How budgeting apps connect to your bank: aggregators, tokens and why connections break

Three parties in every connection

Every synced account involves three parties: your bank, a data aggregator, and the budgeting app. YNAB describes the aggregator's job in three steps: authenticate with your bank over encrypted communication, retrieve balances, transactions and account types, and send that data back to YNAB. Monarch says the same thing more bluntly: 'Monarch never directly accesses your accounts.'

PocketSmith explains why the middle layer exists. Direct feeds need a relationship between the bank and the software company, and 'the overwhelming majority of banks don't offer this as an option'. Aggregators built their own connections to thousands of banks instead, which is how a small app can support banks in many countries.

This is the mechanism. For fixes when a connection fails, see our bank sync troubleshooting guide. For what data each app keeps, see the security and privacy guide. Everything below comes from vendor help pages read on 30 October 2026.

Which aggregators each app documents

Taken from each vendor’s own help pages. Coverage changes often, so check your specific bank in the app before subscribing.

OAuth and open banking versus stored credentials

There are two ways an aggregator can get into your bank. The difference explains most connection behaviour.

How often your data actually refreshes

A refresh is two separate events: the aggregator asking the bank, and the bank having something new to send. Monarch compares it to checking a mailbox. Monarch can walk to the mailbox, but if the post office has not delivered, it comes back empty.

Why you get asked to reauthorise

• Consent renewal. Some jurisdictions require banks to renew third-party access every 90 or 120 days (Lunch Money).
• Bank security policy. Some banks ask for a one-time passcode often, and YNAB says it cannot change that. You only need to complete the prompt when you want new transactions.
• Stored security questions. YNAB may ask repeatedly until all your answers are stored. Removing the connection partway through restarts the process.
• A changed password or two-factor setting. Monarch and PocketSmith both require you to update or reauthorise the connection.
• A bank login or security update. Monarch lists security protocol changes and login flow changes as common causes of breaks.
• The aggregator relationship ends. Monarch notes that a provider and a bank can stop working together.
• Unexpected bank alert emails. PocketSmith warns that some providers sign in the way you do, so your bank may send login alerts when a feed syncs.

History depth on first connection

How far back the first sync reaches also depends on the aggregator and the bank. YNAB imports nothing from before the starting balance it creates on the day you link; older transactions need a file import. PocketSmith publishes guidelines: Plaid up to 2 years, Basiq 2 years, Salt Edge up to 1 year, and Yodlee and Akahu up to 1 year but sometimes 90 days. Monarch says history ranges from a few months to years depending on the bank. Lunch Money lets you set an earliest import date.

What you can control

• Prefer the OAuth route where it exists. The bank decides whether it is offered, but if the connection sends you to your bank's own login page, that is OAuth. Monarch says credential-based connections are more likely to break when a bank changes its login flow.
• Use the primary account holder's login. YNAB recommends this for the best import experience.
• Avoid two connections with the same login to one bank. YNAB lists this as a cause of repeated reauthorisation.
• Check vendor status pages before blaming the app. Monarch publishes a Connection Status Dashboard by institution.
• Review your Plaid permissions in Plaid Portal. Plaid says you can view the data types you have shared there and control ongoing access.
• Keep a file-import fallback. Every app in this guide accepts some form of CSV or bank file.