How to withdraw consent for an open banking app

You can withdraw open banking consent at any time, and you do not need the app's agreement to do it. The Information Commissioner's Office is clear that where an organisation relies on consent, it must make you aware that you can take away your consent at any time¹. In practice there are two routes: withdraw it inside the app or website you gave it to, or tell your bank to stop sharing your data with that firm².

Both routes are legitimate and you can use either. Participating banks and building societies should give you an authorisation dashboard showing which providers have permission to see your account data, and you can withdraw permissions there whenever you wish, at the press of a button³. The names differ from bank to bank, which is the main thing that trips people up.

What changes when you withdraw is narrower than people expect. The bank stops sending new data, but information already shared while permission was live may still be held by the third party⁴. Payments are a separate question from data access, and cancelling one does not always cancel the other.

Two ways to cancel: through the app or through your bank

The first route is the firm you gave permission to. Open Banking sets out that a person can opt out through the website or the app which they originally gave permission to access their details, or instruct their bank or building society to stop sharing their data with a particular firm². Triodos states the same position from the bank's side: to withdraw consent, the third party provider is contacted, and it can also be done by logging into internet banking and going to 'Account Profile' and then 'Open Banking Consents'⁶.

The second route is your own bank. You can instruct your bank or building society to stop sharing your data with a particular firm². Retailcure's consumer explanation sets out both options side by side: go to the regulated app or website and withdraw your consent directly with them, or contact your bank or building society to let them know you no longer want the app or website to have access⁷.

Some providers run a self-service switch. Hoare Bank says you can revoke access by deselecting the relevant consent in the 'Active' list in the Open Banking menu, and that it can also be revoked via the third party provider's website where you initiated consent⁸. Chorley Building Society's consents.online service says you can opt out of open banking services at any time through the consents.online website or directly through your bank or building society⁹.

If you are worried about your account security rather than simply tidying up permissions, MoneyHelper's guidance is to contact your bank directly using the number on your card or by calling 159¹⁰. That is the safer route when something feels wrong, because it puts the bank on notice rather than relying on a third party to act.

Withdrawing consent in the third-party app or website

Third party providers need your explicit permission before they access your data through open application programming interfaces, so the permission record sits with them as well as with your bank³. That means the app or website you signed up to should have its own way to withdraw, usually in account settings or a connected accounts area.

Withdrawing there is the most direct route, because it tells the firm holding your data that the basis for holding it has gone. The Information Commissioner's Office explains the consequence: if you previously consented to an organisation using your personal information and now want to withdraw that consent, the organisation must stop using it, and you do not need to submit a separate right to object request¹¹.

There is a further step available. The right to erasure applies where you initially consented to the organisation using your data but have now withdrawn your consent¹². That is a request to delete data already held, which is a different thing from switching off future sharing, and it is worth knowing the two exist separately.

If the app is unresponsive or you cannot find the setting, the bank route remains open, and it does not depend on the app cooperating.

Cancelling through your bank's online banking or mobile app

Bank controls are usually the quickest to find once you know the label. Ulster Bank and Royal Bank of Scotland both say you will be able to check or change your consents via your online banking or mobile app¹³. first direct says you can log on to either its mobile app or online banking, select 'Open Banking' and cancel access from the relevant third party provider¹⁵.

Barclays says you can view or cancel your connections at any time in the 'Open banking connections' section of Online Banking or the Barclays app⁴. HSBC UK adds a wrinkle: you can only add and manage open banking accounts using the HSBC UK Mobile Banking app, though online banking can review and manage permissions for third parties¹⁶.

Zempler Bank sets out the same two-route structure: to withdraw your consent at any time you can either do this via the third party provider or by logging in to online banking and going to Settings, then Manage Sharing Permissions¹⁷. Its security page repeats the wording, which suggests the setting is stable rather than buried in a menu that moves¹⁸.

Examples from the high street: Barclays and Lloyds

Barclays and Lloyds are useful examples because both publish the exact menu path, and the two differ enough to show why you cannot assume the setting is in the same place everywhere.

At Barclays, the app route is 'Settings' and then 'Third-party permissions'²⁰. There is also a 'Manage open banking connections' section in the Barclays app and in Online Banking, where connections can be viewed or cancelled at any time⁴. Barclays states that you always need to give it explicit permission in Online Banking or the Barclays app before any data or payment information is shared⁴.

At Lloyds, you can withdraw your consent and stop sharing data at any time from the connected accounts dashboard in the mobile app²¹. Connecting accounts in the first place runs through the 'Everyday' or 'Borrow' page, or 'Add your accounts' on the Home screen in earlier versions of the app²¹.

Lloyds also shows how a data permission and a payment arrangement can behave differently. Its subscription payments service works the other way round from open banking consent: once you have asked Lloyds to cancel a subscription, you cannot stop the process in the app, and you need to contact the bank instead²². That is the opposite of the open banking dashboard, where you are in control throughout.

What stops once consent is withdrawn

The data flow stops. Barclays states that if you decide to stop sharing data, it will not send any more data to the third party provider, though the data it shared while you did share may still be stored by that third party⁴. TSB puts it more bluntly: click 'Stop sharing', and your data will be instantly withdrawn²³.

Payments are governed by their own rules. Under the Payment Services Regulations, the payer may withdraw consent to a payment transaction at any time before the point at which the payment order can no longer be revoked²⁴. That is a time limit, not an absolute right, and it is why cancelling a payment arrangement after the money has moved is a different exercise from switching off data access.

For continuous payment authorities on credit or debit cards, the position is stronger: your bank or card provider must cancel the payment authority once you ask²⁶. Business Debtline makes the same point for buy now pay later style arrangements, saying you have the right to cancel directly with your card issuer, and once you have done this it must stop payments immediately²⁷.

If a payment has already gone through without your permission, the bank may be able to cancel the payment or put the money back into your account²⁸. Which.co.uk notes that for unauthorised payments initiated through a third party provider, your bank must refund you immediately unless it has grounds to suspect fraud or negligence, and if the third party was at fault the bank can recover the funds from them³.

Checking which apps currently have access

The authorisation dashboard is the tool for this. Participating banks and building societies should provide one, listing the providers with permission to access your account data, and you can withdraw permissions there whenever you wish³. If your bank does not appear to have one, the consent records still exist and staff can act on your instruction.

Consents do not necessarily last forever on their own. Al Rayan Bank states that consents expire after 90 days and need to be renewed if they are to continue beyond that⁵. That is a useful backstop: an app that has been forgotten about may lose access without anything being done, though it is not something to rely on.

Two practical cautions. Age UK warns that there are a lot of fake banking apps available to download, so it is worth checking that you are downloading the bank or building society's genuine app via their website³¹. And Take Five's advice is to turn on your bank alerts and check your accounts regularly, contacting your bank immediately if you see spending you do not recognise³².

If you want to see everything a firm holds about you, a subject access request under data protection law is a separate route from the open banking dashboard, and the right to erasure applies where you consented and have since withdrawn¹².

Where to get help if a firm will not act

Start with the firm. If the app will not remove your permission and your bank will not act on your instruction, put the request in writing so there is a record. The Financial Ombudsman Service handles complaints about banking and payments, including blocked payments and frozen accounts³⁰.

For payments specifically, the ombudsman's guidance on regular payments covers standing orders, which can be changed or cancelled at any time by contacting the bank³³. Direct Debits work differently: one can be cancelled at any time by simply contacting the bank or building society, though written confirmation may be required, and the payee company is also notified³⁴. The Consumer Council in Northern Ireland covers safer ways to pay for consumers there³⁵.

If a firm has stopped responding, our guide to writing an effective complaint letter or email sets out how to put the complaint together, and free consumer advice when a dispute with a firm stalls explains where to go next. If the problem is a payment an app set up rather than data access, Direct Debit or continuous payment authority: control and refund rights compares the two, and Variable recurring payments compared with Direct Debits covers the newer open banking payment type, which can be cancelled via a banking app or online bank account at any time³⁶.