Open banking for business lending: what you are agreeing to share

Open banking is, in the Financial Conduct Authority’s words, a secure and regulated way for people and businesses to share access to payments data from their bank account with trusted apps and services. You decide whether to share, and the sharing runs between your bank and the provider you choose.

The rules recognise two kinds of provider. An account information service provider (AISP) pulls information from your accounts. A payment initiation service provider (PISP) starts a payment for you. A lender checking your finances is using the first kind, usually through a regulated partner.

The rules sit in the Payment Services Regulations 2017. Capzy does not give legal advice, so read the consent screen and the provider’s terms for the detail that applies to you.

Lenders ask for it because transaction data shows how money moves through a business, which a statement PDF or a credit file cannot show as fully. It can also save you gathering and sending documents.

• Whether takings come in steadily or in bursts
• How much leaves the account each month and to whom
• Whether regular commitments such as loan repayments are being met
• Whether the figures match what you put on the application

Different lenders use it differently, and it is usually one input among several. Any decision remains subject to status and that lender’s criteria. Our guide to how to compare business lenders explains what to weigh once offers arrive.

You are agreeing to let a provider see information from the accounts you choose and the transactions on them, for the purpose you have been told about. The regulations say an account information provider must not access any information other than that from designated payment accounts and associated payment transactions.

Ask yourself whether each item is needed for the decision being made. A lender looking at a trading account has no need for a personal savings account, and you can choose not to connect it.

Check the wording on the consent screen for which accounts, which data and for how long, since terms differ between providers.

An account information service gives a provider information, not control. Moving money is a separate service, payment initiation, which is a different kind of consent.

When you connect, you normally sign in with your own bank rather than giving the lender your login. The rules require banks to let providers rely on the bank’s own authentication procedures, and they prohibit providers from letting your credentials reach other parties.

You check the provider on the Financial Services Register before you connect. The FCA says to make sure you are confident the company is genuine, and that unauthorised firms cannot offer you Financial Ombudsman Service protection.

• Look the firm up on the Financial Services Register and confirm it is authorised or registered for account information services.
• Make sure the connection starts from your own bank’s sign-in page.
• Ask the lender or broker which firm handles the connection and what it will be used for.
• Call the FCA consumer helpline on 0800 111 6768 if you are unsure.

A broker should be willing to say which lenders ask for this and why. If nobody can tell you, wait.

You can manage or end access through your provider’s settings and your bank, and you can decline to connect at all. The FCA’s consumer guidance recommends managing permissions with your provider.

Declining may change the route, not necessarily close it. A lender may ask for statements instead, or may need the data to proceed, depending on its criteria. Ask before you apply.

The main risks are sharing more than you intended and sharing with a firm you did not check. Transaction data can reveal customers, suppliers, payroll and personal spending if the account is mixed.

Personal data about staff or customers may appear in the transactions, so ask your adviser about data protection if you are unsure.

You are sent from the application to a consent screen, then to your own bank to sign in and approve, and then back to the application. The steps vary by provider, but the pattern is usually the same.

1. The lender or its data partner asks you to connect and names the provider handling the connection.
2. You choose your bank and the account to share.
3. You sign in on your bank’s own page using its normal security checks.
4. You review what you are agreeing to and confirm.
5. You return to the application, and the provider reads the information it was allowed to read.

Stop at step four if anything looks different from what you were told. You are entitled to read the permissions before you confirm, and you can close the window without connecting.

The commonest mistakes are connecting the wrong account, clicking through without reading and forgetting the connection afterwards.

• Connecting a personal account that is mixed in with business spending
• Skipping the purpose and duration on the consent screen
• Assuming consent ends by itself without checking
• Applying to several lenders at once and connecting every time without tracking who has access

Keep a short list of each lender or provider you have connected, and review it after each application. Tidy, separate business accounts also make the data easier for a lender to read, which is one reason to keep personal spending out of them.

Capzy is a credit broker, not a lender, and is paid by the lender. We introduce businesses to lenders, and some of those lenders may ask to see bank data as part of an application. The lender directory shows the types of finance on offer.

You can check your funding options with a soft search that does not affect your credit score. A full application to a lender may involve a hard search, and any offer is subject to status and lender criteria. If your account history is patchy, why business loans get declined and business loan requirements show what lenders look for.