UK Open Banking, explained in plain language

Open Banking gives you a legal right to share your bank data with regulated services. Banks must publish secure APIs; access is granted on the bank's own consent screen, scoped to what you approve, and revocable at any time. The FCA authorises the companies allowed to use those APIs, and the framework is enforced under the Payment Services Regulations 2017.

Three parties are involved: your bank (which holds the data and runs the consent screen), an AISP (the FCA-authorised intermediary that fetches data through the official APIs), and the service you actually use. BankSync connects through Salt Edge, an authorised AISP, which means BankSync never sees your credentials and can only ever read data, never move money.

UK rules require periodic reconfirmation that you still want data flowing, typically every 90 days depending on the bank. Renewal is a quick re-authentication with your bank. BankSync tracks the expiry date on each connection and prompts you ahead of time so syncs never silently stop.

Before Open Banking, tools asked for your online banking password and logged in as you. That breaks most banks' terms, grants full account control, and fails whenever the bank redesigns a page. API access is the opposite: credential-free, read-only, bank-supervised, and stable. BankSync uses regulated APIs exclusively in the UK; see our security page for the full picture.