Do I have to share my bank statements with KeySafe for new flat?

I moved into a new flat and the letting agent said it uses a third-party reference service which I thought nothing of. 

I received an email from this service, a company called KeySafe TV, and proceeded with the application.

It seemed pretty normal up until the point of entering my bank details for the credit check, I clicked next and then it redirected me to my Barclays online banking service log-in page.

This seemed strange and wrong to me. I didn’t log into my online banking as I didn’t want anyone to have access. 

I have done some digging around and found out they seemed to want full access to a year’s worth of banking details – my balance, incomings, and outgoings. What is going on? Is this allowed? S.C., via email

George Nixon, of This is Money, replies: KeySafe is a Shropshire-based tenant referencing agency which says on its website it works with major names including Connells, Hamptons and Your Move. 

It has been around since 1999 but seems to have fully embraced the digital world.

Because what you are talking about is something called ‘open banking’, a data-sharing initiative launched in January 2018 designed to open up Britain’s banking industry and personal finances, by letting people provide their financial data to other banks, budgeting apps, lenders, credit reference agencies and other third-party firms.

Crucially, this is all done entirely with the sharers’ consent. 

They must consent to providing their data to whoever is asking for it, consent to the secure APIs (as the data strems are known) which allow apps and banks to talk to each other, and whoever is given your data must delete it when asked.

Open banking has had something of a slow start, largely because of understandable concerns about privacy and also whether users have derived any actual benefit from it. 

For all the talk about revolutionising finance, open banking is still often associated with simply being able to see all your bank accounts and credit cards in one place.

Nonetheless, the system now has over 3million users, according to the body which implemented it, and KeySafe has used it for 60,000 tenant applications, which brings us back to your case.

The reference agency inked a partnership with a software company named Salt Edge in February last year to provide the open banking software you felt troubled by, having originally launched it in 2019.

The announcement stated the partnership allowed KeySafe to ‘securely access tenants’ bank data’ and made it the first tenant reference agency to use open banking through this service, which it has labelled ‘PreView’.

Essentially, rather than handing over three months of payslips, PreView will, provided you give your consent, look through your banking data to determine your financial situation and creditworthiness.

The announcement added: ‘KeySafe’s service allows an applicant to select many forms of income for landlords to consider and the financial situation is presented fully, with a 360-degree view. 

‘Since the process is digitized and no additional documentation such as bank statements and payslips is required, the verification is smoother and completely nonintrusive for tenants.’

However, the company has a 2.5/5 rating on the review site Trustpilot, and many of the negative reviews express the same concerns as you. 

And there is also another thing worth noting. 

Open banking firms must be authorised by the Financial Conduct Authority, but KeySafe, as a referencing company, is not, which is why it has partnered with Salt Edge.

It means that your banking data is not actually being provided to KeySafe, but to Salt Edge.

‘We will use open banking facilitated by our partner to see your bank account information’, KeySafe says in its privacy policy.

And your point about the firm asking for a year’s worth of banking data has also raised some eyebrows. You initially thought this meant you were asked to consent to KeySafe and Salt Edge having ongoing access to your data for a year.

KeySafe will – with consent – scan applicants banking details to determine their creditworthiness and affordability when carrying out tenant referencing

This would have fallen foul of open banking rules, which require a customer to provide their consent every 90 days to any company wanting access to their information. And this 90-day rule doesn’t apply to a company wanting access to more than the last 90 days’ worth of transactions.

In that case, consent must be given every time.

This is Money asked Gareth Fowler, the managing director of KeySafe, a number of questions about the proposition.

It says the process takes as little as 4 minutes, but some have expressed wariness at handing over their banking data

We asked whether it was true tenants were asked to offer access to their banking data for a year, whether they could opt out without being disadvantaged and what happens to the financial data shared with Salt Edge.

Some 83 per cent of applicants are happy to provide access to their banking information, according to figures from KeySafe’s website.

Gareth Fowler said: ‘The information that we request from each prospective tenant is entirely permission based and if that permission is granted our partner Salt Edge is given read-only access to the last 12 months of transaction data which we use to assess an individual’s suitability primarily based on affordability and akin to the criteria now being used increasingly by most lenders.

‘We do not ask for 12 months of access into the future. As you rightly state, that would be unnecessary and intrusive, and we do not ask for that.’

He added: ‘The high level of acceptance of this request that we get, which is higher than most others in the industry, is in large part attributable to the fact that we are not asking for ongoing consent.

‘But if an applicant chooses to opt out of open banking or if their particular circumstances don’t lend themselves to a definitive decision then we can go down a manual based route where we contact their employer, request further documentation and the like.

‘We do not treat these applicants any less favourably for having used the more classical process and our recommendations are based on similar criteria.’

He said any data provided to Salt Edge through the application process was ‘deleted after 24 hours.’