Is Open Banking safe? What read-only access really means

Connecting a financial app to your bank still feels, to many people, like handing over a key. Understanding what is actually being shared — and what the receiving firm is legally permitted to do with it — makes the decision a lot clearer.

What Open Banking is

Open Banking is a UK regulatory framework that lets you share your own banking data with firms you choose, through a secure connection built for that purpose. It came out of competition reforms intended to break the position where your bank was the only party that could see your financial life.

The crucial design decision: you never give the third-party firm your banking password. Authorisation happens on your bank's own app or website, using the same security you would use to log in yourself. The firm receives a token, not a credential.

Two very different permissions

The distinction that matters most is rarely explained clearly.

Account information (read-only). The firm can see balances, transactions and holdings. It cannot move a single pound. Firms doing this are regulated as account information service providers.

Payment initiation. A separate permission that allows a firm to initiate a payment on your instruction. Different authorisation, different regulatory permissions, different consent.

A firm holding only account information access has no technical route to move your money. This is not a policy promise — the permission simply does not exist on that connection.

What protects you

Several things sit behind that connection:

• Authorisation. Firms must be authorised or registered by the FCA to access account data. That status is publicly checkable on the FCA register.
• Strong customer authentication. You approve access through your own bank, with your own security.
• Explicit, expiring consent. You choose which accounts to share and for how long. Consent must be renewed periodically rather than running forever.
• Revocation. You can withdraw access at any time, from either the firm or your bank, and the connection stops.
• UK GDPR. The data remains personal data. It cannot lawfully be repurposed for something you did not agree to.

The questions worth asking any firm

Regulation sets a floor, not a ceiling. Before connecting anything, three questions do most of the work:

1. Is the firm FCA authorised or registered, and under what permissions? Check the register rather than the marketing page.
2. What does the firm do with the data? Specifically: is it sold, shared with advertisers, or used to target you with products?
3. How does the firm make money? A service funded by selling you products has different incentives to one funded by a subscription. The data is the same; what is done with it is not.

Where we stand

Neo-Invest.AI does not use Open Banking connections in its current phase — holdings are added manually or imported by you, so no bank credentials or connections are involved at all. Regulated, read-only account connections are planned for a later phase.

When they arrive, they will be read-only: we will be able to see balances and holdings, and we will never be able to move money. And because we sell no financial products and take no commissions, there is nothing for us to point your data toward.

Sources

• Financial Conduct Authority — Open banking and open finance, accessed August 2026.
• Financial Conduct Authority — Financial Services Register, accessed August 2026.
• Open Banking Limited — Impact Report and ecosystem statistics, accessed August 2026.
• Information Commissioner's Office — Open Banking and data protection, accessed August 2026.

Last reviewed: 2 August 2026 · Figures reflect the 2026/27 UK tax year.

This article is general educational information about UK tax and investing rules. It is not personal advice or a recommendation, and it does not take account of your circumstances. Tax treatment depends on individual circumstances and may change. Figures reflect our understanding of the rules for the 2026/27 tax year at the date of publication. If you are unsure, consider speaking to an adviser authorised by the FCA.