4 ms·

So if your bank partners with them, they'll get access to your financial data and you have no say over that, only recourse to close your account (and what happe

So if your bank partners with them, they'll get access to your financial data and you have no say over that, only recourse to close your account (and what happens with the data already transferred)? Or is it the kind of service that requires you to give them you bank access details (which is against T&C of most of the banks)? It seems like it's just a data grab disguised as an API, but what do I know, maybe I am wrong...

eCa 5y ago
I assume a third way: They get your data once you have signed an agreement with your bank.
blowfish721 5y ago
I agree with you on the data grab but this is true for all those services. Regarding the data they have on you, at least for europeans, you have the right to have it deleted (GDPR).
- varispeed 5y ago
  But you will never get a proof that your data was deleted and if it eventually leaks, company gets a slap on the wrist if anything. So far GDPR is a dead law - sure it looks like companies care with all those banners, but practices hardly changed and big companies can largely ignore it as long as they appear they comply on the surface.
- JackPoach 5y ago
  That is technically not correct. GDPR only covers personal data with several important caveats. So you can't be walking around and claiming that it's all personal data and it all has to be deleted. The law doesn't work this way. This is a silly example, but nonetheless - you can't ask police to delete your criminal records. Nor can you request your bank to delete all transaction records from your bank account - even if you are leaving the bank.
progre 5y ago
In Sweden the banks are required to share data with other entities at the request of the bank customer. So I could intall the Tink app or whatever, and connect to my bank through the app. I think the data formats are even somewhat standardized. Basically the banks where dragging their feets in implementing better customer services and the government slapped them with the sharing requirement.
- rmesters 5y ago
  Yes, this applies to all 31 European Economic Area countries. It covers ~6,000 banks in total and requires banks to build APIs that provide free access to banking data (for licensed AISP companies) and payment initiation services (for licensed PISP companies). This is regulated under PSD2 (Payments Services Directive 2).
rmesters 5y ago
Tink uses both real bank APIs (aka PSD2 APIs) and non-regulated proprietary APIs (screen-scraping, reverse engineering mobile APIs). The former method does not require sharing bank credentials - authentication happens on bank's side and data is shared only with end-user's consent. The latter method requires users to share bank credentials. At Nordigen, we built a freemium alternative to Tink using only real bank APIs / PSD2 APIs.
stevesimmons 5y ago
In Europe and the UK, all banks must offer API access to customers' account data, with the customer in control of what is shared with whom. The rules governing this are OpenBanking in the UK and PSD2 (Payment Services Directive) in the EU. Any company wanting to use account data must get explicit consent from the customer, via a consent flow involving authenticating themselves to their bank. The customer can revoke consent any time via their bank's web site. GDPR plus the OpenBanking (UK) and PSD2 (EU) regulations provide strong guarantees of security. Nothing like the US's sharing of transaction data is allowed here. Tink's role here is to be a single API connecting to all European banks using the PSD2/OB protocols. > but what do I know, maybe I am wrong... Yes you are. 100% wrong. Europe is miles ahead of the United States here.
- varispeed 5y ago
  Thank you. Do you think it would be possible for these services to operate in a manner that does not require sharing data with them? For example, if the 3rd party app wants to show you your aggregate spending, they could run the operation on the bank's server and then the result would be end to end encrypted and shown on a customer device, without the 3rd party being able to read any details. Interesting that they went with full data sharing, that's a bit lazy and careless.
  - stevesimmons 5y ago
    The third parties are tightly regulated. For instance, they need to be registered by the FCA as an AISP or a PISP for respectively showing account info and initiating payments. Personally, I am comfortable with that. Your suggestion makes it more complicated for each bank, which means you won't get uniform, consistent coverage. Better to leave more space for Open Banking specialist providers to innovate, while regulating them tighly.

eCa 5y ago

I assume a third way: They get your data once you have signed an agreement with your bank.

blowfish721 5y ago

I agree with you on the data grab but this is true for all those services. Regarding the data they have on you, at least for europeans, you have the right to have it deleted (GDPR).

varispeed 5y ago
But you will never get a proof that your data was deleted and if it eventually leaks, company gets a slap on the wrist if anything. So far GDPR is a dead law - sure it looks like companies care with all those banners, but practices hardly changed and big companies can largely ignore it as long as they appear they comply on the surface.
JackPoach 5y ago
That is technically not correct. GDPR only covers personal data with several important caveats. So you can't be walking around and claiming that it's all personal data and it all has to be deleted. The law doesn't work this way. This is a silly example, but nonetheless - you can't ask police to delete your criminal records. Nor can you request your bank to delete all transaction records from your bank account - even if you are leaving the bank.

progre 5y ago

In Sweden the banks are required to share data with other entities at the request of the bank customer. So I could intall the Tink app or whatever, and connect to my bank through the app. I think the data formats are even somewhat standardized. Basically the banks where dragging their feets in implementing better customer services and the government slapped them with the sharing requirement.

rmesters 5y ago
Yes, this applies to all 31 European Economic Area countries. It covers ~6,000 banks in total and requires banks to build APIs that provide free access to banking data (for licensed AISP companies) and payment initiation services (for licensed PISP companies). This is regulated under PSD2 (Payments Services Directive 2).

rmesters 5y ago

Tink uses both real bank APIs (aka PSD2 APIs) and non-regulated proprietary APIs (screen-scraping, reverse engineering mobile APIs). The former method does not require sharing bank credentials - authentication happens on bank's side and data is shared only with end-user's consent. The latter method requires users to share bank credentials. At Nordigen, we built a freemium alternative to Tink using only real bank APIs / PSD2 APIs.

stevesimmons 5y ago

In Europe and the UK, all banks must offer API access to customers' account data, with the customer in control of what is shared with whom. The rules governing this are OpenBanking in the UK and PSD2 (Payment Services Directive) in the EU. Any company wanting to use account data must get explicit consent from the customer, via a consent flow involving authenticating themselves to their bank. The customer can revoke consent any time via their bank's web site. GDPR plus the OpenBanking (UK) and PSD2 (EU) regulations provide strong guarantees of security. Nothing like the US's sharing of transaction data is allowed here. Tink's role here is to be a single API connecting to all European banks using the PSD2/OB protocols. > but what do I know, maybe I am wrong... Yes you are. 100% wrong. Europe is miles ahead of the United States here.

varispeed 5y ago
Thank you. Do you think it would be possible for these services to operate in a manner that does not require sharing data with them? For example, if the 3rd party app wants to show you your aggregate spending, they could run the operation on the bank's server and then the result would be end to end encrypted and shown on a customer device, without the 3rd party being able to read any details. Interesting that they went with full data sharing, that's a bit lazy and careless.
- stevesimmons 5y ago
  The third parties are tightly regulated. For instance, they need to be registered by the FCA as an AISP or a PISP for respectively showing account info and initiating payments. Personally, I am comfortable with that. Your suggestion makes it more complicated for each bank, which means you won't get uniform, consistent coverage. Better to leave more space for Open Banking specialist providers to innovate, while regulating them tighly.