Is it safe to connect a budgeting app to your bank in NZ? (2026 guide)

"That app wants to connect to my bank account — hell no." If some version of that thought has stopped you from trying a budgeting app, you're in good company: it's one of the most common objections Kiwis raise about money apps, and until recently it was a reasonable one.

TL;DR: Whether connecting a budgeting app to your NZ bank is safe depends entirely on how it connects. Since 1 December 2025, New Zealand has a regulated open banking system where you approve access in your own bank's app and never share your password. The old method — typing your internet banking login into someone else's app — likely breaches your bank's terms and can put fraud reimbursement at risk. And a third option always exists: don't connect anything, and import statements instead.

This guide explains the difference calmly, without a sales pitch for either side. (Owdyn, the app behind this blog, works fully without any bank connection — so we have no incentive to talk you into one.)

Is it safe to connect a budgeting app to your bank account in New Zealand?

It can be — if the app uses New Zealand's regulated open banking system, where you approve access inside your own bank's app or website and never hand over your password. It's riskier if an app asks you to type your internet banking credentials into its own screens, which most NZ banks' terms don't allow.

The rest of this page unpacks how to tell the two apart.

What changed in December 2025?

New Zealand's open banking law — the Customer and Product Data Act 2025 — came into force for banking on 1 December 2025. From that date, ANZ, ASB, BNZ and Westpac are legally designated "data holders": when you give an accredited service permission, your bank must share your account data with it through secure, standardised APIs, and can't charge you a fee for it. Kiwibank joins in stages — payments from 1 June 2026, account information from 1 December 2026 — and other deposit takers can opt in.

Two details in the rules matter most for safety:

Access is permissioned, not password-based. You approve (and can revoke) access through your own bank — the app never sees your login.
Only accredited organisations can ask. Companies must meet accreditation criteria set by the Ministry of Business, Innovation & Employment (MBIE) covering security safeguards, insurance, and belonging to a dispute resolution scheme — and MBIE maintains a public register of who's accredited.

Public perception hasn't fully caught up with this. Plenty of scary forum threads about bank connections predate the law, describing a problem the regulated system was designed to eliminate.

What's the difference between screen scraping and open banking?

Screen scraping (the old way) means giving an app your actual internet banking username and password so it can log in as you and copy your data. It worked, and reputable NZ intermediaries used it carefully for years, but it has a structural flaw: the app holds your real credentials, and your bank can't tell the app apart from you.

Open banking APIs (the regulated way) mean the app asks your bank for permission, you approve the request inside your own banking app or website, and the bank sends the data directly. The app gets exactly what you consented to — typically read-only account and transaction data — and nothing else. No password ever changes hands, and you can cancel access at any time.

When people say a budgeting app connection is "read-only", this is what they mean: the app can see balances and transactions but cannot move money, change payees, or do anything else with your account.

Does sharing your internet banking password break your bank's terms?

For most NZ banks, yes — or close to it. NZ banks' electronic banking terms require you to keep your password and PINs secret, and some say outright not to enter them into third-party websites or apps. Consumer NZ's analysis of one credential-based payment service found that using it breached the terms and conditions of ASB, BNZ and Westpac customers, and may have breached ANZ's and Kiwibank's.

Why it matters: under the Code of Banking Practice, reimbursement for unauthorised transactions generally depends on you having taken reasonable steps to protect your banking — including complying with your bank's terms. Sharing your login can put that protection at risk.

This isn't a reason for alarm — it's simply the strongest argument for preferring the regulated consent flow (or no connection at all) over anything that asks for your password.

What should you check before connecting any money app?

A five-point check, in order:

How does it connect? If the connection sends you to your own bank's app or website to approve, that's the regulated flow. If the app itself asks you to type your bank password, stop.
Is the provider (or its intermediary) accredited? MBIE maintains a public register of accredited requestors. Many apps connect through an accredited open-banking intermediary rather than holding accreditation themselves — that's a normal, legitimate structure.
Is access read-only? For budgeting, an app needs to see transactions — it never needs the ability to move your money.
Can you revoke access easily? Under the regulated system you can cancel a connection at any time, and from mid-2027 accredited services must remind you annually about any standing permissions you've left active.
What does the privacy policy say happens to your data? Look for a plain statement that your data is never sold, how long it's kept, and how deletion works. New Zealand's Privacy Act 2020 applies regardless, but a good app says it up front.

Do you have to connect your bank at all?

No — and this is the part most sync-first apps won't lead with. Every major NZ bank lets you download your transactions as a CSV file from internet banking, and a fortnightly import takes a couple of minutes per account. Your credentials never go anywhere, because nothing connects to anything.

That's how Owdyn works today: CSV import from any NZ bank, no bank login required, on every plan. Automatic bank sync is in testing now and comes to paid plans after launch — through the regulated open banking system described above, never by asking for your password.

Either way, the point of getting transactions into a budgeting app is the same: turning a raw balance into an honest answer. If your account shows $2,400 but rent, power, an Afterpay instalment and your savings transfer are all due before payday, the amount that's genuinely yours to spend might be closer to $400. That one number is called Safe to Spend — and you can try the calculator without signing up for anything or connecting anything at all.

Frequently Asked Questions

Is open banking safe in New Zealand?

The regulated open banking system that went live on 1 December 2025 was designed specifically to make bank connections safer: you approve access in your own bank's app, no password is ever shared, only MBIE-accredited organisations can request data, and you can revoke access at any time. No system removes all risk, but it's a substantial improvement on sharing credentials.

Can my bank refuse to reimburse fraud if I shared my password with an app?

Possibly. Under the Code of Banking Practice, reimbursement for unauthorised transactions generally depends on you having protected your banking credentials and complied with your bank's terms. Most NZ banks' terms require you to keep your password secret, so sharing it with a third-party app can put reimbursement at risk. The regulated open banking flow avoids this entirely because no password is shared.

What does "read-only access" mean for a budgeting app?

Read-only access means the app can view your account information — balances and transaction history — but cannot move money, make payments, change payees, or alter your account in any way. Budgeting apps only need to read your transactions, so read-only is the appropriate level of access to grant.

How do I cancel a budgeting app's access to my bank account?

Under New Zealand's open banking system you can revoke a connection at any time — through the app itself, and the underlying consent can also be managed with your bank. From 1 June 2027, accredited services must also remind you every 12 months about any active permissions so long-forgotten connections don't linger.

Is CSV import safer than connecting my bank account?

CSV import involves no connection at all — you download a file from your own internet banking and upload it to the app — so there are no credentials shared and no standing access to revoke. The trade-off is a few minutes of manual work each fortnight. For anyone uncomfortable with bank connections, it's a genuinely safe starting point rather than a compromise.

Do budgeting apps sell your data?

Policies differ by app, which is exactly why the privacy policy is worth two minutes of your time. Look for an explicit "we never sell your data" statement and a clear revenue model (a subscription is a good sign — it means you're the customer, not the product). New Zealand's Privacy Act 2020 governs how any NZ service must handle your personal information. Owdyn's position is simple: your data is never sold.

Sources

Owdyn is a budgeting app built in New Zealand around one idea: Safe to Spend — the number that shows what's genuinely yours after bills, Afterpay and savings goals. It works today with CSV import from any NZ bank, no bank login required, and there's a free plan.