asks you to log at the time. Neither is free, and anyone selling one as if it were is leaving something out.

If the job is checking someone else's account details before you send them money, that is a different problem entirely, and the IBAN validator runs the structural check while the IBAN entry explains what it cannot tell you. For a specific provider's authorisation, look it up on the national regulator's public register.

Get Cash Book on the App StoreFree for 7 days. $19.99 once for lifetime.

Get Cash Book on the App StoreFree for 7 days. $19.99 once for lifetime.