When a lender asks you to connect your business bank account to a loan application, it's asking for open banking access: a read-only data link that shows lenders your deposits, balances, overdrafts and existing loan payments straight from the bank. Many online lenders use it in place of PDF statements, and it can speed up a decision, but the access can last well past the application unless you end it. This guide shows what lenders read, how they use it, how to revoke access, and where US and Canadian rules stand on October 17, 2026.
What open banking means when you apply for a business loan
Open banking means letting a third party read your bank account data through a connection you authorize. In lending, that third party is usually a data aggregator that pulls your transaction history, sorts it into categories and passes it to the lender. You choose your bank, approve the request, and the lender has months of transactions within minutes.
How the connection is made matters. With an API connection you usually sign in on your bank's own page, and your password stays with the bank. With screen scraping, you type your banking username and password into the app and it logs in as you. Canada's Financial Consumer Agency says "Screen scraping is not open banking," warns that once you share your login that way, "you no longer have control over it," and says your bank's protection against unauthorized transactions may not apply (FCAC open banking page, dated December 16, 2025).
Lenders want the connection because it's faster than reading PDFs and harder to fake, since the data comes from the bank rather than a file someone could edit. For products where repayment moves with sales, such as revenue-based financing, a lender may also want to keep watching deposits after it funds.
What lenders see when open banking links your business bank account
| What the lender reads | What it tells them |
|---|---|
| Deposits, with payer names | Revenue, how steady it is, and which deposits aren't revenue (owner transfers, loan proceeds, refunds) |
| Daily and ending balances | How much cushion you carry and how often the account runs near zero |
| NSF fees, overdrafts, returned items | Whether payments bounce when cash runs short |
| Recurring debits to other lenders | Existing loans and advances, and whether a new one started recently |
Reading transactions doesn't move money; automatic repayment debits come from a separate authorization you sign with the financing agreement. Some connections also pass along account and routing numbers so that debit can be set up later, so ask exactly what you're approving.
How lenders turn three months of transactions into a decision
Take a business with two advances and a term loan. The lender's underwriting starts from a summary like this (figures are illustrative):
| Line | Month 1 | Month 2 | Month 3 | Total |
|---|---|---|---|---|
| Total deposits | $64,200 | $51,800 | $83,500 | $199,500 |
| Less owner transfer from savings | -$4,000 | $0 | $0 | -$4,000 |
| Less proceeds of a new advance | $0 | $0 | -$25,000 | -$25,000 |
| Revenue deposits | $60,200 | $51,800 | $58,500 | $170,500 |
| NSF or returned items | 0 | 3 | 1 | 4 |
| Advance A, $385 a business day (22, 20, 21 days) | $8,470 | $7,700 | $8,085 | $24,255 |
| Advance B, $310 a day for 6 days | $0 | $0 | $1,860 | $1,860 |
| Term loan payment | $1,450 | $1,450 | $1,450 | $4,350 |
The lender reads four numbers from it:
- Average monthly revenue deposits: $170,500 / 3 = $56,833. Averaging all deposits would give $66,500, about 17% higher, because it counts the transfer and advance proceeds as sales.
- NSF count: 4 in three months, three of them in month 2.
- Advance debits over the period: ($24,255 + $1,860) / $170,500 = 15.3% of revenue deposits.
- Advance debits going forward: $695 every business day, or $14,595 in a 21-day month, which is 25.7% of average revenue deposits. With the term loan, fixed debt payments reach $16,045, or 28.2%.
The lender checks $56,833 against the revenue you stated. For a revenue-based offer it sizes the holdback around existing debits: an 8% holdback would add $4,547 a month and push total debt payments to 36.2% of deposits, and each lender sets its own ceiling. Three NSFs bunched into one slow month can read differently from one every week. Month 3 also shows stacking: a $25,000 deposit followed days later by a new daily debit is a second advance on top of the first.
EQ Funding's application asks about both points up front for the products where they matter: how many business loans or advances you have open (none, 1, 2, or 3 or more) and roughly how many NSFs hit the account in the last three months (0, 1 to 3, 4 to 9, or 10 or more). This business would answer 3 or more and 4 to 9. Answers that match the bank data keep the file moving when each lender checks it. Our guide to merchant cash advances explains how those daily debits work.
Bank statements or a bank connection: which should you use
| PDF bank statements | Read-only bank connection | |
|---|---|---|
| Speed | Files have to be read and checked | Data usually arrives in minutes, already sorted |
| Tamper risk | Edited PDFs are a known fraud risk | Data comes from the bank's records |
| When access ends | When you send the files | When consent expires or you revoke it |
| Who holds your data | The lender, and the marketplace if you upload there | The lender and the data aggregator |
| Your login | Never shared | Not shared with an API connection; shared with screen scraping |
Statements give you a clean end point and a connection gives you speed, and some lenders strongly prefer a connection, so ask first. EQ Funding's application collects bank statements as file uploads, though a lender that receives your file may still ask to connect. An SBA loan or a bank term loan usually needs tax returns and financial statements too; see our business loan documents checklist.
Questions to ask before you link a business bank account
If the lender can't answer these, send statements instead, and read your bank's online banking agreement before you share access.
- Is the connection read-only, or does it also pass along account and routing numbers for repayment debits?
- Will I sign in on my bank's own page, or type my password into your screen?
- Which data are you pulling, and how many months of history?
- How long does access last, and does it end after you decide?
- Who else receives the data: the aggregator, other lenders, a marketplace?
- Will the data be used for anything besides this application?
- How do I revoke access, and will you delete what you've already pulled?
How to revoke a lender's access to your bank account
Once you have a decision, work through each layer, because ending one doesn't always end the others.
- Tell the lender in writing to stop pulling data, and ask what it keeps and for how long.
- Remove the connection at your bank. Many banks list connected apps in online banking's security or privacy settings.
- Remove it with the provider named on the consent screen, which often has a page for managing connections.
- Change your banking password if you ever typed it into a third-party screen.
Where the US and Canadian open banking rules stand in October 2026
United States. The CFPB released its Personal Financial Data Rights rule, implementing section 1033 of the Dodd-Frank Act, on October 22, 2024, and on August 22, 2025 issued an advance notice of proposed rulemaking to reconsider it (CFPB rule page, last modified August 27, 2025). The CFPB's compliance page states: "On October 29, 2025, the compliance dates of the Personal Financial Data Rights Rule were stayed by the court" in Forcht Bank, N.A. v. CFPB (E.D. Ky.), and says the Bureau plans to propose extending those dates (CFPB compliance page, last modified January 6, 2026). The CFPB's 2026 regulatory agenda, published August 14, 2026, lists a rulemaking to reconsider parts of the rule, and we found no new proposal in the Federal Register as of October 17, 2026, so the rule may change.
On business accounts, the rule covers a "Regulation E account" as defined in 12 CFR 1005.2(b), plus Regulation Z credit cards and payments from either (12 CFR 1033.111). Regulation E defines that as a checking, savings or other consumer asset account "established primarily for personal, family, or household purposes" (12 CFR 1005.2), and the 1033 rule says "Consumer means a natural person" (12 CFR 1033.131). Neither section mentions business accounts, and those definitions describe personal ones. For a business checking account, the consent screen, the provider's terms and your bank's agreement set what a lender reads and how you revoke it.
Canada. The Consumer-Driven Banking Act received royal assent on March 26, 2026. It describes "a framework within which consumers, including businesses, can direct that their data be shared," covering data on products such as deposit accounts, payment products and loans (Justice Laws, current to September 30, 2026). Many provisions, including the consent sections, are marked not in force. Once in force, consent "may be valid for a period of not more than 12 months" (section 86) and can be withdrawn "in whole or in part" (section 90).
On June 26, 2026, the Department of Finance announced draft Consumer-Driven Banking Regulations for a 60-day comment period, to come into force in stages starting with accreditation, with the Bank of Canada overseeing compliance (Finance Canada news release). The FCAC's page still says "Open banking, also called consumer-driven banking, is not available in Canada yet." We found no official start date, so for now a Canadian connection runs on the app's terms and your bank's agreement.
One EQ Funding application goes to lenders who compete for your file, and you can ask each how it reads your bank data before you share it. Lenders assess credit and repayment ability, and approval and terms vary by lender.