Open banking lets you instruct your bank to share financial information with a third party. The practical question is not only what you can do with it, but whom to give permission to. This guide answers who counts as licensed, how to check, what such an app can and cannot do, and which signs should raise a red flag. The general background is in Open banking explained simply.
What a financial-information-service licence is
The activity of a financial information service, meaning pulling information about accounts and savings and showing it to the customer, is governed by the Financial Information Service Law. The law says that whoever does this needs a licence and supervision, and owes duties to the customer, including a written agreement and fair disclosure. Supervision lies with the relevant regulator, and the Israel Securities Authority publishes the list of licence holders on its site. The Bank of Israel (opens in a new tab) publishes public information on the banking arrangement that lets a licensed body receive data from the banks.
What a licence says and does not say
A licence says the body has been vetted and is supervised under the law. It does not say the product suits you, that the price is fair or that the information it shows is perfect. Beyond the licence, check what the app does and what it stores.
What a licensed app can and cannot do
Can
- Pull financial information you agreed to share: balances, transactions, charges.
- Combine sources, categorise spending and show one picture.
- Compare and explain, for example management fees against the market.
- Act only during the consent period, until you revoke it.
Cannot
- Move money or take actions in your accounts. The service is read-only.
- Receive your bank password, because you authenticate with the bank itself.
- See information you did not agree to share.
- Replace licensed advice: it shows and compares and gives no personal advice.
How to check that an app is licensed
- 1
Look for the statement
On the app's site, in the app store and in the terms of use there should be a statement that it holds a financial-information-service licence and who supervises it. Its absence is a reason to ask, not proof that there is no licence.
- 2
Verify it in the official list
The Israel Securities Authority (opens in a new tab) publishes a list of licensed financial information service providers. Do not settle for the app's statement: the list is the source that counts, and it is updated.
- 3
Watch how you connect
When connecting to a bank you are sent to the bank's own site or app, identify yourself there and approve. An app that asks you to type the bank username and password into its own screen works differently, and is best avoided.
- 4
Read the consent screen
The bank's consent screen shows what information will be shared, with whom and for how long. If something is unclear, do not approve.
- 5
Check how you cancel
Make sure you can revoke both inside the app and at the bank, and that you can delete the account and the data.
How consent works, from start to revocation
1
You choose what to connect
You decide which accounts and sources to share, and you can start with one.
2
You identify yourself at the bank
The app sends you to the bank. You authenticate there, and the app never sees the password.
3
You approve on the consent screen
The screen shows what information, with whom and for how long. You approve or decline.
4
The data starts to update
The app pulls what was approved and shows it, read-only.
5
You revoke when you want
You can revoke at any time with the service provider and with the bank, and access closes.
Red flags
If any appears, stop and check
0 of 6 checked
Your ticks are saved on this device only.
What to share and what not
The Shavve app holds a financial-information-service licence supervised by the Israel Securities Authority, works read-only and shows only what you connected. Compare apps by the criteria in How to choose a money management app, not by any app's own claim, ours included.
What the law requires of a licensed provider
Beyond the licence itself, the law places duties on a financial information service provider towards the customer. These are the main ones as public sources present them. To confirm the exact wording, read the law and the Authority's guidance.
- A written agreement with the customer that includes fair disclosure about the service and the information collected.
- A duty of trust, care and confidentiality towards the customer.
- Acting only on the permission the customer gave, and within the scope approved.
- Exposure to supervision and financial sanctions for certain breaches.
Open banking versus handing over a password
Before a regulated framework existed, some services around the world asked the customer for the bank username and password and logged in on their behalf, as if they were the customer. In that approach the service sees everything and holds login details, and the bank cannot tell the customer from the service. In open banking the authentication happens at the bank, the consent is defined in scope and time, and it can be revoked. So an app that asks for a bank password is not following this model, and is best skipped.
A quick check, in seven questions
If something seems to have gone wrong
If you find an action you did not approve, or you gave a password to an unlicensed body, act at once: revoke the consent, change passwords and contact the bank. If you suspect a body is operating without a licence, you can contact the Israel Securities Authority. Keep screenshots of the consent and of the correspondence, because they help in any inquiry.
Who is who in the framework
Information is not moving money
The law in question concerns a financial information service: pulling information and showing it. Actions that move money, such as transfers and payments, are a different matter under a different arrangement. This is a practical difference: an app meant to show and compare needs no permission to act in your account, and such a request is a reason to stop and check.
And what about AI assistants?
The same logic applies when you connect an AI assistant to your financial data: connect only with limited permission, read-only, and with a way to disconnect. This is explained in Using an AI assistant safely, and in the guide to connecting Claude or ChatGPT to your Shavve data.
What you can ask the service itself
Beyond revoking consent, you are entitled to ask the service a few simple questions and to expect a clear answer. If the answers are evasive, that is information in itself.
- Exactly what information do you keep, where and for how long?
- Is the information passed to anyone else, and for what purpose?
- What happens to the data when I revoke consent or delete my account?
- How do I ask for a copy of my data, and who handles such requests?
- Whom do I contact when something fails or a figure is wrong?
Changed your mind? How to revoke permission
- 1
Revoke with the service provider
In the app's settings, disconnect and, if you wish, delete the account and the data.
- 2
Revoke at the bank
On the bank's site or app, in the consents or third-party access area, you can see active consents and cancel them.
- 3
Make sure access closed
Check that the consent shows as cancelled and that the data in the app no longer updates.
- 4
Change passwords if you suspect a problem
If you handed a bank password to an unlicensed body, change it at once and contact the bank.
Frequently asked questions
A framework that lets you instruct your bank to share specific financial data with an authorised body, with your consent and without handing over your bank password. The consent is not permanent and you can revoke it.
Check the official list of licensed financial information service providers on the Israel Securities Authority's site, not only the app's own statement.
No. A financial information service is read-only. An app that asks to move money works under a different arrangement, and it is worth asking who supervises it.
No. You authenticate with the bank itself. An app that asks for a bank password should raise a red flag.
With the app and with the bank, at any time. Check in both places that the consent shows as cancelled.
Only what you approved on the consent screen at the bank, in the scope and for the period defined. Someone who connects only one account does not expose other accounts.
No. The bank's app remains the tool for taking actions. A financial information service shows and compares data from several sources and does not move money.
