PSD2 and AIS in one sentence
PSD2 introduced AIS (Account Information Service) in 2018 — your bank must share your account data with any regulated firm you explicitly authorise. You click „grant 90 days” in the bank's panel, the firm reads inflows, balances and recurring payments. No password access, no payments allowed. It's supervised by UKNF in Poland and by EBA across the EU.
Kontomatik, Instantor, FinFin — who actually reads your account
Lenders rarely build their own integration with every bank. They use an aggregator: Kontomatik is the Polish leader (since 2014, KNF-licensed), Instantor covers the Nordic market and partly Poland, FinFin shows up with smaller players. The flow: click „connect account”, pick your bank, log in inside the provider's secure frame, not on the lender's site. Provider returns the data, the session ends itself in 5 minutes.
What the lender really sees from 90-day access
Inflows: amounts, dates, regularity (do you have a recurring salary). Balances: min, mean and max over the period. Spending aggregated: categories (housing, transport, retail), not individual stores. Recurring obligations: loan payments, ZUS, PIT. Doesn't see: individual transfer descriptions, recipient details, single card transactions. Short version — sees the flow, doesn't eavesdrop on your life.
Security and RODO trail
Access has an expiry, typically 90 or 180 days. After that the lender must request fresh consent. You can revoke at any time in your bank's panel — section „External applications” or „PSD2 consents”. The lender must stop processing within 30 days of revocation (RODO article 17). I checked for myself: at PKO and mBank revocation takes 30 seconds.
My take: when to grant, when to refuse
Grant it when your ability to repay shows in the account (steady inflows, modest spend) and BIK looks weak because of old delays that no longer matter. Open Banking bypasses the historic issue because the firm picks the present over the past. Refuse if your account shows what the lender shouldn't know: online gambling (recognisable), payments to other chwilówki (alarm signal), wages below minimum. In those cases BIK is paradoxically the kinder of the two.