Every small-business owner hits the same wall at quarter-end: your accountant needs your bank transactions, but handing them your full banking login means they could — accidentally or otherwise — move money. You want them to see the numbers, not send them.
The good news in 2026 is that you have several clean ways to give an accountant read-only bank access. Some are manual, some are automatic, and one is fully programmable. This guide walks through the three practical options, ranks them on security and effort, and tells you exactly when to pick which.
The core requirement: read, but don't touch
What "read-only" really means here is an Account Information Service (AIS) pattern. Your accountant (or their software) can pull balances and transaction history, but has no ability to initiate payments. Payment initiation is a separate, more heavily-regulated permission (PIS) that you should never grant just for bookkeeping.
Keep that distinction in mind. Any method below is only "safe" if it cannot, even in principle, authorise a transfer out of your account.
Method 1 — Add your accountant as a read-only sub-user in online banking
The old-school option, and still the most common one for sole traders and small limited companies.
Most major banks (HSBC, Barclays, NatWest, Danske Bank, Lloyds, Revolut Business, and many EU banks) let you invite a secondary user and restrict them to "view only" or "viewer / accountant" role.
How it works
- Sign in to your business online banking.
- Find Users & Access (or Manage Users, Permissions).
- Invite your accountant by email and assign the read-only / viewer role.
- They create their own login and can see statements and download transactions — but cannot approve payments.
Pros
- No third party in the middle; data stays inside the bank.
- No recurring software fees.
- Granular per-user audit logs in most business portals.
Cons
- Manual. Your accountant still exports CSVs or PDFs and imports them by hand. No auto-categorisation.
- Bank-by-bank. Each bank has its own portal, role names, and quirks. Three banks = three invites.
- Some consumer accounts don't offer sub-users at all — you may be forced to share a login (don't).
- Revolving access when you switch accountants means deprovisioning each time.
Best for: A single bank, a hands-on accountant who likes raw statements, and owners who want zero new tooling.
Method 2 — Accounting-software bank feeds (Xero, QuickBooks, FreeAgent)
This is the path most growing businesses take, because the read-only connection happens for free as a side effect of using accounting software.
Xero, QuickBooks, Sage, FreeAgent and FreshBooks all connect to your bank through Open Banking (in the UK/EU) or equivalent aggregators. The connection is read-only by design — the software can only fetch transactions, never send payments.
How it works
- Connect your bank account inside Xero / QuickBooks / FreeAgent.
- Authenticate with your bank (standard redirect + consent screen).
- The software pulls a fresh transaction feed daily.
- Invite your accountant as a collaborator on the software — not your bank.
Your accountant now sees a live, auto-categorised ledger without ever touching your bank login.
Pros
- Automatic. Transactions arrive daily and get suggested categories.
- Reconciliation, VAT/GST reports, and month-end close are built in.
- Read-only is enforced at the Open Banking consent layer, not a checkbox in your bank portal.
- Switching accountants is one click (remove their software seat).
Cons
- Monthly subscription (typically £20–£40/mo for the software).
- You're granting a consent to a third party; review the data the software itself can see.
- Consent connections expire (renewable every 90 days under Open Banking rules) and occasionally need re-authenticating.
Best for: Any business that already uses (or should use) bookkeeping software — which is most of them past the very early stage.
Method 3 — Open Banking / PSD2 Account Information APIs
This is the modern, programmable approach, and the one I want to demystify because it's where the industry is heading.
Under PSD2 (the EU payment-services directive) and the UK's Open Banking standard, regulated Account Information Service Providers (AISPs) can access your account data with your consent — read-only, by law. You (or your accountant, or a tool you build) call a clean REST API and receive normalised JSON: balances, transactions, account metadata, across as many banks as you connect.
The crucial thing most guides gloss over: you do not always need your own PSD2/eIDAS certificate. Becoming a fully-regulated AISP means issuing QWAC/QSeal eIDAS certificates, audits, and a national regulator licence. That's overkill if you just want to give an accountant (or yourself) programmatic access. Several providers let you consume the AIS API without holding your own certificates — they're already regulated, and you ride on their authorisation.
Why this matters for read-only accountant access
- One consent flow, all your banks unified into a single API.
- Transactions in a consistent schema — no more parsing six different CSV formats.
- End-to-end encrypted options exist where the provider can't read your data at all — only your client holds the decryption keys. This is a meaningful privacy upgrade over traditional feeds.
- You can pipe the data into a spreadsheet, a custom dashboard, or directly into your accountant's tooling.
What "no certificate needed" actually looks like
You authenticate, consent per bank, and call endpoints like /accounts and /accounts/{id}/transactions. The regulated provider handles the bank integrations, the eIDAS certificates, and the consent renewal. You get clean, audited, read-only data without the regulatory burden.
Disclosure: I maintain open-banking.io, a roughly €3/month service that does exactly this — read-only bank-account aggregation with no PSD2/eIDAS certificates required and client-held encryption keys. I'm mentioning it because it's directly relevant, not because this is a sales pitch. The methods above stand on their own merits.
Best for: Tech-savvy owners, accountants serving multiple clients, finance teams, and anyone who'd rather build a pipeline than paste CSVs.
Comparison at a glance
| Method | Read-only? | Automated? | Banks unified? | Setup effort | Cost |
|---|---|---|---|---|---|
| Bank sub-user (viewer role) | Yes (role-based) | No — manual export | No (one per bank) | Low, but repetitive | Free |
| Accounting software feeds | Yes (Open Banking) | Yes — daily auto-import | Yes, within the app | Low | £20–40/mo |
| Open Banking / AIS API | Yes (by regulation) | Yes — fully programmable | Yes — all banks via one API | Medium (developer-oriented) | ~€3/mo+ |
Security checklist before you grant anything
Whichever route you take, run through this:
- Confirm it's AIS, not PIS. Account Information only — never payment initiation. The consent screen will state this explicitly.
- Check consent expiry. Open Banking consents renew roughly every 90 days. Re-authenticate before they lapse or your accountant's feed goes dark.
- Prefer end-to-end encryption if the option exists — your transaction data is sensitive.
- Rotate access when you switch accountants. Remove the software seat or revoke the API consent the same day.
- Don't share your bank login. Ever. If a method requires it, it's the wrong method.
Summary
You have three solid ways to give your accountant read-only access to your bank account:
- Add them as a read-only sub-user — simplest, but manual and bank-by-bank.
- Use accounting software bank feeds — automatic and auto-categorised, ideal if you're already on Xero or QuickBooks.
- Use an Open Banking / Account Information API — programmable, unified across banks, and (with the right provider) needs no PSD2/eIDAS certificates of your own.
For most businesses, Method 2 is the pragmatic default. Method 3 is the future, and it's more accessible than the regulator-jargon makes it sound. Whatever you pick, the principle is the same: your accountant gets the numbers, and you keep the keys.
If this was useful, I write about Open Banking, PSD2, and practical fintech for small businesses — questions welcome in the comments.
Top comments (0)