Open banking works like this: when you want to connect a financial app to your bank account, the app and your bank exchange your data directly through a secure interface called an API, but only after you approve the connection on your bank’s own login page. You never hand your banking password to the app. Your bank issues a digital token that lets the app pull the specific data you agreed to share, for a limited time, and you can shut the connection off whenever you want.
The API Connection That Replaces Password Sharing
Before open banking, most financial apps used screen scraping. You gave the app your online banking username and password, and it logged in as you and copied whatever appeared on the screen. Once your credentials were out, you had lost control of them. Because the app was signing in with your actual login, your bank often could not tell the app apart from you, and if something went wrong, you could lose the fraud protections your bank normally offers.
An API is a set of rules that lets two software systems exchange specific data directly. When a budgeting app needs your transaction history, it sends a structured request to your bank’s API. Your bank verifies the connection using a token, which is a digital key that grants limited access without exposing your login. The app receives only the data you approved. Your bank always knows which app is connected and can cut off that access.
What You Actually Do to Connect an App
No data moves until you walk through an authorization flow inside the app. You pick your bank from a list of participating institutions, then choose which accounts to include. You also choose the scope: read-only permission, which lets the app see your transactions and balances, or active permission, which lets it initiate payments from your account.
The app then redirects you to your bank’s own secure login page. This redirect is the point of the whole design. You enter your credentials on your bank’s site, not the app’s, so the third party never sees your password. Your bank shows you exactly what data the app is requesting and for how long, and you approve or decline.
How Long the Access Lasts
Access is always time-limited. In the United States, the CFPB’s data rights rule caps a third party’s data collection at one year from your most recent authorization, after which the app must ask you to reauthorize before it can keep collecting your information.1eCFR. 12 CFR Part 1033 Subpart D – Authorized Third Parties In the European Union and United Kingdom, the standard re-authentication cycle is 90 days: after that window, you have to re-verify your identity with your bank for the app to keep its access.2Open Banking Standards. Reducing the Negative Impact of 90 Days Re-authentication
What the App Can and Cannot Do With Your Data
Authorization is not a blank check. Under the CFPB’s rule, a third party can only collect, use, and retain your financial data to the extent reasonably necessary to provide the specific product or service you asked for.3eCFR. 12 CFR Part 1033 – Personal Financial Data Rights Connect a budgeting app and it can pull your transactions to categorize your spending, but it cannot repurpose that data for unrelated goals.
Three uses are prohibited outright:
- Serving you targeted advertising based on your financial data.
- Using your data to cross-sell other products or services.
- Selling your financial data to anyone.
These limits apply for the entire time the third party holds your data, not just while your connection is active.1eCFR. 12 CFR Part 1033 Subpart D – Authorized Third Parties
Reading Your Data Versus Moving Your Money
Open banking connections generally fall into two functional types, and the difference matters because one lets an app see your account and the other lets it act on it.
Account Information Services
Account information services pull data from one or more accounts into a single view. A budgeting app that shows your checking, savings, and credit card balances on one dashboard is the common example. The service retrieves transaction histories and balances but cannot move funds or make changes. It is strictly read-only.4Open Banking. Account Information Service Provider (AISP)
Payment Initiation Services
Payment initiation services send an instruction to your bank to transfer money. Instead of routing a payment through a card network, the app triggers a direct bank transfer, which can settle faster and cost less than a card payment because it bypasses intermediary networks.5European Commission. Payment Services – Revised Rules to Improve Consumer Protection and Competition in Electronic Payments
Turning Off a Connection
You can end a third party’s access to your data at any time. Under the CFPB’s rule, the third party has to give you a revocation method as easy to use as the original authorization, and it cannot charge you a fee or impose a penalty for pulling the plug.1eCFR. 12 CFR Part 1033 Subpart D – Authorized Third Parties
Your bank may also offer its own revocation option, such as a dashboard where you can see which apps have active access and cut off any of them. If your bank provides this, it must revoke the third party’s access and notify that third party in a timely manner.6Federal Register. Required Rulemaking on Personal Financial Data Rights
Once you revoke access, or simply let the authorization period lapse, the third party has to stop collecting your data. It also has to stop using or retaining anything it already collected, unless that data is still reasonably necessary to deliver a product or service you asked for.1eCFR. 12 CFR Part 1033 Subpart D – Authorized Third Parties
If Money Leaves Your Account Without Your Permission
Regulation E governs electronic fund transfers and caps your liability for unauthorized transfers, but only if you report quickly:
- Report within two business days of learning about the unauthorized transfer, and your maximum liability is $50.
- Report after two business days but within 60 days of receiving your account statement, and your maximum liability rises to $500.
- Report after 60 days, and you could be responsible for the full amount of any unauthorized transfers that occur after the 60-day window, if the bank can show those transfers would not have happened had you reported sooner.
These limits apply regardless of whether you were negligent. Writing your PIN on your debit card, for example, does not push your liability past these caps.7eCFR. 12 CFR Part 1005 Electronic Fund Transfers (Regulation E)
One distinction matters here. These protections apply when you connect through secure APIs where your bank controls the authorization. If you instead share your actual login credentials with an app through screen scraping, your bank may argue that any resulting transactions were authorized by you, which can void your fraud protections entirely.8Canada.ca. Open Banking
The Rule Behind It in the United States
Open banking in the U.S. is governed by Section 1033 of the Dodd-Frank Act, which the Consumer Financial Protection Bureau finalized into a detailed regulation in October 2024. The rule requires banks and other financial data holders to make your account information available through standardized, machine-readable APIs when you authorize a third party to access it. It explicitly prohibits data providers from complying through screen scraping.9Consumer Financial Protection Bureau. Required Rulemaking on Personal Financial Data Rights – Final Rule
The rule covers consumer accounts including checking accounts, savings accounts, and credit cards. It phases in based on the size of the institution, with the largest banks (those holding at least $250 billion in assets) and the largest nonbank providers facing an initial compliance deadline of April 1, 2026. Smaller institutions have later deadlines extending through April 1, 2030.10Consumer Financial Protection Bureau. 12 CFR 1033.121 Compliance Dates
Implementation is currently uncertain. A federal court issued an injunction in 2025 preventing the CFPB from enforcing the rule while the agency reassesses it. The regulation is still on the books, but enforcement of the compliance deadlines is paused until the legal challenge is resolved.