Can an Open Banking provider take money from my account?

Not with account information access. Payments need a separate permission and a separate consent at your bank.

Does my bank know who I have connected?

Yes. Consents are managed at the bank and you can see and revoke them in your banking app.

What happens if the provider is hacked?

They hold a token for read access to your data, not your credentials. Revoking the consent at your bank ends the access. The provider is regulated and insured, and you have data protection rights.

Is it safer to self-host a tool that reads my accounts?

It removes the third party but puts the security burden on you. Fine if you know what you are doing; not a default recommendation.

Do AI assistants store my bank data?

It depends on the tool. Ask, and prefer tools that fetch on demand rather than storing history.

Guides

Is Open Banking safe? What changes when an AI assistant is on the other end

How UK Open Banking protects your data, what a licensed provider can and cannot do, and the extra questions to ask before letting an AI assistant read your bank account.

The short answer

Yes, when used through a licensed provider. Open Banking was designed by regulators with the assumption that third parties would be reading your data, so the protections are structural: you authenticate at your own bank, you never share your login, the third party is on the FCA register, and you can revoke access at any time. The risk sits less in the standard and more in who you connect and what they do with the data afterwards. That question gets sharper when the "who" is an AI tool.

How Open Banking works

A licensed provider asks for your consent to read specific accounts.

You are sent to your bank's own app or website to approve it. The provider never sees your password.

Your bank issues the provider a time-limited token for the accounts and data you approved.

The provider reads balances and transactions through the bank's API for as long as the consent is live.

You can revoke the consent from your bank or from the provider. The provider must reconfirm it with you every 90 days.

The provider is on the FCA Financial Services Register, carries insurance, and is subject to data protection law and FCA supervision.

What a licensed provider cannot do

Move your money. Account information access is read-only. Payments require a separate permission and a separate consent.

See your login details. Authentication happens at the bank.

Keep access after you revoke it.

Use the data for purposes you did not consent to.

Where the real risks are

Risk	What it looks like	How to check
Unlicensed intermediary	A tool asks you to enter your bank username and password directly	Never do this. A licensed provider sends you to your bank
Over-broad consent	The consent screen lists every account and every data type when the tool only needs one	Read the consent screen. Approve only what the tool needs
Data retention	The tool stores your transaction history indefinitely	Read the privacy policy. Look for retention periods and deletion
Onward sharing	Your data is passed to third parties, including AI model providers	Look for a plain statement of who receives the data
Forgotten connections	Consents you set up months ago and no longer use	Review connected apps in your bank's app every few months

The AI question

Connecting an AI assistant to your bank adds one layer that traditional budgeting apps did not have: the data may be sent to a large language model to generate the answer to your question. That raises three questions to ask any AI finance tool:

Where does the model run? If your transactions are sent to a cloud model, they leave the provider's systems. Find out which model, which company, and whether the data is used for training.

What is stored, and where? A well-designed tool fetches data when you ask and does not keep it. A poorly designed one caches months of transactions next to the model.

Who holds the consent? If the tool sits between a licensed provider and the assistant, be clear which party you actually consented to. Your right to revoke sits with that party.

None of this makes AI tools unsafe. It means the checklist is slightly longer than it was for a budgeting app.

A short checklist before you connect anything

Is the provider, or the AISP behind it, on the FCA register?
Does the consent flow send you to your bank, not ask for your password?
Does the consent screen match what the tool actually needs?
Does the privacy policy say how long data is kept and who it goes to?
If AI is involved, does it say which model provider receives your data?
Do you know how to revoke access, and have you tried it?

FAQ

Can an Open Banking provider take money from my account?
Not with account information access. Payments need a separate permission and a separate consent at your bank.
Does my bank know who I have connected?
Yes. Consents are managed at the bank and you can see and revoke them in your banking app.
What happens if the provider is hacked?
They hold a token for read access to your data, not your credentials. Revoking the consent at your bank ends the access. The provider is regulated and insured, and you have data protection rights.
Is it safer to self-host a tool that reads my accounts?
It removes the third party but puts the security burden on you. Fine if you know what you are doing; not a default recommendation.
Do AI assistants store my bank data?
It depends on the tool. Ask, and prefer tools that fetch on demand rather than storing history.

Monzo, Starling and Revolut APIs: what an AI assistant can actually read
How Monzo, Starling and Revolut expose account data to developers and AI agents in the UK, and where each bank's own API ends and Open Banking begins.
AISP explained: who is allowed to read UK bank data, and how to become one
What an AISP is, how it differs from a PISP, the three ways to get AISP access in the UK, and what it means for anyone building an AI tool that reads bank accounts.