FinTech Open Banking Personal Finance Management — UK Consumer App

FCA AISP

• registered to access customer bank account information with consent.
• TrueLayer (Open Banking middleware): aggregates Open Banking connections to all major UK banks (HSBC, Barclays, Lloyds, NatWest, Santander, Halifax, Monzo, Starling, Revolut, First Direct — 95%+ of UK current accounts).

TrueLayer Auth API

OAuth 2.0 PKCE (customer consents → TrueLayer → bank → TrueLayer token → AISP API).

Data received

account details, balances, transactions (90-day history at consent, 90-day rolling thereafter).

Consent management

• 1consent duration display (90 days — bank-enforced),
• 2renewal reminder (84 days — customer re-consents before data gap),
• 3revocation workflow (customer revokes consent → data deleted within 30 days — UK GDPR Article 17).

FCA consent record

every consent created, renewed, and revoked logged immutably.

Transaction categorisation

ML model (fine-tuned on UK transaction descriptions — Tesco, ASDA, Costa Coffee, council tax, TV Licence) → 32 categories (groceries, transport, entertainment, utilities, savings, income).

Merchant enrichment

Monzo-style merchant logos and clean names (remove bank transaction codes).

Net Worth calculation

• 1current account balance,
• 2savings accounts,
• 3credit cards (liability),
• 4mortgages (TrueLayer mortgage data where available).

Budget feature

user sets monthly budget per category → spending tracked against budget → alert at 80% → notification at 100%.

Spending prediction

30-day forward spending forecast (linear regression on last 6 months spending patterns — Conservative/Expected/Optimistic).

FCA Consumer Duty PS22/9 for PFM

FCA Consumer Duty applies to FCA-registered AISPs providing consumer-facing financial tools.

Consumer Duty design obligations

• 1product design (PFM features must genuinely help consumers — not nudge them into products that generate commission),
• 2price and value (if PFM app earns referral fees from financial products — explicit Consumer Duty value assessment),
• 3consumer understanding (spending insights must be clear, accurate, and not misleading — no dark patterns inflating apparent savings),
• 4consumer support (customers can delete their account and all data within 30 days — right to erasure).

No referral nudging

ClickMasters explicitly designed the PFM to not nudge users towards partner financial products — pure PFM, no commission.

FCA Consumer Duty simplifies to

• help customers, do not exploit them.
• ICO AADC PFM Under-18

Compliance

Some PFM users are under-18 (16–17 year olds with bank accounts — Monzo, Starling, HSBC under-18 accounts).

AADC compliance

• 1age verification at registration (DOB required — under-18 triggers AADC mode),
• 2AADC controls (behavioural analytics off by default, no spending pattern advertising, parental consent for under-16),
• 3data minimisation (under-18 profiles do not have investment or credit product recommendations — not age-appropriate),
• 4screen time limitation (under-18 app usage monitoring — ICO recommends but not mandated),
• 5parental consent workflow (under-16: parent account linked, parent must approve data access). Open Banking under-18: bank accounts for under-18s (Monzo Under-16 accounts) — Open Banking consent by parent on behalf of minor.