PSD2 is a European directive establishing that you may share your bank data with someone other than your bank. Not that your bank may do so, but that you get to decide, and your bank then has to facilitate it.
For you as an account holder it means one thing: if you want an app to see your balances and transactions, your bank cannot stand in the way. And if you do not want that, nothing changes.
The two services it enables
| Service | What the provider does | Example |
|---|---|---|
| Account information service | Reads your balances and transactions | A net worth overview or budgeting app |
| Payment initiation service | Starts a payment with your consent | An alternative to iDEAL at checkout |
This distinction is the most important thing in this article. An app that tracks your wealth needs only the first. The second, where money actually moves, is a separate service with separate consent.
What an app can see
- Your balance
- Your credits and debits, with date, amount and description
- The counterparty account and name
That is enough to know what you earn, what you spend and on what. Worth being clear-eyed about before you consent.
What an app cannot do
With account information access only, a provider cannot transfer money anywhere, cannot set up direct debits or standing orders, cannot change anything about your account, and cannot close it. Read access is exactly that, and the connection runs one way.
How supervision works
A provider wanting to read your bank data needs a licence. In the Netherlands, De Nederlandsche Bank issues those licences. The AFM supervises the information such providers give and how they treat customers, and the Dutch data protection authority oversees how your personal data is processed.
Licence holders appear in a public register, but in practice you do not need to check it yourself: your bank verifies a valid licence before anything is shared. No licence, no connection.
Consent is temporary
This is the part most people do not know, and it is precisely what makes PSD2 robust.
Your consent expires. An account information provider has to ask you again periodically; according to De Nederlandsche Bank that is at most every 180 days. So twice a year you confirm that you still want this, which is the design rather than a defect.
Many older articles cite 90 days. That limit was later extended for account information services, so if you come across that figure you are reading outdated information.
You can also withdraw consent yourself at any time with the party you gave it to.
What to check before consenting
- Is this an account information service, or a payment service too? A wealth overview needs only the first.
- Where is my data held, inside the EU or not, and for how long?
- What happens to it beyond the service itself? Read the privacy statement, not the marketing page.
- How do I withdraw? If that is hard to find in the app, take it as a signal.
- Can I export my data and delete my account? That should be possible without an email exchange.
How Gylder does it
Bank connections in Gylder are read-only: balances and transactions are retrieved, and no money can be moved. Your data is stored encrypted on servers within the European Union, and you can export it or delete your account whenever you want.
PSD2 connections arrive in September 2026. Until then bank accounts are added manually, investments are imported through a broker export, and crypto connects through read-only API keys.