Behind the Permission Screen: How Open Banking Quietly Powers UK Apps

Open banking rarely appears as a headline feature. It is more likely to sit behind a button that says connect your bank, a screen that asks for permission to read your transactions, or a payment flow that moves money without a card. For UK users, the practical question is no longer whether open banking exists. It is whether the app in front of you is using it well, and whether the data you are handing over is proportionate to the service you receive.

How the plumbing works

Open banking in the UK grew out of a Competition and Markets Authority remedy order that came into force in 2018. It required the largest banks to expose secure APIs — application programming interfaces — so that authorised third parties could access account information or initiate payments with the customer’s consent. The model was designed to reduce reliance on screen scraping, where a customer hands over online banking credentials to a third party.

Today, authorised providers can read balances, transaction histories and account details, or initiate payments from a customer’s account. The customer authenticates directly with their bank, not with the app. Strong customer authentication applies, and consent must be explicit. For account information services, the customer generally has to reauthenticate at least every 90 days, and can revoke access earlier.

That architecture sounds technical, but it produces a simple user experience: a permission screen, a redirect to the bank, a login, and a return to the app. The important detail is what happens in the background. The app receives only the data the bank releases under the consent, and the bank should not release the customer’s online banking password.

What you are actually sharing

A budgeting app may ask for read-only access to current accounts and credit cards. A lender may use transaction data to assess affordability. A payment provider may ask to initiate a one-off payment or set up a recurring payment. The data shared can include balances, transaction descriptions, merchant names, payee details and account identifiers. Some services also use open banking to verify that a customer owns an account.

The scope matters more than the label. Read-only access is not the same as payment initiation. Access to one account is not the same as access to every account. A one-off payment is not the same as a long-running recurring mandate. Users should look for a clear statement of purpose: what the app will read, why it needs it, how long it will keep it, and whether it will share it with anyone else.

Under UK data protection law, the app must have a lawful basis for processing personal data and must explain its use in a privacy notice. Consent for open banking access is not a blanket permission for unrelated marketing or secondary analytics. If an app wants to use transaction data for a broader purpose, that should be explained separately and, where required, consented to separately.

Where protections sit

Open banking providers must be authorised or registered with the Financial Conduct Authority, depending on the service. The FCA register is public and should be the first check for any unfamiliar app. Authorisation is not a guarantee of quality, but it is a minimum signal that the provider has met regulatory requirements.

Strong customer authentication is another safeguard. It reduces the risk of someone accessing an account with only a stolen password. The ability to revoke consent is equally important. A useful app should make it easy to disconnect an account, and the bank should honour that revocation. If an app makes cancellation difficult, or hides the disconnect option deep in settings, that is a warning sign.

Consumers also have data protection rights: access, correction, deletion in certain circumstances, and the right to complain to the Information Commissioner’s Office. For payment-related problems, the app’s complaints process and the Financial Ombudsman Service may be relevant. These routes do not remove the need for care before sharing data, but they provide recourse after something goes wrong.

What changes in 2026

The next phase of UK open banking is less about account dashboards and more about money movement and decisions. Variable recurring payments — sometimes described as a smarter form of direct debit — are being developed for recurring commitments such as subscriptions and bill payments. Account-to-account payments are becoming more practical for merchants and consumers. Lenders and affordability providers are refining how they use transaction data to make faster decisions.

The wider policy direction is often called open finance: extending the model beyond current accounts to savings, investments, pensions and insurance. That could produce more joined-up financial views and more competitive offers. It could also increase the number of permission screens a user encounters. The practical challenge for UK users will be distinguishing between a service that genuinely needs financial data and one that collects it because it can.

Telling a useful app from a data-hungry one

A genuinely useful financial app tends to be specific. It explains which accounts it needs, what it will do with the data, and how long it will retain it. It uses the bank’s authentication flow rather than asking for online banking credentials. It offers a visible disconnect option. It has a clear privacy notice and a pricing model that makes sense.

A data-hungry app is often vague. It may ask for access to all accounts when one would do, request payment initiation when read-only access would suffice, or describe its use of data in broad terms. It may bundle consent for marketing with consent for the core service. It may have no obvious route to deletion. It may also be unfamiliar, unauthorised, or promoted through pressure tactics.

The practical test

Before connecting an account, ask three questions. First, is the provider on the FCA register for the service it is offering? Second, does the permission screen match the job you want done? Third, can you disconnect easily and understand what happens to your data afterwards? If the answers are unclear, wait. Open banking is a useful piece of UK financial infrastructure, but it works best when users treat permission as a decision rather than a formality.