Nordigen: API aggregator to European banks

https://nordigen.com/en/products/account-information/

61 35 5 years ago

Open banking as a service?

maverwa3• 5 years ago

I'd really like to have a read-only API that is accessible for personal projects to be able to retrieve my own transaction history. Sadly with PSD2 that is (afaik) impossible, or at least pretty close to impossible. Things like this (nordigen) might "solve" the problem by replacing it with a bigger one: now nordigen (or someone else) has access to all this transaction data and is going to leak it somewhere.

I get why banks are so conservative and bureaucratic, and all this PSD2 security stuff is required. I want my financial data to be secured. But I also want to be able to access it with my own software. Guess I cannot have both, in which case I prefer the first.

I dont think nordigen is a solution (for me) and quite frankly, I find the concept somewhat scary.

alexchamberlain• 5 years ago

I think some banks do offer restricted keys that only allow you to access your own accounts - I think Starling in the UK does this; Monzo used to too, but I'm not sure if that's the Open Banking API, or just another API.

Deathmax• 5 years ago

Starling[1] and Monzo[2] have their own APIs accessible to end users which are not Open Banking[3]. Monzo has a separate set of OB APIs and AFAIK Starling doesn't have an OB API as only the big, high-street UK banks (HSBC, Barclays, RBS, Santander, Bank of Ireland, Allied Irish Bank, Danske, Lloyds, Nationwide) were forced to implement the OB spec.

[1] https://developer.starlingbank.com/

[2] https://docs.monzo.com/

[3] https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385...

szszrk• 5 years ago

For what PSD2 done is it made that Nordigen service possible, also I can see my history from one bank in another. Results (possibilities) greatly vary from bank to bank, but in general at least I can download my data from one place.

I get your complain, but It's a step forward at least.

wdb2• 5 years ago

Would you be interested in something similar for open finance?

andruby2• 5 years ago

What does "open finance" mean in this context?

I have the same desire as OP to access my own data. I want to build a tool to track my assets. Maybe it's worth building this as open source. Would that be considered "open finance"?

acatton• 5 years ago

Take a look at https://woob.tech. In a nutshell, it is a bunch of open source python modules which allows you to scrape websites as a unified API. (i.e "bank", "classified ads", "recipes", etc.)

They mostly cover European (especially French, since the original author is French) banks. But they have some US ones.

pbronez• 5 years ago

Nice to see they renamed that project. The new name is more approachable.

marbu• 5 years ago

My bank fio.cz provides it's own user rest api, so that before you create an api access key, you can select which accounts it applies to and if it's read only access or not. I don't understand why there aren't more banks doing something like this. Btw the bank also offers PSD2, but I haven't looked into that so far, and I'm not sure if it's actually directly useful for a client. https://www.fio.cz/bank-services/internetbanking-api

rhn_mk1• 5 years ago

What makes it impossible in PSD2? The python-fints library can fetch available transaction history for supported banks no problem.

https://github.com/raphaelm/python-fints

https://python-fints.readthedocs.io/en/latest/reading.html#r...

vesinisa5• 5 years ago

Under PSD2 banks are required to give access to the "open" APIs only to audited partners (Third Party Payment Service Provider, TPP) They may give wider access, but most are somehow paranoid about the entire matter.

vesinisa5• 5 years ago

now nordigen (or someone else) has access to all this transaction data and is going to leak it somewhere.

You must of course be able to trust the 3rd party, Nordigen in this case. But I don't think their operational license even allows storing your financial data - only proxying requests between you and the bank. So only your bank is even allowed to store your financial data.

But of course you need to be able to trust that Nordigen indeed does not store and abuse your financial data -- just like you need to be able to trust your bank! Bear in mind though that Nordigen is supervised by the same financial regulation authority as your own bank, and if they were caught doing anything shady they would face very serious consequences - not to even speak of staining their reputation, which would be ruinous for a small startup.

tl;dr: Banking is ultimately about trust, and nothing is ever perfect.

maverwa3• 5 years ago

You are right, trust is the most important thing here. But nordigen does not want my money for their service. Instead they want to sell what looks like APIs for ML over your transaction data. So they at least have a good incentive to use my data for training their model.

ofc, I dont know what they do with it, they may be cool ethical ppl just doing a cool thing and my mistrust might be totaly misplaced.

But I have to trust another entity that proxies my connections. Another link in the chain.

And I dont really want to hit on nordigen here, as I said, I dont know them, I have not read that whole website and havent looked in the details.

For me its more about the generell problem. I find it sad that a service like this seems nessassary.

vesinisa5• 5 years ago

Read this comment below: https://news.ycombinator.com/item?id=28035602

Nordigen does actually reuse, store and sell your financial data in "anonymized" form. That's rather concerning.

elfrinjo2• 5 years ago

It is rally terrible that such a service is actually necessary... PSD2 was a chance to create a standard api for everyone including customers. I still cannot understand how they managed to f it up by limiting access to "trusted companies"

delusional• 5 years ago

I work at a bank and it's quite simple really. The systems we use at my workplace are so antiquated and wonky that even giving people read access would be a monumental effort. To put it plainly, modernizing these systems takes effort similar in order of magnitude to landing on the moon. Not for any technical reason, but due to the mountains of manual processes and general cruft built up around them. The EU is not deaf to these concerns, and therefore the laws end up falling short for no other reason than that they want someone to actually be able to follow them.

We are talking about things like "make a request at the wrong time and the system will be broken for the next 24 hours, and you are not allowed to speak to the people who know why".

People (myself included until a few years ago) buy into this "banks need to be secure and move slowly to maintain that" but really most of it is due to mismanagement. The "move slowly" is a rationalization.

Gys2• 5 years ago

I think they do not want to deal with individuals not understanding oath2 flow, the API calls or having typos in python ;-)

gnrlst• 5 years ago

Mildly interesting: I wanted to see how their newsletter signup flow worked, but on inputting my email and clicking "sign up" I get a jquery $.ajax error. I wonder if they monitor their signups at all (and how long it's been broken).

vesinisa5• 5 years ago

List of supported banks: https://airtable.com/shrX4uBtNLnsPxSih/tblyRj2FTQoXq9Qmu

A very impressive list! Having worked in the sector I can only begin to imagine the monumentality of this integration task.

I however see that some banks are still missing. How do you deal with those? After all, PSD2 is supposed to give access to all EU banks. Have you encountered any resistance where e.g. banks refuse to open the APIs - the APIs are broken, non-standard, non-existent, or such?

monkeydust• 5 years ago

Why isn't your coverage easily discoverable on your website?

vesinisa5• 5 years ago

That would indeed be a good change, since it's such an impressive list. It's now available only via one well-hidden link in the API docs: https://nordigen.com/en/account_information_documenation/api...

throwawayswede• 5 years ago

There was a Show HN a few weeks ago [1] about a script that used Nordigen.

This is from Nordigen's information handling section in TOS, just so people understand what's going to happen with their financial data (I also recommend reading full TOS).

2.3. As the Services also allow User to upload Information and/or obtain Account Information and personal data therein, User further acknowledges and agrees that by uploading or entering any Information for the Services and by using the Services, User grants Nordigen permission to make anonymized data based on personal and non-personal data collected from User or through User's use of the Services, and combine such anonymized data with that of other Users in order to make anonymized aggregate data. Nordigen may use the anonymized data and anonymized aggregate data for various business purposes and legitimate interests of Nordigen, including but not limited to improving the Services, developing and improving other Nordigen products and services, and distributing or licensing such data to third parties with whom Nordigen has a business relationship.

1] https://news.ycombinator.com/item?id=27769266

dang• 5 years ago

Please stop using multiple accounts to promote your stuff on HN. It's against the rules and we ban accounts and sites that do it. Also, HN users notice obvious cases like https://news.ycombinator.com/item?id=27843204 and will flame you if you keep it up.

The rules are at https://news.ycombinator.com/newsguidelines.html and https://news.ycombinator.com/newsfaq.html.

For readers: of many past submissions promoting this startup, these look to be the major threads:

Show HN: Connect your bank account to Google Sheets - https://news.ycombinator.com/item?id=27769266 - July 2021 (76 comments)

Nordigen: Free banking data and premium insights - https://news.ycombinator.com/item?id=26375962 - March 2021 (39 comments)

tomaszs• 5 years ago

The first fintech solution I love

andreineculau• 5 years ago

Given that the API is the product, their API style leaves many things to desire.

Concrete example:

Account details https://nordigen.com/en/docs/account-information/overview/pa... : alright, I send in a bank account ID, and get back some "application/json". What exactly I get back? You have to check another page with zero context https://nordigen.com/en/docs/account-information/output/acco...

As a techie, giving up my info https://news.ycombinator.com/item?id=28035602 to them is a big no-no given the above knee-jerk reaction.

flas9sd• 5 years ago

I'm weirded out by PSD2. I see the utility, but there are only so much interested parties able to wield this tool. Its expressed goals are to "improve the security of payment transactions, enhance consumer protection, foster innovation and increase competition on the market".

But looking at open banking APIs all I see are "insight" features for risk assessment and data mining. If I want to make a payment, disclosing that the amount is covered via a boolean would suffice, instead all accounts, transaction history and balances are transferred with some payment initiators. Ready to be scored by a model. It reminds me of private messengers asking for permission to upload all contacts: surely this is not necessary most of the time, but you want to get on with your day and click yourself through TOS dialogues. I need bank account level privacy settings to not accidentally disclose the past 400 days of my financial history.

rakshazi• 5 years ago

Hi there, still waiting for news from one of your guys (vaivars).

I hope that comment will reach him and finally I will get a response about matrix social/oidc auth...

Nordigen: API aggregator to European banks

Related Stories