[elfrinjo]

It is rally terrible that such a service is actually necessary... PSD2 was a chance to create a standard api for everyone including customers. I still cannot understand how they managed to f it up by limiting access to "trusted companies"

[delusional]

I work at a bank and it's quite simple really. The systems we use at my workplace are so antiquated and wonky that even giving people read access would be a monumental effort. To put it plainly, modernizing these systems takes effort similar in order of magnitude to landing on the moon. Not for any technical reason, but due to the mountains of manual processes and general cruft built up around them. The EU is not deaf to these concerns, and therefore the laws end up falling short for no other reason than that they want someone to actually be able to follow them.

We are talking about things like "make a request at the wrong time and the system will be broken for the next 24 hours, and you are not allowed to speak to the people who know why".

People (myself included until a few years ago) buy into this "banks need to be secure and move slowly to maintain that" but really most of it is due to mismanagement. The "move slowly" is a rationalization.

[kreetx]

But I can log in to my bank and see a transaction log and it doesn't seem to break anything. How would that break anything?

[elfrinjo]

Oh, I totally agree (started my carreer in a company that still used VSE/ESA and CICS and sometimes dream about ASRAs). However, they had to implement modern api-stuff with PSD2 and then they made it strictly b2b-only :-(

[maverwa]

Oh I think its a mix of both. But I do not have your insight ofc, so just guessing. I think banks should move slowly and pay extra attention to security. Examples like N26 show that not doing so can cause significant issues.

But its also a great excuse to justify your vintage cruft.

[Gys]

I think they do not want to deal with individuals not understanding oath2 flow, the API calls or having typos in python ;-)