For a bank account in the EU or EEA, connecting it to a budgeting or bookkeeping app is generally safe when the app uses regulated open banking under PSD2. You authorise access inside your own bank, the app receives a read-only consent instead of your password, it cannot initiate payments with that consent, and you can revoke it at any time. The risks that remain are about the app itself: how well it protects the data it stores, how much it asks for, and whether you are on the real app and not a lookalike.
This article explains what happens technically when you press "connect bank", what an app can and cannot do with that access, which risks are real, and a short checklist you can use on any app, ours included.
What "connecting your bank" actually means
Since PSD2 (Directive (EU) 2015/2366), banks in the EU must give licensed third parties access to payment accounts through a dedicated interface, usually an API. A company that reads account data this way is an account information service provider (AISP). It must be authorised or registered by a national regulator and appears in the EBA register of payment institutions.
Many apps do not hold the licence themselves. They work with a licensed aggregator that maintains connections to thousands of banks. The flow looks the same either way:
You pick your bank in the app.
You are redirected to your bank's own login page or app.
You log in there with your usual strong customer authentication (password plus a second factor).
Your bank shows what is being requested (which accounts, which data, for how long) and you approve.
The bank issues a consent to the provider. The app uses it to fetch balances and transactions.
Your banking password is typed into your bank, not into the app. That is the main difference from the older practice of "screen scraping", where you handed your credentials to a third party that logged in as you.
What an account information provider can and cannot do
PSD2 limits what an AISP may do with your data. In plain terms, it may access only the accounts you designate, it may not ask for sensitive payment data such as card credentials, and it may not use or store the data for purposes other than the service you signed up for.
| Can | Cannot |
|---|---|
| Read balances of the accounts you selected | Initiate a payment or transfer |
| Read transaction history (how far back depends on the bank) | See or store your online banking password |
| Refresh data on a schedule while the consent is valid | Access accounts you did not select |
| Keep the data it already fetched, under its privacy policy | Keep fetching after you revoke the consent or it expires |
Moving money is a separate regulated activity (payment initiation) with its own licence and its own explicit approval at your bank for each payment. A read-only consent for a budgeting app does not quietly include it.
How long a connection lasts and why apps ask you to "reconnect"
Banks must ask you to re-authenticate periodically. Originally that was every 90 days. An amendment to the PSD2 technical standards (EBA final report, April 2022), applicable since 25 July 2023, extended this to 180 days and stopped banks from demanding extra authentication every time a provider refreshes your data in the background.
In practice the length you see depends on the bank and on the consent the app requests. Some apps ask for 90 days, some for 180. A good app warns you before a connection lapses so your balances do not silently go stale.
The risks that actually matter
The regulated connection is rarely the weak point. These are:
The app's own data storage. Once transactions are fetched, they live in the app's database. A breach there exposes your history. Ask where data is stored, whether bank tokens are encrypted, and whether data is sold or used for advertising.
Over-broad consent. If you only need one business account, do not connect every account you own.
Phishing and lookalike apps. An attacker does not need open banking if you type your banking password into a fake page. The bank login step should always happen on your bank's real domain or app.
Non-bank connections. Crypto exchanges and brokers are not covered by PSD2. Apps connect to them with API keys you create. Always create those keys with read-only permissions and no withdrawal rights.
Unregulated workarounds. Accounts outside the EU or EEA, and some account types, may not have a regulated interface. Then the app either cannot connect or falls back to file imports, which is fine, or asks for credentials, which you should refuse.
Checklist: eight questions before you connect any app
Who provides the bank connection, and is that company in the EBA register or a national regulator's register?
Do you log in on your bank's own page or app, never in a form inside the budgeting app?
Is access read-only, and does the app say plainly that it cannot initiate payments?
How long does the consent last, and will the app tell you before it expires?
Where is the data stored (EU or elsewhere) and is it encrypted at rest?
Is data sold, shared for advertising or used to train third-party models?
Can you export everything and delete your account?
Can you revoke access from your banking app, not only from the budgeting app?
If an app cannot answer the first three clearly, do not connect it.
What changes with PSD3 and the Payment Services Regulation
PSD2 is being replaced by a new directive (PSD3) and a directly applicable Payment Services Regulation (PSR). The European Parliament and the Council reached a provisional political agreement on 27 November 2025, and final compromise texts were published in April 2026. Formal adoption is expected in 2026, with most obligations applying later, around 2028. For users of account information services, the direction is more control rather than less: the package aims to make banks' open banking interfaces work more reliably and to give customers a clearer overview of which providers have access to their accounts and the ability to withdraw that access. Nothing about the read-only, consent-based model for budgeting apps changes for the worse.
How MoneySky handles bank connections
We are a budgeting and bookkeeping app ourselves, so here is the same checklist applied to us:
Bank connections run through GoCardless, authorised by the FCA under reference 597190, which connects to more than two thousand banks in the EU, the EEA and the UK.
You authorise in your own bank. We receive a read-only consent and never see your banking credentials. The connection cannot initiate payments, and MoneySky has no payment capability at all.
We currently request 90-day consents and notify you before a connection lapses.
Data is stored in the EU, bank tokens, IBANs and exchange API keys are encrypted, and data is never sold.
Banks that are not covered can be added by importing a CSV statement instead.
You can export your data at any time. Deleting your account sends you a full archive first.
Details for each bank, including how much history it returns, are on the bank sync page.
FAQ
Can a budgeting app take money from my account?
Not through a read-only account information consent. Initiating payments requires a different licence and your explicit approval at the bank for each payment.
Do I give the app my online banking password?
No. With PSD2 open banking you log in at your bank. If an app asks you to type your banking password into its own form, treat that as a red flag.
How often do I need to reconnect my bank?
The rules allow consents of up to 180 days before you must re-authenticate. Some apps request shorter consents, often 90 days.
What happens if I revoke access?
The provider stops receiving new data immediately. Data already fetched stays in the app until you delete it or your account, depending on the app's policy.
Is screen scraping still allowed in the EU?
For payment accounts covered by PSD2, banks must offer a dedicated interface, and reputable providers use it. Giving your credentials to a third party is a practice to avoid.
How do I check whether a provider is licensed?
Search for the company in the EBA payment institutions register or in the register of the national regulator in its home country.
If you want to see what a read-only connection looks like in practice, the 14-day MoneySky trial needs no card. Connect one account, look around, and disconnect from your bank if it is not for you.