Open banking consent is the customer's permission for a regulated provider to access specific accounts and data, or to make a specific payment, for a defined period. The customer gives it at their own bank, can see exactly what they shared, and can withdraw it at any time. Ongoing data access has to be reconfirmed at least every 90 days.
What consent covers
Open banking consent is deliberately narrow. When a customer connects, they are approving three things at once: which accounts are included, which categories of data (or which payment) are allowed, and for how long. A request for a one-off affordability check looks different from a request for 12 months of ongoing access, and the customer sees that difference before they approve. Nothing outside the agreed scope is shared, and the provider cannot widen it later without a new consent.
For a business, the practical rule is to ask for the least you need. A tighter request is approved more often and is easier to justify under data protection law, and you can always ask again if the relationship grows.
The 90-day reconfirmation
Where a business needs continuing access to a customer's data, rather than a single snapshot, that access cannot run indefinitely. The customer has to reconfirm their consent at least every 90 days. This "90-day rule" exists so that long-lived connections are revisited and stale access is cleared out.
How the reconfirmation happens has changed over time. The original rule required the customer to re-authenticate with their bank; the FCA has since moved toward a lighter reconfirmation-of-consent model that can, in defined cases, avoid a full bank re-authentication every 90 days. Because the detail here is evolving, treat the principle as settled (ongoing access is time-boxed and must be renewed) and confirm the current mechanics against the FCA's rules before you build a long-lived use case. See is open banking safe for the authentication context.
Consent dashboards vs access dashboards
Customers can manage their connections in two places, and it helps to keep them straight:
- The provider's consent dashboard is on the business side: it shows what the customer has shared with this provider and lets them withdraw it.
- The bank's access dashboard is on the bank side: it shows every third party the customer has connected across all services, and lets them cancel any of them independently.
Both matter. A customer who withdraws at the provider stops that connection; a customer who revokes at the bank cuts it off at source. Good practice is to make your own consent dashboard clear, so customers do not have to hunt for how to stop sharing.
Revoking consent, and what happens to your data
Revocation stops future access immediately: no more data flows and no further refresh happens. It does not retroactively delete data a business has already received and lawfully holds. What happens to that data is governed by the provider's retention policy and the business's own data protection obligations, not by the open banking consent itself. In plain terms: switching off sharing stops the tap, and how long the water already in the bucket is kept is a separate, data protection question, covered below.
Consent for business accounts and multi-authorisation
Business accounts add a wrinkle: more than one person may need to authorise access or a payment. Where an account requires multiple signatories, open banking supports multi-authorisation, so a connection or a payment is only completed once the required approvers have each confirmed at the bank. If you serve SMEs, design for this: assume some customers will need a second approver, and do not treat a single approval as final for those accounts.
GDPR consent vs PSD2 consent
This is the point most often confused. The consent a customer gives to connect their account is payment services consent under the Payment Services Regulations: it authorises access. It is not, by itself, your lawful basis for processing personal data under UK GDPR. A lender using open banking data for an affordability decision usually relies on a basis such as contract or legitimate interests, with consent handled separately and appropriately. Keep the two ideas distinct in your privacy notice, because conflating them is a common compliance error.
From the data consumer's side
Consent is where conversion and compliance meet. The narrower and clearer your request, the higher your completion rate and the easier your data protection story. Two habits pay off: ask only for the data the decision needs, and give customers an obvious way to see and stop what they shared. If you need ongoing access, plan for the 90-day reconfirmation in the customer journey rather than letting connections silently lapse. Credit Canary handles the consent capture, the dashboard and the renewal prompts so you do not build them from scratch.
How Credit Canary does it
Credit Canary runs consent through a regulated provider: a scoped, plain-English request, a consent dashboard for the customer, and reconfirmation handling for ongoing access. You get the data you are entitled to, with the permission trail recorded, and without having to build consent management yourself.
Common questions
How long does open banking consent last?
A one-off check is a single snapshot and then the connection ends. Ongoing access can run for up to 90 days before the customer has to reconfirm it, and the customer can set a shorter period or withdraw at any time.
What is the 90-day rule?
For continuing account information access, the customer must reconfirm their consent at least every 90 days, so access does not quietly continue forever. The exact reconfirmation mechanism has evolved under the FCA's rules; check the current position before relying on specifics.
How do customers revoke open banking access?
They can withdraw access in the provider's dashboard, or cancel the connected party in their own banking app. Revoking stops further access; data already shared is handled under the provider's retention and data protection obligations.
Is open banking consent the same as GDPR consent?
No. The payment services consent that authorises access is separate from the lawful basis for processing personal data under UK GDPR. A business using the data still needs its own data protection basis, which is often legitimate interests or contract rather than consent.
Related pages
Primary sources
- Payment Services Regulations 2017, SI 2017/752 (checked 14 Oct 2026).
- Delegated Regulation (EU) 2018/389 (SCA RTS) (checked 14 Oct 2026).
- Open Banking Standard, Customer Experience Guidelines (checked 14 Oct 2026).
Credit Canary provides open banking through fumopay limited, an FCA-authorised account information and payment initiation service provider (FRN 925689), of which Credit Canary is an agent. Underlying bank connectivity is also provided by fumopay limited. This page is an evergreen reference and is reviewed and dated; it is not regulatory, legal or financial advice.