It is rally terrible that such a service is actually necessary... PSD2 was a chance to create a standard api for everyone including customers. I still cannot understand how they managed to f it up by limiting access to "trusted companies"

I work at a bank and it's quite simple really. The systems we use at my workplace are so antiquated and wonky that even giving people read access would be a monumental effort. To put it plainly, modernizing these systems takes effort similar in order of magnitude to landing on the moon. Not for any technical reason, but due to the mountains of manual processes and general cruft built up around them. The EU is not deaf to these concerns, and therefore the laws end up falling short for no other reason than that they want someone to actually be able to follow them.

We are talking about things like "make a request at the wrong time and the system will be broken for the next 24 hours, and you are not allowed to speak to the people who know why".

People (myself included until a few years ago) buy into this "banks need to be secure and move slowly to maintain that" but really most of it is due to mismanagement. The "move slowly" is a rationalization.

But I can log in to my bank and see a transaction log and it doesn't seem to break anything. How would that break anything?

Oh, I totally agree (started my carreer in a company that still used VSE/ESA and CICS and sometimes dream about ASRAs). However, they had to implement modern api-stuff with PSD2 and then they made it strictly b2b-only :-(

Oh I think its a mix of both. But I do not have your insight ofc, so just guessing. I think banks should move slowly and pay extra attention to security. Examples like N26 show that not doing so can cause significant issues.

But its also a great excuse to justify your vintage cruft.

I think they do not want to deal with individuals not understanding oath2 flow, the API calls or having typos in python ;-)

My bank fio.cz provides it's own user rest api, so that before you create an api access key, you can select which accounts it applies to and if it's read only access or not. I don't understand why there aren't more banks doing something like this. Btw the bank also offers PSD2, but I haven't looked into that so far, and I'm not sure if it's actually directly useful for a client. https://www.fio.cz/bank-services/internetbanking-api

I think some banks do offer restricted keys that only allow you to access your own accounts - I think Starling in the UK does this; Monzo used to too, but I'm not sure if that's the Open Banking API, or just another API.

Starling[1] and Monzo[2] have their own APIs accessible to end users which are not Open Banking[3]. Monzo has a separate set of OB APIs and AFAIK Starling doesn't have an OB API as only the big, high-street UK banks (HSBC, Barclays, RBS, Santander, Bank of Ireland, Allied Irish Bank, Danske, Lloyds, Nationwide) were forced to implement the OB spec.

[1]: https://developer.starlingbank.com/

[2]: https://docs.monzo.com/

[3]: https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385...

Take a look at https://woob.tech. In a nutshell, it is a bunch of open source python modules which allows you to scrape websites as a unified API. (i.e "bank", "classified ads", "recipes", etc.)

They mostly cover European (especially French, since the original author is French) banks. But they have some US ones.

Nice to see they renamed that project. The new name is more approachable.

> now nordigen (or someone else) has access to all this transaction data and is going to leak it somewhere.

You must of course be able to trust the 3rd party, Nordigen in this case. But I don't think their operational license even allows storing your financial data - only proxying requests between you and the bank. So only your bank is even allowed to store your financial data.

But of course you need to be able to trust that Nordigen indeed does not store and abuse your financial data -- just like you need to be able to trust your bank! Bear in mind though that Nordigen is supervised by the same financial regulation authority as your own bank, and if they were caught doing anything shady they would face very serious consequences - not to even speak of staining their reputation, which would be ruinous for a small startup.

tl;dr: Banking is ultimately about trust, and nothing is ever perfect.

You are right, trust is the most important thing here. But nordigen does not want my money for their service. Instead they want to sell what looks like APIs for ML over your transaction data. So they at least have a good incentive to use my data for training their model.

ofc, I dont know what they do with it, they may be cool ethical ppl just doing a cool thing and my mistrust might be totaly misplaced.

But I have to trust another entity that proxies my connections. Another link in the chain.

And I dont really want to hit on nordigen here, as I said, I dont know them, I have not read that whole website and havent looked in the details.

For me its more about the generell problem. I find it sad that a service like this seems nessassary.

They might be cool ethical people that might be bought up by Facebook or Google at some point.

Read this comment below: https://news.ycombinator.com/item?id=28035602

Nordigen does actually reuse, store and sell your financial data in "anonymized" form. That's rather concerning.

What makes it impossible in PSD2? The python-fints library can fetch available transaction history for supported banks no problem.

https://github.com/raphaelm/python-fints

https://python-fints.readthedocs.io/en/latest/reading.html#r...

Under PSD2 banks are required to give access to the "open" APIs only to audited partners (Third Party Payment Service Provider, TPP) They may give wider access, but most are somehow paranoid about the entire matter.

For what PSD2 done is it made that Nordigen service possible, also I can see my history from one bank in another. Results (possibilities) greatly vary from bank to bank, but in general at least I can download my data from one place.

I get your complain, but It's a step forward at least.

Would you be interested in something similar for open finance?

What does "open finance" mean in this context?

I have the same desire as OP to access my own data. I want to build a tool to track my assets. Maybe it's worth building this as open source. Would that be considered "open finance"?

The access to my bank’s PSD2 API is only possible for authorized companies. I assume other banks require the same. They do not want to deal with individuals.

I know. As a dev, I don't like it, but I understand the bank's attitude. That's why individuals will need an intermediary, such as Nordigen (or Tink, Plaid, Truelayer, Ponto)

I mean access to your investment portfolio, model portfolios, accounts, your transaction history, trades, pension plans etc.