Hacker News

points by elric 1 day ago | 0 comments

> By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.

"Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful. Interacting with any of the "open" APIs requires approval from a national bank (or similar institution), which means there are many hoops to jump through.

There is only one bank I know of that offers an API for end users ("bunq" IIRC). Every other god damned bank insists on being user hostile.

[–] Xeago 1 day ago

Whilst not PSD2/PSD3, I've been super happy with Wise; an excellent API, good quality docs. A _proper_ test environment that you can drive using hooks they expose. Nothing but praise for them, including their support, which has helped me around the clock even on weird questions such as why my custom integration fails to send a transaction (mismatched currency between recipient and transfer in my code).

[–] doetoe 4 hours ago

For contactless pay with Wise you need Google wallet, which requires Google play integrity

[–] kevin_thibedeau 1 day ago

Not going to be a good day when Wise or Plaid are breached and accounts start being drained. Adding middlemen is not a solution to poor banking services.

[–] ThePowerOfFuet 1 day ago

Wise is not a bank, is not licensed as a bank, and is thus not insured like a bank is.

Balances are held in Wise at your own risk.

[–] qmarchi 1 day ago

Depends on the country. My money is stored in a bank, licensed as a bank, and insured like a bank (because it's a bank).

Wise is really just a glorified interface on the account. And no, it's not a shared account. Those don't really exist in Japan.

[–] alecsm 1 day ago

Because these API are not meant to be public for the end user to use.

Access to that kind of data requires regulation, a lot of it and that's why Third Party Providers exist. There are a lot of them in Europe and they're not expensive.

I actually didn't expect to find anything about bunq around here but I have to say they're the worst bank I've worked with. When we started working with them, their API were broken and the devs had no idea why. It seems to have improved recently but it's definitely not a bank to praise for their API.

[–] Semaphor 1 day ago

Bunq… It’s great that they have an API, but to use it, I had to clone their SDK, and manually fix everything that was broken, add some workarounds, and now it works. Documentation was all from the announcement in 2016, me using it was ~2022, and some undocumented things changed since. Still, better than no API, which is what everyone else seems to offer.

And now we have a paypal-like shopping experience via SEPA Instant Payments, all our PayPal hating customers are happy ;)

[–] elric 1 day ago

> Because these API are not meant to be public for the end user to use.

I know, that's my point. It's a stupid decision.

> Access to that kind of data requires regulation

It's my data. I want to access it how I see fit.

> There are a lot of them in Europe and they're not expensive.

I already have a bank and I already pay them. I don't want to pay anyone else to be able to use my bank account in a way that suits me. Sadly, there aren't many good options.

Someone mentioned Wise, and they do seem pretty interesting. But it makes no sense why common high strees banks refuse to cater to power users, or even to users who aren't using mainstream devices.

[–] jcsager 1 day ago

>It's my data. I want to access it how I see fit

It ain't your data, it's the bank's data about you. Banks are shitty about access, APIs because they are perpetually in CYA mode from KYC/AML rules from the US (also on most foreign banks) and GDPR and cousins in Europe.

I was actually surprised how many bank apps will work under GrapheneOS even if only partially.

[–] esseph 1 day ago

> But it makes no sense why common high strees banks refuse to cater to power users

"Power users" don't make them more money. In fact, from their POV, you're a legal, reputational, and security liability.

[–] rockskon 1 day ago

Reputational and security liability is highly debatable. Legal is highly jurisdiction dependant.

They often act as marketing and can find and report security vulnerabilities rather than the criminal element doing so first.

[–] esseph 1 day ago

> Reputational and security liability is highly debatable

Hmmm then why are banks telling people to not use AI systems to log into their bank?

https://www.reuters.com/legal/government/us-banks-detect-una...

https://www.cbc.ca/news/business/canadian-banks-block-ai-9.7...

[–] rockskon 1 day ago

Is this thread not a conversation about GrapheneOS and those that use it? I'm not sure what relevance AI has here.

[–] esseph 1 day ago

Parent thread is discussing banking API access, and requiring a particular type of phone and OS to access said services.

Seems to be in the "banks controlling how customers access services" context.

[–] e-topy 1 day ago

I've actually been very successful in building a Home Assistant integration for my bank, built on PSD2. Approval took 4 days, after that I had production access. It's not that bad. Obviously you get Design By Committee problems, but better than no API.

[–] lmz 18 hours ago

It's Open for other (similarly regulated) institutions, not open for individual persons.

[–] mmfl 1 day ago

In the UK, you do require an FCA registration to access Open Banking APIs, but I built an open-source client (in production) that handles a lot of the API integration work: https://github.com/finlabsuk/open-banking-connector

[–] gergely 1 day ago

In Hungary you don't get documentation for these APIs only in pdfs via email, and if you get it the APIs are not stable, constantly breaking. I was always dreaming about creating an automated testing suite and report all of the issues automatically to the national bank, which is the supervisor of all commercial banks in HU, in a hope to punish them.

[–] ThePowerOfFuet 1 day ago

>I was always dreaming about creating an automated testing suite and report all of the issues automatically to the national bank, which is the supervisor of all commercial banks in HU, in a hope to punish them.

Vágj bele!!

[–] xp84 1 day ago

You guys get APIs??

Seriously, count your blessings man. In America we only get Plaid, which only works right or reliably for big banks (which are also the worst ones), and it isn’t an API for humans, just a paid SaaS product that a company who wants to offer integration with banks has to pay (i assume a lot) for.

[–] qmarchi 1 day ago

Two immediate options exist: - Crew (unofficial, but blessed, SDK) - Mercury (official)

Neither are technically a bank, but provide banking services. Mercury is more focused on big earners, and Crew is focused more on budgeting. Both have pretty extensive API surfaces.

(Disclaimer: Affiliate for Crew)

[–] embedding-shape 1 day ago

> "Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful

You mean the step from sandbox to production application, or you're not even getting access to the sandbox itself? I managed to get sandbox access with ease via two separate banks (both Spanish though), with no problems, think it took them one (working) day or something to review my "application". I never tried to get anything into the production environments though, but makes sense they'd be a bit tighter on that tbh.

Not sure why you'd claim it's impossible, it's in wide use already by banks, fintech and payment service providers across the union.

[–] elric 1 day ago

I should have added that it's impossible for individuals, not for fintech providers.

[–] embedding-shape 1 day ago

I guess I should have clarified too, I'm an individual, not a fintech provider.

[–] bloppe 1 day ago

Remember Bitcoin?