Open banking lets you give a company you choose access to your business bank account data, and since January 2018 UK banks have had to make that possible. Two safety questions come up before anyone clicks Allow, and both have short answers. A provider with read access can see your transactions but cannot move your money: reading an account and initiating a payment are separate permissions in law, and you grant them separately. Access then runs for 90 days and stops unless you confirm it again, and you can end it sooner from your bank or from the provider. What ending it won't do is erase the data you have already shared.

‍

Reading your account and moving your money are different permissions

The Payment Services Regulations 2017 define two separate services, and the difference between them is the whole answer to the question most directors are really asking.

An account information service is 'an online service to provide consolidated information on one or more payment accounts'. It reads. It can pull your balance and your transaction history, and that is the limit of what it can do. A payment initiation service is 'an online service to initiate a payment order at the request of the payment service user'. It can start a payment, but only when you ask it to, and only once you have authorised that payment at your bank.

So a firm holding read access to your account cannot take money out of it. This isn't a matter of trust or good behaviour: moving money is a different permission, granted separately, and most connections never involve it at all. When you connect your account to an accounting package or to a lender, you are granting the read one.

Either way, you log in at your own bank to approve it. Nobody in the chain sees your banking password or PIN, and we never see yours.

‍

What a read connection shows: your balance, your transactions, and who you pay

'Your data' is vague enough to be worrying on its own, so here is the actual list. When you connect a business account to iwoca, the connection is made through TrueLayer, the account information provider we use, which is authorised and regulated by the Financial Conduct Authority (FCA) under firm reference number 901096. Its consent screen names what gets shared: your full name, the account number and sort code, the balance, and the transactions, direct debits, and standing orders on the account. In a finance application we retrieve it in that order too, starting with the name on the account and ending with the transactions, both settled and pending.

That is a detailed picture of how money moves through a business. It is worth going in clear-eyed about that rather than reassured. Anyone reading it can see who pays you, what you pay your staff, which suppliers you use, and when you were last overdrawn. What it cannot show is anything outside the accounts you chose to connect, or your login.

Two business-account details are worth knowing, and consumer guides skip both. iwoca Credit Compass uses business accounts only: connect a bundle that includes a personal account and only the business accounts are used, and a connection with no business account in it is refused. And the figures drawn from your bank data are visible to the director who connected the accounts and to iwoca staff, but not to your fellow directors, which is different from the Equifax figures, which every director can see.

If you would rather see what a lender sees before sharing anything, Credit Compass shows you your Equifax business credit score and four more scores free, and its open banking connection is optional. It is also worth knowing which business bank account you are connecting, because that is the one being read.

‍

Access lasts 90 days, and you can end it sooner

Open banking consent is time-bound by design. It runs for 90 days from the moment you authorise it, and then it stops, with no further data collected until you connect again.

Renewing it got easier on 26 March 2022, when the FCA added an exemption to the strong customer authentication rules. Where your bank has taken that exemption up, you no longer need to log back in at the bank every 90 days; instead the provider has to ask you for explicit consent again, at least that often. Whether you get the smoother version depends on your bank, not on the provider.

You can disconnect before the 90 days are up, either in your bank's open banking settings or with the provider. In Credit Compass that is the Bank accounts page.

Then there is the part worth knowing before you connect rather than afterwards. Disconnecting stops any further data being collected. It does not delete the data you have already shared. Whatever we received while the connection was live, we still hold, and we use it under our privacy policy, which sets out the purposes it can be used for – neither of which covers referring you to products outside iwoca. That is how open banking works everywhere, not a quirk of ours. It is simply not what 'you can withdraw your consent at any time' tends to sound like.

‍

What we do with it when you apply to us

Connecting an account is an alternative to uploading bank statements, so the first thing it changes is how much you have to send us, and how much you have to dig out of online banking as a PDF.

The second thing matters more. Many banks only let you download three months of business statements, and if you are applying for finance, those three months are quite likely to be your worst three: the quarter you need money in is usually the quarter that looks thin. Judging a seasonal business on whichever statements it happens to be able to download is unfair to that business. A bank connection gives a longer history, drawn from the bank itself, and our credit analysts can adjust for a quarter that skews the picture in either direction. That argument comes from Anna Karina Nava, who has worked on open banking at iwoca since the project started in January 2018 – and in October 2018 we became the first alternative lender to connect to a UK bank using Open Banking, starting with Lloyds.

What we do with the transactions is categorise them – payroll, inventory, shipping, and the rest – and check the revenue arriving in the account against the revenue declared on the application. A quick decision isn't a light one. We look at your revenue and what your business can afford to repay before we make an offer, and our credit team reviews larger or more complex applications. A decision is usually made within 24 hours, though it might be longer depending on the complexity of the request.

One thing a connected account will not do is change what you can afford. It makes the application quicker and the picture of your business more accurate, and that cuts both ways: a clearer view can support a larger offer, and it can equally show that the timing is wrong. It buys you a better-informed answer, not a softer one.

{{flexi-loan="/components"}}

‍

How to check a provider before you connect

Open banking is not a fringe arrangement: Open Banking Limited reported more than 12 million active user connections in August 2026. Every firm offering it has to be authorised or registered with the FCA and listed in the Open Banking Directory, and both registers are public. Checking takes a minute, so look the company up on the FCA Register or in the Open Banking Directory before you grant access to anything.

The rules behind all this are the Payment Services Regulations 2017, rather than the EU directive they descend from, which no longer applies here. They set the requirements for consent, for secure communication, and for strong customer authentication – which is why approving a connection asks you for two things out of three: something you know, something you have, or something you are.

It is worth separating out one related term. Open finance is a proposed extension of the same idea beyond payment accounts, to things like savings, pensions, and insurance. It is not open banking, and it is not here yet.