What can a budgeting app actually see? PSD2 in plain words

A budgeting app connected under PSD2 can see transaction, balance, and basic account details for the accounts you approved — and nothing else. It cannot see your bank password, cannot move money, and your bank re-asks you for strong authentication periodically. Those limits are not the app being polite. They are EU law. Here is what the law actually says, in plain words.

What PSD2 is

PSD2 (the second Payment Services Directive) is the EU law that lets you share your bank account data with a licensed third party, with your explicit consent. It is Directive (EU) 2015/2366, applied since 13 January 2018, and the sharing happens under the supervision of financial regulators.

Before PSD2, your transaction history was locked inside your bank. PSD2 created regulated access to eligible payment-account data when you consent, and required banks across the EU/EEA to build a secure channel for it. This is the framework that lets an app like Bilance, made for European banks, sync and categorise your accounts automatically without ever touching your bank credentials.

The permission model: two very different licences

PSD2 defines two separate kinds of third-party access:

• Account information (AISP — account information service provider): permission to read account data. This is what budgeting apps use.
• Payment initiation (PISP — payment initiation service provider): permission to start a payment, approved by you one payment at a time. Budgeting apps that only track your money do not have or need this.

The two are separate regulated services under PSD2 (Articles 66 and 67), each needing its own consent from you. A provider may be authorised for both, but an account-information permission on its own never authorises a payment. National supervisors keep public registers of these providers, collected in the EBA’s central PSD2 register. Bilance’s connections run through two named, regulated providers: GoCardless (supervised by France’s ACPR) and Enable Banking (supervised by the Finnish FIN-FSA), both listed in our privacy policy.

What data actually flows

With account-information access, the app receives, for the accounts you approved:

• the list of transactions (date, amount, counterparty, reference text),
• current balances,
• the account’s name, type, and identifier (such as its IBAN).

What never flows: your login credentials, and anything on accounts you did not approve. You authenticate at your own bank, and the bank passes the app a limited-time token instead of anything you could log in with. The step-by-step of what this looks like in practice is in how bank sync works.

The time limits

PSD2 access is not permanent. Your bank must ask you to authenticate again when more than 180 days have passed since the last check (Regulation (EU) 2022/2360, applied since 25 July 2023). How often you actually see it depends on your bank and on the open-banking provider behind the connection: some are on the 180-day maximum, others still re-ask closer to every 90 days, the previous limit. Until you confirm, the syncing stops and the connection waits for you to reconnect it. You also do not have to wait for that: in Bilance you can stop the syncing or delete a bank connection at any moment, and the data sharing stops with it.

Why the EU frame matters

PSD2 makes these protections legal requirements rather than optional promises. Banks must offer the secure channel, providers are supervised, and consent must be explicit and renewable. You still need to trust the app and its providers to implement the requirements correctly and to protect the data after it arrives. GDPR then governs what the app does with the data afterwards, including your right to have it erased on the grounds the regulation lists.

The one thing PSD2 does not decide is what a company does with your data once it has it. That is a business-model question worth asking of any app you trust with your accounts. Bilance uses this framework to connect 2,300+ banks across Europe — check if yours is covered.