FAQs - Open Banking (2024)

There are two ways to stop giving access to your data:

1. Go to the app or website, and withdraw your consent directly there.

2. Contact your bank or building society to let them know you no longer want the firm that provides the app or website to have access to your information.

Toenrol in theOpenBankingDirectory, providers have to be authorised or registered with the Financial Conduct Authority (FCA) and comply with the Payment Services Regulations 2017 which contain strict requirements around the sharing of data, secure methods of communication and customer identification.

You should always ensure that the app or website you are using to make open banking payments is operated by a regulated firm. If it is regulated, you are protected.

You can find out more and check if a firm which provides an app or website is regulated by searching on ourregulated providers page,on theFCA register,or (for European apps and websites) the registers of the FCA’s European equivalents.

No– you’ll need to provide your consent for payments made from your account.

A new type of paymentcalled Variable Recurring Payments (VRPs), enabled by open banking, is providing a ‘smart’ alternative to traditional directdebitsorkeeping your card details on file with a merchant. In the case of VRPs, you’llstillneed to consent to therecurring payments being made from your account by the third party’s app.

Prior to any payments being made, you will agree on parameters such as the maximum amount, frequency and the length of the service. Based on those parameters, future payments may be made from your account by the VRP provider – but you’ll remain in control and have the ability to cancel the service with the VRP provider.

Openbanking has been designed with security at its heart – here’s how:

Bank-level security–openbanking uses rigorously tested software and security systems (the Open Banking API security profile is based on Financial Grade API (FAPI) specifications). You’ll never be asked to give access to your bank login details or password to anyone other than your own bank or building society.

It’s regulated– only apps and websites provided by firms which are regulated by the FCA or European equivalent canenrol in our Open Banking Directory.

You’re in charge– you choose when, and for how long, you give access to your data.

Extra protection– your bank or building society will normally refund your back if unauthorised payments are made. You’re also protected by data protection laws, and you can make a complaint to the Financial Ombudsman Service.

Openbanking uses secure technology. Here are a few more steps you can take to stay extra safe online:

Check if it’s regulated– see if the firm that provides the app or website is listed on ourregulated providerspage,check theFCA register,oritsEuropean equivalent.

Read the small print– always read the terms and conditions before you agree to give a firm access to your data.

Check your bank account– if you see something that doesn’t look right, contact your bank or building society straight away.

Find out more– theFCA websitehas tips on how to protect yourself online, as does theTake 5 Campaign.

All these independent organisations have published guides onopenbanking: the government’s Money Helper,Money Saving Expert, theFinancial Conduct AuthorityandWhich?

Contact the company you believe may have misused or allowed the misuse of your data.

If you think you’ve been a victim of identity theft, report this to your bank andAction Fraud,the UK’s national fraud and internet crime reporting centre. You can call Action Fraud on 0300 123 2040.

First, discuss your complaint directly with the company, bank or building society. If you’re still unhappy, you can contact the independent Financial Ombudsman Service:

Financial Ombudsman Service, Exchange Tower, LondonE14 9SR

Freephone:0800 023 4567

Low-cost phone:0300 123 9123

Email:[email protected]

Website:www.financial-ombudsman.org.uk

If you’re worried about the security of your data or the way it’s being used, first of all contact the company to discuss your complaint. You can also report the company to theInformation Commissioner’s Officeor call them on 0303 123 1113.

A growing number of businesses and public sector organisations now include open banking as a payment option.

For example, HMRC offers it as a way to pay self-assessment tax, corporation tax, VAT and other taxes. You may have seen it on your self-assessment form as ‘Pay by bank account (new)’. You can see how it works here.

Some energy providers, water companies, and local authorities also offer it as an option to pay your bill. You can even use open banking when you buy or sell a car through some online car retailers.

When you make a payment by open banking, it is sometimes referred to as ‘Pay by link’, ‘Bank Pay’, ‘Pay with Bank Transfer’, or ’Instant bank transfer’.

The data you share may include the following:

·account details such as the balance and name on the account.

·regular payment details, such as who you’re paying, Direct Debits, and standing orders

·transactions such as incoming and outgoing payments from your current account.

You should only share the minimum amount of data needed to access the product or service you want to use.

You’ll never be asked to share your bank login details or password to anyone other than your own bank or building society.

A growing number of energy and water providers use open banking data to help assess a customer’s ability to pay their bill, and in some cases, move them on to a more affordable tariff.

For example, if a customer calls the energy company, and is eligible to go on the open banking journey, the team can send out a secure link which allows it to see a snapshot of the customer’s banking data at that specific time. This can enable an immediate switch to the lower tariff while they are on the phone.

The company should then delete the data.

Strong Customer Authentication (SCA) is a way for your bank or payment provider to verify your identity when you make an electronic payment or access an account online. It aims to provide additional layers of security and help prevent fraud.

Your identity must be authenticated by at least two of the following:

·Something only you know, like a password or PIN.

·Something only you possess, such as a card-reader or mobile phone.

·Something unique to you personally, such as facial or fingerprint scan.

Your bank/payment provider is required to apply SCA under the Payment Services Regulations 2017.