Financial data access is a customer's ability to direct a bank, insurer, investment firm or other financial institution to share the data it holds about them with a third party they choose. The term covers both the legal right to have the data shared and the technical machinery that moves it safely. It is also called account data sharing, and in the European Union it is the name of a proposed law, the Financial Data Access Regulation, usually shortened to FiDA.
Financial data access is the legal backbone of open banking and its wider successor, open finance. It is different from a customer simply downloading a statement: the data flows directly from the holder to a named recipient, under the customer's account data sharing permission, and both firms take on obligations. The main questions every framework must answer are what data is covered, who may receive it, who pays, and who is liable when something goes wrong.
Financial data access in plain terms
Imagine your doctor keeps your medical records, and a specialist needs them. You could photocopy the file and post it, or you could sign a form telling the doctor's office to send it directly, only to that specialist, only for this treatment. Financial data access is the signed form, applied to money. Your bank or pension provider holds the records; you decide who else may read them.
The rules make sure the form means something. The bank must send the data if you ask, the recipient must be trustworthy and use it only for the purpose you agreed, and you can cancel the arrangement whenever you like.
How financial data access works
A typical data-sharing journey has three parties: the customer, the data holder (for example a bank) and the data user (for example a budgeting app or lender). The steps are usually:
- The data user explains what data it wants, for what purpose and for how long, and asks for consent.
- The customer is sent to the data holder, logs in with strong customer authentication and confirms which accounts may be shared.
- The data holder issues a token to the data user, who then calls the holder's bank API to fetch balances, transactions or product details.
- The customer can see and revoke active permissions in a dashboard at either firm.
Where no API exists, some firms still use screen scraping: the customer hands their login details to an account aggregation service that logs in on their behalf. Regulators have been pushing the market away from this towards token-based APIs, because sharing passwords weakens security and blurs liability.
The EU Financial Data Access Regulation (FiDA)
The European Commission proposed FiDA on 28 June 2023 as part of a package with PSD3 and the Payment Services Regulation. Its main features, as proposed, are:
- Scope. It reaches data on mortgages, consumer credit, savings, investments, crypto-assets, occupational and personal pensions and non-life insurance, beyond the payment accounts already covered by PSD2, where an account information service provider reads data and a payment initiation service provider starts payments.
- Financial data sharing schemes. Data holders and users must join industry schemes that set technical standards, compensation (data holders may charge a reasonable fee) and dispute rules.
- Permission dashboards. Customers get a dashboard showing every permission they have granted.
- Licensed recipients. A new category of financial information service provider would need authorisation to receive data.
As of November 2026 FiDA had not been adopted; trilogue talks between the European Parliament, the Council and the Commission were continuing, with disagreement over scope, timing and whether large digital "gatekeepers" should be allowed to receive data.
Financial data access in the United States and elsewhere
In the United States, Section 1033 of the Dodd-Frank Act gives consumers a right to access their financial account data. The Consumer Financial Protection Bureau issued a final Personal Financial Data Rights rule in October 2024, with compliance originally due to start for the largest institutions in April 2026. After a legal challenge, a federal court enjoined enforcement, and the Bureau opened a new rulemaking in August 2025 that reconsiders, among other things, whether data holders may charge fees. In 2026 the rule was being rewritten. In the UK, open banking rules sit in the Payment Services Regulations and a 2017 Competition and Markets Authority order. India's Account Aggregator system and Brazil's Open Finance programme give broad data access through licensed intermediaries.
Uses, safeguards and criticism
Financial data access supports lending decisions, affordability checks, KYC, bank account verification, personal finance tools, embedded finance and switching. It overlaps with general data protection law: in Europe, GDPR already gives a right to data portability, but without the real-time, standardised interfaces that sector rules require. Safeguards include purpose limits, bans on reselling data to a data broker, security standards and liability rules for data breaches and unauthorised payments. Critics on the industry side object to building free interfaces for competitors; consumer groups worry about pressure to share data in exchange for credit or insurance. Supporters answer that customers own the data and that access drives competition from fintech firms.