PSD2 explained for people who are neither developers nor lawyers

1. What it changed

Before, your bank held your data and there was no standard way to use it elsewhere. PSD2 established that if you give explicit consent, an authorised third party can read your account information through a proper channel.

That is the whole basis of tools like this one. Not a loophole, not a private deal with a bank: a right you exercise, with rules attached.

2. Consent and strong authentication

Two pieces do the heavy lifting. Consent has to be explicit, informed and limited in time. And authentication has to be strong: your bank confirms it is you, with a second factor, on its own channel.

Together they explain the two things people find annoying about the flow — the redirect to the bank and the periodic renewal — and both are protections rather than friction.

3. Reading data and moving money are different permissions

The regulation separates account information access from payment initiation. They are distinct services with distinct authorisations, and an app that only needs to show you your finances only needs the first one.

This is why "read-only" is a meaningful statement in this context rather than marketing language. The categories exist in the regulation itself.

• Account information access: read balances and transactions.
• Payment initiation: order a payment on your behalf — a separate permission.
• FinBoard uses the first one only.

4. What it means for you in practice

You can consolidate accounts from different banks without giving anyone your passwords, and you can withdraw that permission whenever you like. The bank cannot refuse the connection because it would rather keep you inside its own app.

That is a genuinely good deal for you, and it is worth knowing it exists — including for judging any app that asks you for something more than this.