Updated
GL-P-05
Glossary · Banks and finance
PSD2 - the European rules that let apps access your bank account
01 / In 30 seconds
The short answer
- What it is
- The European directive on payment services, the basis of open banking
- The main idea
- With your consent, third-party services can see account data and initiate payments
- What it protects
- Strong customer authentication for payments and log-ins
- Who benefits
- Those who use financial apps and account aggregators
- What to remember
- Access is granted with your consent and can be withdrawn
02 / In plain words
What PSD2 / Open banking means
PSD2 is the European directive on payment services on which open banking is built. Put simply: it allowed licensed third-party services, with your consent, to obtain information about your account and initiate payments on your behalf — through a secure connection to the bank.
The familiar conveniences grew out of this: apps that show all your accounts at different banks in one place, spending analysis services, paying directly from an account without a card. The second important part of the directive is strong customer authentication: confirming transactions with two factors, which is why payments and log-ins now require an extra confirmation.
There are two practical conclusions for the client. First: access to your account data is possible only with your explicit consent, and it can be withdrawn. Second: when connecting financial apps, look at the service’s licence and the scope of the permissions you grant — convenience should not turn into uncontrolled access to your financial picture.
A case from practice
On moving to Europe, a client connected several financial apps and a year later could not remember which had what access. Sorting it out took an evening: some connections were withdrawn and only the necessary ones kept. Checking the list regularly takes a couple of minutes and removes the issue.
Where you encounter it
- Account aggregator apps
- Paying directly from an account
- Expense tracking services
- Proving income to services
- Two-factor confirmation of payments
- Fintech products in Europe
03 / What it covers
What open banking gives
Access to data
- Account information
- Transaction history
- Only with consent
Payments
- Initiated from the account
- No card fee
- Quick confirmation
Security
- Strong authentication
- Licensing of services
- Withdrawal of consent
Your control
- The scope of permissions
- How long access lasts
- The list of connections
04 / How it works
How to use it safely
Check the service’s licence
We look the service up in the regulator's register.
Read the scope of permissions
Which data and actions the service requests.
Give consent deliberately
You approve access in your bank's app.
Check the list of connections
Every few months we review the active connections.
Withdraw access you no longer need
Unneeded connections are withdrawn in the bank's app.
05 / Key facts
What you need to know
01What it is
The EU Payment Services Directive
The basis of open banking: licensed services can see account data and initiate payments.
02Consent
Only with your permission
Access requires your explicit consent and can be withdrawn at any time, usually in your bank's app.
03Authentication
Two factors
Payments and logins are confirmed in two independent ways, such as a password and an app code.
04Where it applies
The EU and the EEA
Outside Europe, open banking works differently.
Common mistakes
Connecting a service without checking its licence
Look the service up in the regulator's register before granting access.
Not reading what data the service requests
Grant only the permissions the app actually needs.
Forgetting old connections
Every few months, withdraw access from apps you no longer use.
06 / Expert advice
How to prepare in advance
Before connecting a financial app, check whether it is licensed and in which jurisdiction, and read the permissions requested carefully. It is worth reviewing the list of active connections in your bank at least every few months and withdrawing access from services you no longer use.
What we do for you. We draw clients’ attention to digital hygiene when relocating: which services get access to your accounts and what permissions you grant. Your financial picture is sensitive data, especially while you are going through programme checks.
Dmitry NagyTax consultant, international taxation and compliance (ex-Big4)
07 / Questions
Frequently asked questions
The European directive on payment services. It allowed licensed services, with your consent, to see account data and initiate payments.
Access is possible only with your explicit consent, the service must be licensed, and transactions are confirmed with strong authentication. But you still need to check whom you are giving access to.
Yes. Consent can be withdrawn at any time — usually in the bank’s app, in the section on active connections.
Confirming a transaction with two independent factors — a password and a code from an app, for example. Because of it, payments require an extra step.
In the European Union and the EEA countries. Outside them, approaches to open banking differ.
No. It is an option, not a requirement. The bank works without any third-party apps being connected.
INITIAL ASSESSMENT
Tell us what outcome your family needs
We will design a solution for your case, choose the country and the right status, and take the whole process through to the result.
