Open Banking Data and Credit Decisions

Identify the open banking service and data flow

Open banking can allow a consumer to connect a payment account so that account information is accessed through an authorised service, potentially supporting a lender’s assessment of income and expenditure. The legal route matters. Under PSD2, account information services have defined functions and access conditions; not every screen-scraping or account-link product automatically qualifies in the same way. Establish which entity is the account information service provider, which entity is the creditor, what permission the consumer grants and which data reaches the lender. PSD2 access permissions and GDPR processing lawful bases are legally distinct. A connected account is not an unlimited mandate to reuse transaction histories for unrelated purposes.

Distinguish payment-services consent and GDPR lawful basis

PSD2 Article 67 refers to explicit consent of the payment service user for account information access, and the EBA has explained that consent and authentication need to be considered within the payment-services framework. That does not, by itself, establish that GDPR consent is the lawful basis for every downstream processing operation. The creditor must separately map its Article 6 basis, information duties and applicable national obligations. A service provider sharing account information with a lender also needs an appropriate legal assessment. Design the interface so the consumer can understand which accounts, time periods and categories of information are being accessed and what happens if connection is declined.

Select information relevant to creditworthiness

Transaction feeds can reveal recurring income, rent, utilities, debt repayments and volatility, but individual transactions may be ambiguous. A transfer between a consumer’s own accounts should not automatically count as income twice, and a one-off incoming payment should not automatically be treated as stable earnings. Under CCD2 Article 18, in-scope creditworthiness assessment relies on sufficient relevant information and cannot be based exclusively on past credit history. Data processing restrictions and national implementing rules must be checked. Describe how categorisation, exception handling and consumer explanations address uncertainties rather than claiming a bank feed reveals every financial commitment.

Prevent excessive or unexpected data use

A raw bank statement can expose details irrelevant to lending, including sensitive inferences about health, religion or private life. Apply GDPR data minimisation, purpose limitation, security and retention standards to the actual fields processed and retained. Consider whether aggregated income and expenditure features meet the assessment need without preserving full transaction descriptions. Evaluate whether Article 9 special-category issues can arise and avoid treating incidental data exposure as permission for underwriting features. Access controls should distinguish initial retrieval, model development, support review and complaint investigation. A vendor should not keep copies indefinitely simply because storage is technically inexpensive.

Evaluate automated categorisation and decisions

Open banking underwriting often uses software to group transactions, estimate net disposable income or identify unusual spending. Incorrect classification can materially distort a decision. Validate source coverage, model version, account ownership, currency and handling of missing months. When automated outputs determine credit availability with legal or similarly significant effects, analyse GDPR Article 22 and applicable CCD2 safeguards. Allow meaningful correction of errors in categorised transactions and a route for human examination where required. A human approval step should not be described as meaningful review unless the reviewer can assess and change the result. Test the workflow on accounts with irregular income and multiple banks.

Control providers, revocation and evidence

A controlled integration records the account information service provider, requested scope, authorisation event, relevant data window, transmission protections and the lender’s own decision purpose. Review withdrawal or expiry of access permissions, ongoing retrieval and retention separately: ending future access does not automatically erase every record retained under another lawful basis, and retention still requires justification. Test provider outages, revoked access, mismatched account holders and duplicate feeds. Assess security incidents and third-country transfers where relevant. Revalidate source mapping after API changes and preserve proportionate evidence of the information used. This supports a defensible credit process without confusing PSD2 service permission with a universal authority to obtain or keep personal data. If a consumer declines an open banking connection, the lender should assess whether another evidence route is available or required under the relevant law, rather than declaring that every applicant must surrender account access. Explain how payment account data is transformed into assessment outputs and who can correct a misclassification. Document any different procedures for accounts held at multiple institutions. The disclosure should describe the operation actually performed, not suggest that an open banking provider has independently decided credit eligibility when that responsibility remains with the creditor.

Frequently asked questions

Related research

credit data and credit reporting compliance overview ↗

Credit Decisions Based on Credit Bureau Data ↗