Account Information API

An account information API is an application programming interface, offered by a bank or other account provider, that allows an authorised third party to retrieve information about a customer's payment account, such as the account name and number, current balance and transaction history. The customer must agree to the access, and the third party is usually a regulated firm such as a budgeting app, lender, accounting platform or identity checking service.

The account information API is one of the two core building blocks of open banking, alongside the payment initiation API. In the European Union and the United Kingdom, the right of third parties to use it comes from PSD2, which created the regulated role of the account information service provider (AISP) and obliged each account servicing payment service provider (ASPSP) to give such firms access. Similar regimes exist or are being built in Australia, Brazil, the United States and elsewhere.

A typical data request follows a set sequence:

1. The customer asks the third-party app to connect a bank account and agrees to share specific data for a stated purpose and period.
2. The app sends a consent request to the bank's API and redirects the customer to the bank, or to its app, to log in.
3. The bank applies strong customer authentication, shows what will be shared and asks the customer to confirm.
4. The bank issues an access token to the third party, which then calls endpoints for accounts, balances and transactions until the consent expires or is withdrawn.

Data is returned in a structured format, usually JSON, defined by a common standard so that the same app can work with many banks. Some standards also cover standing orders, direct debits, saved payees, product details and statements.

Rather than each bank designing its own interface, most markets use shared specifications. In the UK, the largest banks were required to build the Open Banking Standard, overseen first by the Open Banking Implementation Entity. In the EU, many banks follow the Berlin Group's NextGenPSD2 framework, while others use national or bank-specific designs. PSD2 rules allow a bank to provide access through a dedicated interface for third parties rather than through its customer-facing website. Third parties prove their identity using certificates issued under the EU eIDAS framework or by checking against an open banking directory that lists authorised firms and their roles.

Because bank interfaces still differ in practice, many apps reach banks through aggregators that maintain connections to hundreds or thousands of institutions and offer one combined interface, a practice described as API aggregation.

Access rests on the customer's explicit permission, and handling the permission over time is a field of its own, known as consent management. Consents usually name the data categories, the purpose and an expiry date. Under the original European technical standards, customers had to re-authenticate with their bank at least every 90 days; later EU and UK changes moved much of this renewal to the third party, reducing broken connections. Customers can end access at any time through the app or the bank, a step covered by consent revocation. Data protection law, such as the General Data Protection Regulation, applies alongside payment rules and limits how the data may be reused.

• Personal finance. Budgeting and savings apps combine accounts from several banks into one view, a form of account aggregation.
• Lending decisions. Lenders read real income and spending data to check affordability faster than with paper statements.
• Accounting and bookkeeping. Small business software pulls bank feeds automatically for reconciliation.
• Verification. Payment and onboarding firms confirm that a customer owns an account before paying out or setting up a debit.

Before standard APIs, aggregators collected data by data scraping: they stored the customer's online banking password and logged in as the customer. This gave banks little control, exposed credentials and broke whenever a website changed. An account information API replaces this with token-based access, defined data scopes and an audit trail. Scraping still exists in markets without mandated APIs, and in the United States the move to API-based access has been driven partly by industry standards and partly by rules on consumer data rights. The wider push to extend the same model to savings, pensions, insurance and investments is known as open finance.