5 ms·

I'd really like to have a read-only API that is accessible for personal projects to be able to retrieve my own transaction history. Sadly with PSD2 that is (afa

I'd really like to have a read-only API that is accessible for personal projects to be able to retrieve my own transaction history. Sadly with PSD2 that is (afaik) impossible, or at least pretty close to impossible. Things like this (nordigen) might "solve" the problem by replacing it with a bigger one: now nordigen (or someone else) has access to all this transaction data and is going to leak it somewhere. I get why banks are so conservative and bureaucratic, and all this PSD2 security stuff is required. I want my financial data to be secured. But I also want to be able to access it with my own software. Guess I cannot have both, in which case I prefer the first. I dont think nordigen is a solution (for me) and quite frankly, I find the concept somewhat scary.

alexchamberlain 5y ago
I think some banks do offer restricted keys that only allow you to access your own accounts - I think Starling in the UK does this; Monzo used to too, but I'm not sure if that's the Open Banking API, or just another API.
- Deathmax 5y ago
  Starling[1] and Monzo[2] have their own APIs accessible to end users which are not Open Banking[3]. Monzo has a separate set of OB APIs and AFAIK Starling doesn't have an OB API as only the big, high-street UK banks (HSBC, Barclays, RBS, Santander, Bank of Ireland, Allied Irish Bank, Danske, Lloyds, Nationwide) were forced to implement the OB spec. [1]: https://developer.starlingbank.com/ https://developer.starlingbank.com/ [2]: https://docs.monzo.com/ https://docs.monzo.com/ [3]: https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385802/Specifications https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385...
szszrk 5y ago
For what PSD2 done is it made that Nordigen service possible, also I can see my history from one bank in another. Results (possibilities) greatly vary from bank to bank, but in general at least I can download my data from one place. I get your complain, but It's a step forward at least.
wdb 5y ago
Would you be interested in something similar for open finance?
- andruby 5y ago
  What does "open finance" mean in this context? I have the same desire as OP to access my own data. I want to build a tool to track my assets. Maybe it's worth building this as open source. Would that be considered "open finance"?
  - Gys 5y ago
    The access to my bank’s PSD2 API is only possible for authorized companies. I assume other banks require the same. They do not want to deal with individuals.
    - andruby 5y ago
      I know. As a dev, I don't like it, but I understand the bank's attitude. That's why individuals will need an intermediary, such as Nordigen (or Tink, Plaid, Truelayer, Ponto)
  - wdb 5y ago
    I mean access to your investment portfolio, model portfolios, accounts, your transaction history, trades, pension plans etc.
acatton 5y ago
Take a look at https://woob.tech https://woob.tech. In a nutshell, it is a bunch of open source python modules which allows you to scrape websites as a unified API. (i.e "bank", "classified ads", "recipes", etc.) They mostly cover European (especially French, since the original author is French) banks. But they have some US ones.
- pbronez 5y ago
  Nice to see they renamed that project. The new name is more approachable.
marbu 5y ago
My bank fio.cz provides it's own user rest api, so that before you create an api access key, you can select which accounts it applies to and if it's read only access or not. I don't understand why there aren't more banks doing something like this. Btw the bank also offers PSD2, but I haven't looked into that so far, and I'm not sure if it's actually directly useful for a client. https://www.fio.cz/bank-services/internetbanking-api https://www.fio.cz/bank-services/internetbanking-api
rhn_mk1 5y ago
What makes it impossible in PSD2? The python-fints library can fetch available transaction history for supported banks no problem. https://github.com/raphaelm/python-fints https://github.com/raphaelm/python-fints https://python-fints.readthedocs.io/en/latest/reading.html#reading-account-transactions https://python-fints.readthedocs.io/en/latest/reading.html#r...
- vesinisa 5y ago
  Under PSD2 banks are required to give access to the "open" APIs only to audited partners (Third Party Payment Service Provider, TPP) They may give wider access, but most are somehow paranoid about the entire matter.
vesinisa 5y ago
> now nordigen (or someone else) has access to all this transaction data and is going to leak it somewhere. You must of course be able to trust the 3rd party, Nordigen in this case. But I don't think their operational license even allows storing your financial data - only proxying requests between you and the bank. So only your bank is even allowed to store your financial data. But of course you need to be able to trust that Nordigen indeed does not store and abuse your financial data -- just like you need to be able to trust your bank! Bear in mind though that Nordigen is supervised by the same financial regulation authority as your own bank, and if they were caught doing anything shady they would face very serious consequences - not to even speak of staining their reputation, which would be ruinous for a small startup. tl;dr: Banking is ultimately about trust, and nothing is ever perfect.
- maverwa 5y ago
  You are right, trust is the most important thing here. But nordigen does not want my money for their service. Instead they want to sell what looks like APIs for ML over your transaction data. So they at least have a good incentive to use my data for training their model. ofc, I dont know what they do with it, they may be cool ethical ppl just doing a cool thing and my mistrust might be totaly misplaced. But I have to trust another entity that proxies my connections. Another link in the chain. And I dont really want to hit on nordigen here, as I said, I dont know them, I have not read that whole website and havent looked in the details. For me its more about the generell problem. I find it sad that a service like this seems nessassary.
  - aerique 5y ago
    They might be cool ethical people that might be bought up by Facebook or Google at some point.
- vesinisa 5y ago
  Read this comment below: https://news.ycombinator.com/item?id=28035602 https://news.ycombinator.com/item?id=28035602 Nordigen does actually reuse, store and sell your financial data in "anonymized" form. That's rather concerning.
elfrinjo 5y ago
It is rally terrible that such a service is actually necessary... PSD2 was a chance to create a standard api for everyone including customers. I still cannot understand how they managed to f it up by limiting access to "trusted companies"
- delusional 5y ago
  I work at a bank and it's quite simple really. The systems we use at my workplace are so antiquated and wonky that even giving people read access would be a monumental effort. To put it plainly, modernizing these systems takes effort similar in order of magnitude to landing on the moon. Not for any technical reason, but due to the mountains of manual processes and general cruft built up around them. The EU is not deaf to these concerns, and therefore the laws end up falling short for no other reason than that they want someone to actually be able to follow them. We are talking about things like "make a request at the wrong time and the system will be broken for the next 24 hours, and you are not allowed to speak to the people who know why". People (myself included until a few years ago) buy into this "banks need to be secure and move slowly to maintain that" but really most of it is due to mismanagement. The "move slowly" is a rationalization.
  - elfrinjo 5y ago
    Oh, I totally agree (started my carreer in a company that still used VSE/ESA and CICS and sometimes dream about ASRAs). However, they had to implement modern api-stuff with PSD2 and then they made it strictly b2b-only :-(
  - maverwa 5y ago
    Oh I think its a mix of both. But I do not have your insight ofc, so just guessing. I think banks should move slowly and pay extra attention to security. Examples like N26 show that not doing so can cause significant issues. But its also a great excuse to justify your vintage cruft.
  - kreetx 5y ago
    But I can log in to my bank and see a transaction log and it doesn't seem to break anything. How would that break anything?

alexchamberlain 5y ago

I think some banks do offer restricted keys that only allow you to access your own accounts - I think Starling in the UK does this; Monzo used to too, but I'm not sure if that's the Open Banking API, or just another API.

Deathmax 5y ago
Starling[1] and Monzo[2] have their own APIs accessible to end users which are not Open Banking[3]. Monzo has a separate set of OB APIs and AFAIK Starling doesn't have an OB API as only the big, high-street UK banks (HSBC, Barclays, RBS, Santander, Bank of Ireland, Allied Irish Bank, Danske, Lloyds, Nationwide) were forced to implement the OB spec. [1]: https://developer.starlingbank.com/ https://developer.starlingbank.com/ [2]: https://docs.monzo.com/ https://docs.monzo.com/ [3]: https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385802/Specifications https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385...

szszrk 5y ago

For what PSD2 done is it made that Nordigen service possible, also I can see my history from one bank in another. Results (possibilities) greatly vary from bank to bank, but in general at least I can download my data from one place. I get your complain, but It's a step forward at least.

wdb 5y ago

Would you be interested in something similar for open finance?

andruby 5y ago
What does "open finance" mean in this context? I have the same desire as OP to access my own data. I want to build a tool to track my assets. Maybe it's worth building this as open source. Would that be considered "open finance"?
- Gys 5y ago
  The access to my bank’s PSD2 API is only possible for authorized companies. I assume other banks require the same. They do not want to deal with individuals.
  - andruby 5y ago
    I know. As a dev, I don't like it, but I understand the bank's attitude. That's why individuals will need an intermediary, such as Nordigen (or Tink, Plaid, Truelayer, Ponto)
- wdb 5y ago
  I mean access to your investment portfolio, model portfolios, accounts, your transaction history, trades, pension plans etc.

acatton 5y ago

Take a look at https://woob.tech https://woob.tech. In a nutshell, it is a bunch of open source python modules which allows you to scrape websites as a unified API. (i.e "bank", "classified ads", "recipes", etc.) They mostly cover European (especially French, since the original author is French) banks. But they have some US ones.

pbronez 5y ago
Nice to see they renamed that project. The new name is more approachable.

marbu 5y ago

My bank fio.cz provides it's own user rest api, so that before you create an api access key, you can select which accounts it applies to and if it's read only access or not. I don't understand why there aren't more banks doing something like this. Btw the bank also offers PSD2, but I haven't looked into that so far, and I'm not sure if it's actually directly useful for a client. https://www.fio.cz/bank-services/internetbanking-api https://www.fio.cz/bank-services/internetbanking-api

rhn_mk1 5y ago

What makes it impossible in PSD2? The python-fints library can fetch available transaction history for supported banks no problem. https://github.com/raphaelm/python-fints https://github.com/raphaelm/python-fints https://python-fints.readthedocs.io/en/latest/reading.html#reading-account-transactions https://python-fints.readthedocs.io/en/latest/reading.html#r...

vesinisa 5y ago
Under PSD2 banks are required to give access to the "open" APIs only to audited partners (Third Party Payment Service Provider, TPP) They may give wider access, but most are somehow paranoid about the entire matter.

vesinisa 5y ago

> now nordigen (or someone else) has access to all this transaction data and is going to leak it somewhere. You must of course be able to trust the 3rd party, Nordigen in this case. But I don't think their operational license even allows storing your financial data - only proxying requests between you and the bank. So only your bank is even allowed to store your financial data. But of course you need to be able to trust that Nordigen indeed does not store and abuse your financial data -- just like you need to be able to trust your bank! Bear in mind though that Nordigen is supervised by the same financial regulation authority as your own bank, and if they were caught doing anything shady they would face very serious consequences - not to even speak of staining their reputation, which would be ruinous for a small startup. tl;dr: Banking is ultimately about trust, and nothing is ever perfect.

maverwa 5y ago
You are right, trust is the most important thing here. But nordigen does not want my money for their service. Instead they want to sell what looks like APIs for ML over your transaction data. So they at least have a good incentive to use my data for training their model. ofc, I dont know what they do with it, they may be cool ethical ppl just doing a cool thing and my mistrust might be totaly misplaced. But I have to trust another entity that proxies my connections. Another link in the chain. And I dont really want to hit on nordigen here, as I said, I dont know them, I have not read that whole website and havent looked in the details. For me its more about the generell problem. I find it sad that a service like this seems nessassary.
- aerique 5y ago
  They might be cool ethical people that might be bought up by Facebook or Google at some point.
vesinisa 5y ago
Read this comment below: https://news.ycombinator.com/item?id=28035602 https://news.ycombinator.com/item?id=28035602 Nordigen does actually reuse, store and sell your financial data in "anonymized" form. That's rather concerning.

elfrinjo 5y ago

It is rally terrible that such a service is actually necessary... PSD2 was a chance to create a standard api for everyone including customers. I still cannot understand how they managed to f it up by limiting access to "trusted companies"

delusional 5y ago
I work at a bank and it's quite simple really. The systems we use at my workplace are so antiquated and wonky that even giving people read access would be a monumental effort. To put it plainly, modernizing these systems takes effort similar in order of magnitude to landing on the moon. Not for any technical reason, but due to the mountains of manual processes and general cruft built up around them. The EU is not deaf to these concerns, and therefore the laws end up falling short for no other reason than that they want someone to actually be able to follow them. We are talking about things like "make a request at the wrong time and the system will be broken for the next 24 hours, and you are not allowed to speak to the people who know why". People (myself included until a few years ago) buy into this "banks need to be secure and move slowly to maintain that" but really most of it is due to mismanagement. The "move slowly" is a rationalization.
- elfrinjo 5y ago
  Oh, I totally agree (started my carreer in a company that still used VSE/ESA and CICS and sometimes dream about ASRAs). However, they had to implement modern api-stuff with PSD2 and then they made it strictly b2b-only :-(
- maverwa 5y ago
  Oh I think its a mix of both. But I do not have your insight ofc, so just guessing. I think banks should move slowly and pay extra attention to security. Examples like N26 show that not doing so can cause significant issues. But its also a great excuse to justify your vintage cruft.
- kreetx 5y ago
  But I can log in to my bank and see a transaction log and it doesn't seem to break anything. How would that break anything?