Before open banking rules existed, an app that wanted to see your bank balance generally asked for your online banking password. The replacement changed both the security model and who could compete.
Credential sharing was the practice it displaced
Aggregation services logged into banking sites on a customer's behalf and read the screens as a browser would. The technique worked but required handing over full account credentials.
Anything the customer could do, the service could also do, because the bank saw an ordinary login. There was no way to grant a narrow permission or to withdraw one cleanly.
Banks disliked it, customers rarely understood the exposure, and any change to a page layout broke the connection until the aggregator rewrote its parser.
A defined interface makes consent explicit
Open banking replaces that arrangement with a published interface the bank maintains. The customer authenticates with the bank directly and approves a specific scope of access.
The third party never sees the password. It receives a token that expires, covers only the agreed data, and can be revoked by the customer without changing any credentials.
That structure also gives the bank a record of which providers hold live consents, which is the basis for the dashboards where customers review and cancel connections.
Reading data and moving money are different permissions
The rules generally separate access into two families. One allows an application to read balances and transaction history; the other allows it to initiate a payment from the account.
Payment initiation is the more consequential of the two, because it removes the card networks from the flow entirely and settles directly between bank accounts.
Providers are authorised separately for each capability, so a budgeting tool that only categorises spending never holds the permission required to move funds.
Data quality varies more than the specification suggests
A common interface does not guarantee common data. Merchant names, transaction categories and the timing of pending items differ considerably between institutions.
Applications therefore spend real effort normalising what they receive, matching inconsistent merchant strings and reconciling transactions that appear, disappear and reappear as they settle.
Reliability differs too, since each bank runs its own infrastructure. An outage at one institution is invisible to customers of another using the same application.
The competitive effect was the point
Account data had been an incumbent advantage. A bank could see a customer's full financial picture while any challenger saw only the fragment it held itself.
Making that data portable at the customer's instruction lowered the barrier for firms offering lending, budgeting and account switching without holding the underlying account.
The regulatory design treats the data as belonging to the customer rather than the institution, and most of the market consequences follow from that single decision.