Why Some Banks Make You Re-Link Every 90 Days

Your bank connection expires 90 days after you grant it because some banks — mostly in Europe, and a handful in the US — put a hard time limit on the consent you give when you link an account to an app. The rule comes from open-banking regulation (Europe's PSD2 originally capped consent at 90 days) and from banks' own security policies, not from the app you're using. When the clock runs out, the bank stops honoring the connection until you log in again and re-approve it. It's mildly annoying by design: the bank wants you to periodically confirm you still use that app and still want it reading your data.

Where does the 90-day rule come from?

The number 90 isn't arbitrary. Europe's PSD2 open-banking rules originally required banks to re-verify a customer's consent every 90 days using strong customer authentication — the log-in-plus-code dance you know from your bank's website. UK and EU regulators have since relaxed this (the re-confirmation can now often happen on the app side rather than at the bank), but the 90-day cadence became the industry default, and plenty of banks kept it.

In the US there's no law mandating expiry, but some institutions adopted a similar policy on their own. When a bank moves from screen scraping to a modern OAuth connection — where you log in on the bank's own page and approve specific access — it also gets to decide how long that approval lasts. Some choose "until revoked." Others choose 90 days, 6 months, or a year. If your credit union makes you re-link like clockwork while your big national bank never does, that's simply two institutions making different choices with the same technology. The mechanics of how that approval works are covered in how OAuth bank connections differ from screen scraping.

Is a connection that expires actually safer?

Partly yes, partly it's security theater. The genuine benefit: expiring consent limits the blast radius of forgotten connections. Most people have linked their bank to more apps than they remember — an old budgeting app from 2022, a loan pre-qualification tool they used once. If consent expires, those zombie connections die on their own instead of reading your transactions forever. Without expiry, cleaning them up is on you, which is why it's worth knowing how to revoke an app's access to your bank account directly.

The weaker argument is that re-authentication protects against ongoing fraud. A read-only aggregation connection can't move money, so the risk being managed is data exposure, not theft. And in practice, forcing frequent re-logins trains people to type bank credentials reflexively whenever a prompt appears — which is exactly the habit phishing exploits. Regulators in Europe partly walked back the strict version of the rule for this reason: the friction was pushing people away from safer OAuth connections without measurably reducing harm.

What actually happens when the 90 days run out?

The connection doesn't explode; it goes quiet. Here's the typical sequence:

1. Day 0: you link your bank through the bank's own login page and approve access. The bank issues the aggregator (usually Plaid) a token that works for 90 days.
2. Days 1–89: syncs run normally. New transactions and balances flow through, often multiple times a day.
3. Day 90: the token stops working. The bank rejects the next sync attempt with an error that effectively says "consent expired."
4. Day 90 onward: your app still shows data — but it's frozen at the last successful sync. Nothing new arrives until you re-link.

That last stage is the dangerous one. An expired connection doesn't look broken; it looks like a slow week. Suppose your checking balance synced at $4,212 on the day the token expired. Two weeks later, rent ($1,800), a car repair ($640), and normal spending have taken the real balance to about $1,100 — but your app still says $4,212. If you make a decision off that stale number, the expiry just cost you real money. A good app should flag the failure loudly rather than quietly serving old data; that's the core argument in why bank connections break and what Plaid actually does about it.

How do I know if expiry is my problem or something else is?

Not every disconnection is a 90-day expiry. The tells:

• It happens on a regular schedule — roughly every three months, like clockwork, with no action on your part. That's consent expiry.
• It happens right after you changed your bank password or turned on new two-factor authentication. That's a credential change invalidating the connection, not expiry.
• It happens randomly and resolves on its own within a day. That's usually bank-side maintenance or a temporary outage.
• It happens once and stays broken until you intervene, with a message about consent or authorization. Expiry or revoked access.

If your connection drops for reasons other than the calendar, the causes and cures are different — why your bank keeps disconnecting from your budgeting app walks through the full list. Either way, the fix ritual is the same: go through the app's reconnect flow, not the bank's website alone. Logging into your bank directly does nothing for the app's token.

How to make the 90-day re-link painless

You can't opt out of a bank's expiry policy, but you can shrink the cost of it to about sixty seconds a quarter.

• Re-link the moment you see the prompt. The flow takes under a minute when you do it immediately, and the gap in your data stays at zero days instead of three weeks.
• Use an app that tells you a connection is broken. The failure mode to avoid isn't the re-link itself — it's not knowing you need one. Seven Financial, for example, sends a broken-connection alert and marks the account as stale rather than passing off old balances as fresh.
• Know your bank's login before you need it. Half the pain of re-linking is a forgotten password plus a locked account. A password manager turns the re-link into three taps.
• If one institution expires constantly and another never does, expect that pattern to continue. It's a policy, not a glitch, so calling support won't change it.
• After re-linking, glance at recent transactions to confirm the gap backfilled. Transactions usually catch up automatically; if a stretch looks thin, the steps in what to do when your bank connection breaks cover forcing a fresh sync.

Will the 90-day re-link ever go away?

Probably, gradually. The trend in both the US and Europe is toward long-lived, revocable consent: you approve once, the connection lasts until you cancel it, and you get a dashboard at your bank showing every app you've authorized, with a revoke button next to each. Several large US banks already work this way — link once, forget about it, revoke whenever you want. That model is strictly better: it keeps the security benefit (you can kill access anytime, and you can see exactly who has it) without the quarterly toll booth. Until your particular bank gets there, the 90-day prompt is the price of admission, and the best you can do is treat it as routine maintenance — like changing a furnace filter, except the furnace texts you first.