Open Finance: how financial data sharing works
If you've heard that it's possible to share your banking data between institutions securely and wondered how this works in practice, the answer is Open Finance.
If you've heard that it's possible to share your banking data between institutions securely and wondered how this works in practice, the answer is Open Finance. In short: Open Finance is a system in which the customer authorizes the sharing of their financial data and services between institutions through standardized consents — and you can revoke that authorization at any time.
In this guide, you'll understand what Open Finance is, how the authorization process works step by step, and how to cancel a consent you no longer want to keep.
What is Open Finance
Open Finance is a model in which banks and other participating financial institutions can share information and services with one another — always based on the customer's consent. In practice, this means that you, and only you, decide which data will be shared, with which institution, and for how long.
The system works through standardized APIs. One of them is the Open Finance Brasil consents API, which handles the creation, consultation, renewal, and revocation of consents for sharing registration and transactional data. Among the data groupings covered in this ecosystem are:
| Data grouping | What it typically covers |
|---|---|
| Registration data | Customer identification and profile information |
| Accounts | Account data, balances, and transactions |
| Credit card | Card limits, statements, and transactions |
| Credit operations | Loans and financing you've taken out |
| Investments | Investment products held by the customer |
| Foreign exchange | Foreign exchange operations related to the customer |
The central point is simple: nothing is shared without your authorization. Consent is the foundation of how Open Finance works.
How the authorization works
The authorization is requested by the institution that will receive the data (the receiving institution) and only becomes valid after the customer authenticates and confirms it in the app or channel of the institution that holds the data (the transmitting institution — usually the bank where you have an account).
In broad terms, the flow works like this:
- Consent request: you request a service (for example, a financial aggregator that organizes your accounts in one place) and the receiving institution creates a consent request.
- Confirmation in your bank's environment: you are directed to the app or channel of the transmitting institution, where you need to authenticate and confirm the authorization. According to the official specification, the consent status only changes to "authorized" after this authentication and confirmation by the user at the transmitting institution.
- Secure authentication: institutions must adopt authentication procedures and controls compatible with those used in their own electronic channels, in line with the official Open Finance Brasil security profile. In other words, the same level of care you use to access your banking app.
- Deadline to confirm: if the customer doesn't confirm the authorization, the request doesn't stay pending forever — without confirmation, the consent is automatically rejected after 60 minutes, according to the specification itself.
Important: the authorization confirmation happens in the environment of the institution that holds your data, not the receiving one. If an app or website asks for your data directly, without going through your bank's channel, be suspicious.
How to cancel an authorization
You can revoke (cancel) an Open Finance consent at any time, directly through the channels of the participating institution — usually via your bank's app or the app/service that received the data.
From a technical standpoint, the official consents API provides for a consent revocation request, which guarantees that cancellation is a standard capability of the system, not an exception.
In practice, the most common path is:
- Access the app or internet banking of the participating institution;
- Find the Open Finance or data sharing area (the menu name and location may vary between institutions);
- Select the consent you want to end and confirm the revocation.
Keep in mind that the exact location of these menus varies from bank to bank, so the best approach is to look for "Open Finance" or "data sharing" within your institution's app. If you have trouble, the bank's official customer service can guide you.
Why this matters for your financial organization
Open Finance, when used well, can make your financial life easier: services that consolidate accounts from multiple banks into a single dashboard help you see the full picture — something that complements practices like reviewing your bank statement step by step and keeping a weekly financial routine.
At the same time, the logic of consent aligns with the control mindset we've covered in other guides, such as how to find Pix keys registered under your CPF via Registrato: knowing what is registered in your name — and having the power to review and revoke it — is a form of financial hygiene.
Risks and precautions
- Authorize only what's necessary: share only the data, and only with the institutions, you actually intend to use.
- Always confirm through your bank's channel: a valid authorization takes place in the transmitting institution's environment. Be suspicious of any flow that asks for your password or data outside of it.
- Review your consents periodically: cancel authorizations for services you no longer use.
- Never share your passwords: no legitimate Open Finance process asks you to hand your access password to third parties.
Common mistakes
- Thinking that Open Finance shares data automatically, without authorization — that's not how it works;
- Confirming authorizations without reading which data is being shared and for how long;
- Forgetting old consents for services you stopped using;
- Believing that canceling is complicated — revocation at any time is built into the system itself.
FAQ
Is Open Finance safe? The system was designed with security and authentication requirements compatible with the banks' own electronic channels, and nothing is shared without your confirmation in the environment of the institution that holds the data.
Do I have to authorize everything at once? No. Each consent is specific: you choose which data to share, with which institution, and under which conditions.
Can I cancel whenever I want? Yes. The customer can revoke a consent at any time, directly through the channels of the participating institution.
Can someone authorize on my behalf? No. The authorization only becomes valid after your authentication and confirmation in the channel of the institution that holds your data.
Conclusion
Open Finance puts control in your hands: nothing is shared without your explicit authorization, confirmed in the app or channel of the bank where you hold your account — and you can cancel any consent at any time through the channels of the participating institutions. Used with care, it's one more tool for seeing and organizing your financial life with transparency. Review your authorizations from time to time, as part of your financial organization routine.
Educational content; not investment or financial product advice.
Notas de QA (uso interno, não publicar): números, prazos (60 minutos), jurisdição (regras do Open Finance Brasil mantidas como contexto brasileiro, sem transplantar para leis US/UK), tabela, FAQ e disclaimers preservados parágrafo a parágrafo. Links internos mantidos nos slugs PT-BR implementados no site — nenhuma rota EN inventada. Nuance de "normally via your bank's app or the app/service that received the data" preservada conforme observação da Critical Review Final.
