Guides
Open banking in Portugal: how it works and what is safe
7 min readUpdated on
Connecting a bank account to an application feels like a leap of faith. It is not. It is a mechanism defined by European law, with very concrete limits on what the application can and cannot do.
In this guide7
What PSD2 is
PSD2 is the second European payment services directive, in force since 2018 and transposed into Portuguese law. It requires banks to give customers a secure way to authorise third parties to read their account information.
The idea is simple and it favours the customer: your account data is yours, not the bank’s, and you decide who to share it with.
What happens when you connect an account
The process always takes the same shape, whatever the application.
- You pick your bank inside the application.
- You are taken to the bank’s own site or app, on the bank’s domain.
- You authenticate there, with your credentials and whatever strong authentication the bank requires.
- The bank asks which accounts you want to share, and for how long.
- The bank returns a time-limited consent to the application. The application never receives your password.
What the application can see and what it cannot do
PSD2 has two kinds of access and the difference matters. Account information access allows reading balances and transactions. Payment initiation allows ordering a transfer.
A personal finance app like Navefi uses only the first. That means it can read, and it cannot move money, change account details, apply for credit or alter anything at the bank. Even if the application were compromised, the access granted does not allow taking money out.
Who is allowed to offer these connections
Not anyone can connect to banks. You must be an entity licensed and supervised by a European regulator, or work through one.
It is worth checking. A serious application tells you which aggregation provider it uses and under what licence it operates. Navefi works with a licensed provider and publishes that information.
How to revoke access
You always have two doors. You can cut the connection inside the application, and you can revoke it directly at your bank, in the third-party authorisations area of online banking.
From the moment you revoke, the application receives no new information from that account.
What to check before connecting
Five questions any application should be able to answer in writing.
- Which aggregation provider is used, and under what licence?
- Is the access requested read-only, or does it include payment initiation?
- Where is the data hosted? Inside the European Union?
- Is financial data sold or shared with third parties?
- Can I export everything and delete my account without talking to anyone?
Frequently asked questions
Can an open-banking finance app transfer my money?
No, when the access granted is account information access, which is the case for personal finance applications. That consent allows reading balances and transactions and does not allow initiating payments or transfers.
Does the app hold my banking password?
No. Authentication happens on the bank’s own site or app. The application only receives a consent token issued by the bank, with a time limit and a limited scope.
How do I cancel an app’s access to my bank account?
You can cancel inside the application, and you can also revoke it in your bank’s online banking, in the third-party authorisation management area. Revocation takes effect immediately.