Open Banking explained: what an app really sees when you connect your bank account

What Open Banking is

Open Banking is the rule that your bank must share data from your account with another company if you want it to and if that company holds the right licence. It rests on the EU's PSD2 directive (2015/2366), which applies to banks across the European Union. The data travels through the banks' secure interfaces (APIs), not by handing someone your login and password.

For you it means one thing: an app can see your account history without you sending PDF statements, taking screenshots or copying transfers into a spreadsheet.

AIS and PIS: two very different services

PSD2 defines two services that are easy to confuse:

• AIS (account information service) lets a provider read data from your account. Only read it.
• PIS (payment initiation service) lets a provider initiate a payment on your behalf.

Every veinito. product uses AIS only. Technically, they cannot initiate a payment, change account settings or move money.

What exactly the app sees

With AIS, an app can see data only from the accounts you choose:

• the account holder's name and the account number,
• the balance,
• the transaction history: date, amount, reference, payer or payee.

What it does not see: your bank login or password (you sign in at your bank, not in the app), accounts you did not select, and nothing that would require changing your account.

How consent works, step by step

1. In the app, you choose your bank.
2. The app sends you to your bank's website or app. You sign in there as usual and confirm your identity.
3. The bank shows who is asking for access, to which accounts and for how long. You pick the accounts and accept.
4. You return to the app, which can now read data from the chosen accounts.

Consent has an end date. Since the 2022 rule change (Delegated Regulation 2022/2360), a bank can keep it for up to 180 days without you confirming it again. After that it has to be renewed, otherwise access simply expires.

Who is allowed to ask

Only a licensed account information service provider (AISP) can get AIS access. Such a company is supervised by a national financial authority and listed in the public register of the European Banking Authority (EBA).

For veinito. products, the bank connection is provided by Enable Banking Oy, a Finnish AISP supervised by FIN-FSA. Its EBA register entry is public, and we link it in the sources below. Enable Banking connects over 2,500 banks in more than 30 European countries, so the same mechanism works in Poland, Germany or Spain.

How to withdraw consent

There are two ways and both work immediately: disconnect the bank in the app's settings, or remove access in your online banking (usually under "consents" or "third-party services"). You do not need to ask anyone or give a reason.

How our products use it

• ClassKasa reads payments into the class account and matches each transfer to the right family, so the treasurer does not tick off payments by hand.
• CzynszOK checks income against the rent and the rent payment history in the bank data, issues a certificate and deletes the raw bank data right after. The landlord sees no amounts.
• Kasandro brings together accounts from several banks, a partner's too, and shows where the household's money goes. Insight, not investment advice.

What to watch out for

• If an app asks for your bank login and password in its own form, that is not Open Banking. With real AIS you always sign in at your own bank.
• Check who the AIS provider is and look it up in the EBA register.
• Read the consent screen at your bank: which accounts, what scope, for how long.
• Share only the accounts the service actually needs.