Monzo's API includes a unique transaction ID as well as a timestamp to indicate when (if it has happened) the transaction 'settled'. The open banking APIs implemented by the CMA9 include a BookingDateTime and Status (Booked or Pending) and an immutable transaction ID. It's surely just common sense to do this.
Why is there no regulation to require banks expose a usable API in NA?
Nacha ACH spec per BoA for example:
https://files.nc.gov/ncosc/documents/eCommerce/bank_of_ameri...
The entire point of OB and PSD2 is that any regulated company can get access to this data.
This is part of a wider "challenger bank" initiative. Creating space for smaller, usually digital only, banks to create more competition in the consumer banking market. This was thought to be especially important after the "too big to fail" crash. Directly breaking up the larger banks was never going to happen, so instead they created an environment where competition could (hopefully) flourish.
It's scary to think what would happen if one of these services (Mint, Personal Capital, Plaid) had a backend data breach. If they can log in to your financial sites, a breach would mean the attacker would be able to as well.
I don't think enough people realize that when you authenticate with Plaid, even for apps that don't provide "Mint-like" functionality and have no need for your transaction history, you're giving that developer permission to pull your transaction history, personal information, account balance, etc without any additional permission at anytime.
Especially in the accounting tech space. Take a look at HubDoc (which Xero accounting acquired for ~70m) and their practices of asking accountants to share their clients login credentials + challenge questions to every online service they want "automated" instead of using OAuth. Their FAQ even encourages this "Hubdoc will have all of the information it needs to connect and fetch your documents": https://support.hubdoc.com/hc/en-us/articles/360007260052-Wh...
As for bank feeds, no one has solved this the right way. Not even Plaid. Scrapers are not the answer. Maybe open banking standards like already happening in Commonwealth countries? Or a dropbox like app that lives on the user's machine and that does all the scraping without giving away the login credentials to other actors.
As an added bonus, banks may disclaim liability because you shared your credentials with a third party.
