Where open banking adds value
An authorised account-information connection can present transactions, balances and recurring payments to support an assessment of income and expenditure. A lender might examine salary receipts, housing costs, debt-service payments and cash-flow variability. Such records are not guaranteed to capture every relevant commitment: a borrower may use other accounts, receive cash income or pay bills through another household member. A balance snapshot does not itself establish dependable disposable income. The creditor should identify which underwriting questions the feed answers and use data over an appropriate period. The legal basis for access, the consumer's permissions where required and the lender's use of retrieved information must be documented separately from the statistical ability of a classification model to infer spending categories.
Legal permission, privacy and financial data access
Open banking is not a universal permission to retrieve or reuse all financial information. In the EU and UK, account-information services and associated customer authentication, permissions and data-protection rules need to be considered under the applicable payments and privacy framework. The creditor may be receiving information from an authorised third party or acting in another regulated role. The specific access channel, lawful basis, disclosed purpose and retention restrictions should be identified before implementation. The presence of an API token or screen-scraping capability is not itself a legal justification. In the United States, financial-data access and consumer reporting obligations can involve different rules and ongoing regulatory developments. Do not claim that a single EU consent mechanism or a US rule automatically authorises identical underwriting uses across jurisdictions.
CCD2 creditworthiness and information standards
Directive (EU) 2023/2225 Article 18 focuses on adequate, relevant and accurate information about the consumer's financial and economic circumstances. Open banking information may contribute to those objectives when appropriately obtained and used, but CCD2 does not require every lender to use a transaction aggregation provider. Article 19 on database access and applicable data protection provisions require separate analysis. National implementing measures generally apply from 20 November 2026, subject to transition; current Member State law remains relevant before that date. A lender should distinguish what the law requires about the assessment from what technology can conveniently supply. A machine-generated income estimate should not be treated as verified without assessing source quality, account coverage and material discrepancies.
UK CONC affordability and transaction data
FCA CONC 5.2A requires relevant lending firms to make a reasonable creditworthiness assessment, including affordability risk, using evidence appropriate to the individual circumstances. Open banking may help obtain evidence of income, outgoings or debt service, but it is not an automatic compliance certification. Where spending data is incomplete or unusual, reasonable further checks may be required. Statistical expenditure estimates may have limits when the lender knows that the consumer's circumstances differ materially from benchmark assumptions. The regulator's concern is whether the firm has assessed repayment capacity appropriately, not whether it purchased a particular data product. Firms should document the transaction period reviewed, exclusions, categories and why the derived estimates were suitable for that consumer and agreement.
Categorisation, duplicates and model uncertainty
Transaction classification systems can mistake transfers for salary, reimbursements for income, gambling-like merchant descriptions for a prohibited inference, or credit-card payments for a separate expense in addition to purchases. A user may also have multiple linked accounts; internal transfers then appear as both outgoing and incoming payments. The creditor should build reconciliation, source labels and quality checks into the calculation workflow. Outputs need confidence or exception flags for low coverage, unusual amounts and contradictory categories. A reviewer should understand which categories are estimated and which were verified against other records. This is particularly important for self-employed people, seasonal workers and borrowers sharing expenses with a partner. Preserve raw-to-derived mappings only to the extent lawful and necessary to reproduce important decisions.
Fairness, transparency and US distinctions
Financial transaction data can reveal sensitive patterns about a consumer. Appropriate safeguards are needed to avoid unlawful discrimination, irrelevant sensitive inferences and opaque decisions. In US credit decisions, ECOA and Regulation B apply to applicable nondiscrimination and adverse-action obligations, while consumer reporting obligations can arise depending on the data provider and product. The law and regulatory status of consumer-permissioned financial data access must be checked on the implementation date rather than assumed static. A creditor should not describe all transaction data as a traditional consumer report or all providers as exempt from reporting law. Document which information drove a denial when notice rules require it and provide a procedure for disputes about categorisation or inaccurate source information.
Operational testing and governance
Test scenarios should include missing accounts, revoked permission, failed authentication, duplicate transfers, irregular wages, shared household bills, credit-card repayments and transactions incorrectly classified as recurring essentials. The assessment process needs a proportionate fallback when data access is unavailable or the applicant declines a channel that is not legally compulsory. Monitor approval patterns, consumer complaints and realised repayment difficulty for signs that transaction classification or account coverage is biased or inaccurate. Define roles for the creditor, aggregator, bank and decision-model vendor, including incident notification, retention, security and model-update approval. A traceable record connects the legal purpose, permission or other lawful basis, source dates, transformation version, assessed amounts and final decision.
Frequently asked questions
Does one data source establish affordability?
No. The adequacy of the assessment depends on the governing law and the reliability and coverage of all relevant information.
When do CCD2 implementing requirements generally apply?
20 November 2026, subject to national law and transitional provisions.
Are a creditor's data access rights unlimited?
No. Permissible purpose, privacy, accuracy and related restrictions must be assessed.
Primary sources
Directive (EU) 2023/2225 Articles 18–19 ↗FCA CONC 5.2A ↗CFPB Regulation B ↗CFPB Regulation Z 1026.43 ↗US Fair Credit Reporting Act, 15 USC 1681 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.