Open Banking: safe, secure, and widely used

What is open banking?

Open banking is a system introduced by the UK's Financial Conduct Authority (FCA) and mandated under PSD2 (Payment Services Directive 2). It requires banks to give customers a secure way to share their financial data with authorised third-party providers — but only with the customer's explicit consent.

When you connect your bank through an open banking flow, you are redirected to your own bank's login screen. You log in with your bank directly — not with us. Your bank then releases a read-only data feed. We never see your passwords, PINs, or security credentials.

How is it regulated?

Open banking in the UK is overseen by two bodies:

• The Financial Conduct Authority (FCA) — authorises and supervises all Account Information Service Providers (AISPs). Only FCA-registered firms can receive bank data through open banking.
• Open Banking Limited (OBL) — the implementation body set up by the Competition and Markets Authority (CMA). It sets the technical standards and security requirements that every participant must meet.

The data provider we use, GoCardless Bank Account Data (formerly Nordigen), is a registered AISP authorised by the FCA. All data in transit is encrypted with TLS 1.2+, and access tokens expire automatically after the period you authorise.

Where is open banking already used?

Open banking is not a new or niche technology — it is embedded across mainstream financial and consumer services. You may already have used it without realising:

• Mortgage lenders — Nationwide, Halifax, and others use open banking to verify income and outgoings during affordability checks, replacing months of paper statements.
• Credit brokers and lenders — Experian, ClearScore, and comparison sites use it to show live account balances and tailored credit offers.
• HMRC — uses open banking as a payment method for self-assessment tax bills.
• Utilities and telecoms — energy suppliers and broadband providers use it for credit assessments and switching services.
• Accounting platforms — Xero, QuickBooks, and FreeAgent use it to automatically import bank transactions.
• Payroll and HR platforms — Tide, Monzo Business, and Revolut use open banking connections to verify payroll deposits.
• Letting agents and property platforms — Rightmove, Homeppl, and referencing providers across the UK now use open banking as standard for income verification during tenancy applications.

According to Open Banking Limited, there were over 11 million active open banking users in the UK by 2024, with more than 9 billion API calls made annually. It is firmly mainstream.

Why does MyChecksAI use it for tenant referencing?

Traditional income verification relies on applicants uploading bank statements as PDF or image files. This creates two problems: it is slow (chasing documents takes days), and it is easy to falsify (PDF editors and image manipulation are widely available).

Open banking solves both:

• Speed — income data arrives in seconds directly from your bank, rather than waiting for documents to be uploaded and reviewed manually.
• Accuracy — the data comes straight from the source. It cannot be altered, edited, or fabricated.
• Less friction for you — rather than hunting down 3 months of statements and uploading files, you authorise access once and the check is complete.

We use open banking to verify regular salary or income deposits, assess affordability relative to the rent, and check for any patterns of concern — the same analysis a mortgage underwriter would conduct, just faster.

What data do we access?

We request access to up to 90 days of transaction history from the account(s) you choose to share. Specifically, we look at:

• Incoming credits (salary, self-employment income, benefits)
• Regular outgoing commitments (rent, loans, subscriptions)
• Account balance trends

We do not access savings accounts, credit card accounts, or any account you do not explicitly select. You choose which account(s) to connect during the authorisation flow.

Your rights and how to revoke access

You are in control at every step:

• Consent is always explicit — you must actively authorise access via your bank's own interface. We cannot access data without this step.
• You can revoke access at any time — most banks let you manage open banking permissions in your app under Settings → Connected Apps (or similar). You can also contact us directly to request deletion.
• One-time access — we do not set up ongoing or recurring data access. The connection is for the duration of this referencing check only.

For questions about how we handle your data, email us at privacy@mychecksai.com or read our full Privacy Policy.