AustraliaNow Live
·Australian banks now supported via CDR.Browse AU banks
BankSync

Finicity

Open Banking (US) via Finicity · United States. Full regulatory disclosures, consent model, and data handling.

“We partner with licensed providers so you always know exactly who is authorised to access your data and under what rules.”
- The BankSync Team

Penny's provider boundary

Finicity may operate under its own terms, regulatory duties, security controls, AI settings, retention rules, and incident processes. BankSync protects data inside the BankSync Boundary, but independent provider acts and incidents sit outside that boundary unless caused by BankSync.
🇺🇸

Finicity Corporation (a Mastercard company)

Open Banking (US) via Finicity · CFPB Section 1033 / Quiltt Connector

Live
CFPB
Financial data aggregator operating under CFPB Section 1033
Jurisdiction
United States
Registered Address
Murray, UT, USA
External Dispute Resolution
Consumer Financial Protection Bureau (CFPB)

About this Provider

Finicity Corporation, part of Mastercard Open Finance, is a US financial data aggregator with direct and OAuth data-access agreements with US financial institutions. BankSync reaches Finicity through Quiltt, Inc., a financial data platform that hosts the connection flow and normalises the data.

BankSync's Relationship with this Provider

BankSync uses Quiltt to offer Finicity as an alternative way to connect US banks. Quiltt and Finicity handle the authentication and data retrieval directly with your financial institution. BankSync does not store banking credentials.

This provider is an independent third-party service where it acts under its own terms, authorisation, regulatory role, account relationship, or legal obligations. BankSync is not responsible for that provider's independent compromise, breach, outage, use, disclosure, retention, deletion, product improvement, AI use, model training, sale, or sharing, except to the extent directly caused by BankSync's breach of its Terms, fraud, wilful misconduct, or a non-excludable legal obligation.

Consent & Access

How consent is collected

Consent is provided via Quiltt Connector, Quiltt's hosted connection flow, which hands you to Finicity's own credential or OAuth screen. Your banking credentials go directly to Finicity or your bank. BankSync never sees them.

How to revoke

You may revoke access at any time by disconnecting the bank from within BankSync, which ends the Quiltt session and removes the connection. Where your bank issued an OAuth grant, you can also revoke it in your bank's own connected-apps settings.

Data Handling

Stored by BankSync

  • Account metadata (institution name, account type)
  • Quiltt profile and connection identifiers (encrypted at rest)
  • Finicity customer identifier (encrypted at rest)
  • Sync timestamps and audit log

Pass-through by default

  • Transaction history (amounts, dates, descriptions, categories)
  • Account balances
  • Account details

Pass-through data moves through a Cloudflare Workflow sync step on Cloudflare's global network, is checkpointed by Cloudflare for the life of the run, and is forwarded to your connected destination. Data may be stored where you enable a BankSync-managed feature, such as future BankSync Tables, or where needed for support, security, compliance, backups, or legal requirements.

No Secondary Use

Data accessed via Quiltt is used to provide the service you request. Within the BankSync Boundary, BankSync does not sell your banking data, use it for advertising or data brokerage, disclose identifiable banking data for another party's independent commercial exploitation, or use customer banking data to train AI or machine-learning models. Quiltt, Finicity and other independent providers may have their own terms and legal obligations.

Regulatory Disclosures

  1. 1US bank connections through this provider are facilitated by Quiltt, Inc., a financial data platform, using Finicity Corporation (a Mastercard company) as the underlying aggregator under CFPB Section 1033 rules and its own data-access agreements with financial institutions.
  2. 2BankSync does not store banking credentials. Authentication is handled between Finicity, Quiltt and your financial institution using tokenised connections.
  3. 3Data accessed via Quiltt is used to provide the service you request. Within the BankSync Boundary, BankSync does not sell your banking data, use it for advertising or data brokerage, disclose identifiable banking data for another party's independent commercial exploitation, or use customer banking data to train AI or machine-learning models. Quiltt, Finicity and other independent providers may have their own terms and legal obligations.
  4. 4Financial data obtained via Quiltt is pass-through by default. It is stored only where you enable a BankSync-managed feature that requires storage, such as BankSync Tables, or where needed for support, security, compliance, backups, or legal requirements.
  5. 5BankSync makes its server-side calls to Quiltt from BankSync infrastructure in the United States (Google Cloud, us-central1). Quiltt requires this for CFPB Section 1033 data residency, and our production deployment refuses to start Quiltt without it.
  6. 6You may revoke access at any time by disconnecting the bank from within BankSync.

Regulatory Resources

CFPB — Personal Financial Data Rights (Section 1033)

The CFPB rule underpinning US consumer financial data access rights

Quiltt, Inc.

Connection platform that hosts the consent flow and fronts Finicity

Finicity — Mastercard Open Finance

Underlying aggregator for Finicity connections

Back to ComplianceView data flow architecture

Know Who Holds Your Data

Every licensed provider, fully disclosed. Regulated frameworks, consent you control.

  • Regulated access only
  • Consent-scoped data
  • Revoke anytime
Start your free trial