Is It Safe to Connect Your Bank to an App? Open Banking Explained (and What PSD3 Changes)

There's a question almost everyone asks the first time they connect a bank account to an app: "is this actually safe?" It's a fair question, and it deserves a clear answer — not a marketing line.

First things first: what "connecting your bank" actually means

When you connect a bank account through Open Banking, you're not handing anyone your login credentials or giving permission to move your money. It's read-only access: the app can see your balances and transactions to show them to you in one place, but it can't make transfers, payments, or any operation on your behalf. We never share your data with third parties.

The regulation that makes this possible: PSD2

This doesn't run on trust alone. Since 2018, the EU's PSD2 directive has required banks to open a secure, regulated channel (an API) so authorised providers can access your financial data — always with your explicit, renewable consent. Before PSD2, some apps relied on credential scraping, essentially logging in as you with your own username and password, which was far less secure and far less transparent. PSD2 replaced that with API connections supervised by each country's banking regulator. In Spain, that means the provider we use to connect your bank (GoCardless) operates under that regulation, not around it.

What changes with PSD3 and the new Payment Services Regulation (PSR)

Worth being precise here, since there's a lot of noise online about the timeline. As things stand:

• In November 2025, the European Parliament and the Council reached a provisional political agreement on PSD3 and the new Payment Services Regulation (PSR).
• In April 2026, the Council of the EU published the final compromise text. A formal vote in Parliament and Council, plus publication in the EU Official Journal, is still pending.
• The PSR is expected to enter into force around mid-2026, but its practical obligations (stronger authentication, fraud liability, open banking standards) won't be enforceable until late 2027. PSD3, being a directive, needs each country to transpose it into national law — a process expected to run through 2027-2028.

In short: PSD3 isn't a distant promise, but it's also not something that changes your bank connection tomorrow. Today you're still operating under PSD2, which is already a solid framework — and one that already covers accounts held anywhere in the EU/EEA, useful to know if you're managing money across borders.

What's actually new

• It merges the current PSD2 and the Electronic Money Directive into a single rulebook.
• It clarifies who's on the hook when someone falls for an authorised push payment scam — banks may have to cover part of the loss if they didn't meet expected fraud-detection standards.
• It introduces a requirement to accept future EU digital identity wallets (EUDI wallets) as a verification method.
• Net effect: more accountability for banks, more consistency across countries, an extra layer of security — not a shake-up that requires you to do anything differently as a user.

What this means for you, today

Being able to connect your bank, broker and accounts without handing your password to anyone isn't a marketing trick — it's an existing regulatory requirement. PSD3 will reinforce that framework, not replace it with something built from scratch. If you already trust connecting your account via Open Banking, nothing here suggests that's about to change for the worse — if anything, it's heading toward more control, not less.

Once everything is connected, the exercise that surprises people most is looking at what each account charges you just for being open.

Start free, no card required at finboard.me.

Verified as of September 2026. The PSD3/PSR timeline can move — if you're reading this later, check the current status before citing it.