"Connect your bank account" is a sentence that makes sensible people close the tab. It should — the instinct behind it is correct, and anyone who tells you to relax about it has not earned the trust they are asking for.
So rather than reassurance, here is the mechanism. What actually happens when an app initiates a payment from your account, what it can see, what it cannot do, who allowed it to exist, and where the real limits are.
The short version
An app that pays invoices for you never holds your banking credentials. It sends your bank a payment instruction and then hands you over to your bank, where you approve that instruction the same way you approve anything else — the app, the token, the code, whatever your bank uses. Your bank executes it. If you do not approve it, nothing moves.
The app is not a party to the payment. It is a courier carrying a proposal.
Where this comes from: PSD2
The arrangement exists because European law created it. The second Payment Services Directive — PSD2, in force across the EU and transposed into Romanian law — did two things that matter here.
First, it broke the banks' monopoly on account access. If you want a third party to see your balance or start a payment for you, your bank must let them, through a proper technical interface, and cannot charge them for the privilege or make the route deliberately worse than its own app.
Second, it regulated the third parties. Two roles were created:
- AISP — account information service provider. Can read: balances, transaction history. Cannot move anything.
- PISP — payment initiation service provider. Can propose a payment from your account. Cannot execute it; only your bank does that, and only after you have authorised it.
Both are licensed activities. In Romania, the authority that grants and supervises them is the National Bank of Romania. A company doing this without authorisation is not a startup moving fast; it is committing an offence, and the register of who holds a licence is public.
What actually happens, step by step
Take paying a supplier invoice from an app:
- You choose. The invoice, the amount, the account it leaves from. The app assembles a payment instruction from data it already has — for an e-Factura invoice, the IBAN comes out of the structured document rather than off somebody's keyboard.
- The app calls your bank's API, presenting its licence credentials, and says: this customer wants to make this payment.
- Your bank takes over the authorisation. You are handed to your bank's own flow — its app, its SMS code, its token, its biometrics. This is the crucial step: the credential is exchanged between you and your bank, and the app is not in the middle of it.
- Strong customer authentication. PSD2 requires two independent factors from the categories of something you know, something you have, something you are. This is the same rule that made 3-D Secure ubiquitous, and it applies here.
- Your bank executes the payment and returns a status. The app learns whether it went through, which is how it can tell you the invoice is settled.
At no point in that sequence does the app learn your internet banking password, and at no point can it repeat the payment on its own.
What it can and cannot do
Worth being blunt about both halves:
It can:
- Propose payments from a specific account you have connected.
- Read the account information you consented to, for as long as that consent lasts.
- Tell you a payment succeeded or failed.
It cannot:
- Move money without your authorisation at your own bank.
- Change your banking credentials, open products, or alter your limits.
- Keep access after you withdraw consent — consent is revocable, at your bank as well as in the app.
There is a useful test here for any tool you are evaluating: ask what happens if the company disappears overnight. With a properly licensed initiation model, the answer is "nothing to your money" — there is no standing mandate to cancel, because there was never a mandate, only a series of payments you personally approved.
The Romanian specifics
Two things about Romania in particular that come up constantly.
Instant payments in lei already exist, and have since 2019. Romania runs its own instant payments scheme in RON, operated nationally, settling in seconds around the clock. Most major Romanian banks participate. This is why an approved payment can be with the supplier before you have closed the tab — it has nothing to do with the app and everything to do with the rail underneath it.
Instant euro payments are on a legislated timetable, and Romania is on the non-euro track. Regulation (EU) 2024/886 phases in instant euro transfers across the EU. Because Romania's currency is not the euro, its deadlines sit later than the euro-area ones: 9 January 2027 for being able to receive instant euro credit transfers, and 9 July 2027 for sending them. If your business pays euro invoices, that is the date after which "it will arrive in two days" stops being an acceptable answer from a bank.
The honest limitations
Three, and none of them are reasons not to use it — just things worth knowing before you do.
- Coverage is per bank, not per country. Every bank exposes an interface, but they differ in quality, in which account types they support, and in how often they are down. A provider's list of supported banks is a real constraint, not a marketing detail.
- Consent expires. Account information access is time-boxed by regulation and has to be renewed. If a tool shows you balances, expect to re-authorise periodically; that is the rule working, not a bug.
- It does not protect you from paying the wrong person. Open banking removes the typing error. It does not know that the invoice itself was fraudulent. That is a different control, and it belongs to who approves the payment rather than to how it is transmitted.
How OpenPay uses it
OpenPay initiates payments with your bank over integrated open banking — which is what allows the IBAN to travel from the e-Factura document into the payment without anyone re-typing it, the problem described in paying invoices from e-Factura. Every payment is confirmed at your bank with multi-factor authentication. OpenPay cannot move money on its own, and that is a property of the design rather than a promise about our intentions.