Is Open Banking safe when applying for finance?

The security model

Open Banking was introduced under UK regulation so that sharing bank data could happen through secure, supervised channels rather than ad-hoc file sharing. You start the connection inside your own bank's login or app, which means your banking credentials never reach the lender — they stay with the bank, exactly as they would for any other login. The lender receives a token that lets it read your transactions, nothing more. The full picture is in the Open Banking lending guide.

Consent, scope and time limits

Access is never open-ended. When you connect, you agree to a defined scope — typically read-only sight of your business account transactions — for a limited period, and you can see what you are agreeing to before you confirm. The lender cannot quietly expand that access later; any change needs your fresh consent. This is a deliberate part of the design: you grant a specific, time-boxed view, not a blank cheque over your account.

Revoking access

Because consent is yours to give, it is also yours to take back. You can withdraw a lender's Open Banking access at any time, either through your bank's app or by contacting the provider, and the read-only view stops. This matters: it means connecting for an application does not tie you to anything permanent. If you change your mind, the access ends. For how the company's data is handled more broadly, see how Credicorp protects your data.

What this means for your company

Open Banking is generally safer than emailing statements around, because the data moves through a regulated, encrypted channel and you keep control of consent. It is read-only, password-free and revocable — a lender can see your trading but cannot touch your money. If you would still rather not connect, the manual route remains open: see do I need to connect my bank account. Credicorp lends to the UK limited company and does not take a personal guarantee.