The short answer
Revoking consent and deleting data are two different actions with two different mechanisms, and doing the first does not achieve the second.
Revocation is a switch at your bank. It invalidates the token, and the app can no longer pull new transactions. That is all it does. The eighteen or twenty-four months of history the app already retrieved sits in its systems exactly where it was, governed by the app’s retention policy rather than by your consent.
Getting that deleted is a separate request, made to the app rather than the bank, under data protection law rather than payment regulation. Most people never make it, because most people reasonably assume revocation covers it.
Why the two are separate
They come from different legal instruments doing different jobs.
The consent you give at your bank is a payment services construct. It governs access to your payment account — who may connect, with what scopes, for how long. Withdrawing it is your right and it takes effect immediately at the access layer.
What the app does with data it lawfully obtained is a data protection question, governed by GDPR in Europe. The app is a controller for that data. It processes it on some lawful basis, keeps it for a period it has defined, and deletes it according to that policy.
The two systems interlock badly at exactly this point. Your bank cannot delete data held by the app; it has no access to the app’s systems and no legal standing to demand erasure on your behalf. The app is not notified of your intentions beyond the token failing.
So the token dies and the data does not.
What the app is still holding
Assume, unless you have evidence otherwise, that a connected app retains everything it pulled: full transaction history including counterparties and descriptors, derived categorisations, any behavioural or affordability scores it computed, and the account metadata.
Some of this it may be required to keep. If the app initiated payments, records of those transactions fall under record-keeping obligations in payment and anti-money-laundering law, often for five years or more, and an erasure request cannot override a legal retention duty. This is a legitimate and correct refusal, and a well-run provider will tell you precisely which records it must keep and for how long.
The rest — the analytics, the categorised feed, the profile — generally has no such protection.
There is also a third category worth naming: data that has been aggregated or anonymised. If anonymisation is genuine and irreversible, that data has left the scope of data protection law entirely and cannot be recalled. Whether transaction data can be meaningfully anonymised is contested, since spending patterns are close to unique, but the claim appears in policies frequently.
The order of operations
Do these in sequence. The order matters — deleting the app first removes your ability to use its own controls.
1. Use the app’s in-product deletion first, if it has one. Many apps have a “delete my data” or “close account” control that triggers their internal erasure process. It is faster than a formal request and it leaves a record.
2. Send a written erasure request. To the privacy or DPO address in the privacy policy. Keep it short and specific:
I am withdrawing consent for account access and requesting erasure under Article 17 GDPR of all personal data you hold about me, including transaction history retrieved from my accounts, derived categorisations and any profiles. Please confirm what has been erased, and identify specifically any data you are retaining under a legal obligation, with the obligation and retention period stated.
That last sentence is the one that produces a useful answer. It forces the provider to distinguish between data it must keep and data it would prefer to keep, and the second category is where the argument is.
3. Revoke the consent at your bank. In online banking under third-party access or connected services. Do this after the deletion request, so the app cannot claim it needed access to identify you.
4. Revoke in the app as well. Belt and braces. Not sufficient alone — revoking at the bank is the authoritative action, because it kills the token regardless of what the app does.
5. Delete the app. Last. Removing it earlier changes nothing on the server and loses you the controls.
The timelines and what to do when they slip
A controller must respond to an erasure request within one month, extendable by two further months for complex requests with notice given to you. In practice, well-run providers confirm within days.
If nothing arrives: send a follow-up referencing the original date, then complain to your national data protection authority. Complaints are free, they are made online, and providers respond to regulator contact considerably faster than to customers. You do not need a lawyer and you do not need to have suffered harm.
If the app has ceased trading, there may be nobody to ask. Data held by a failed company becomes an asset in the insolvency, and where it goes depends on what the administrator does with the customer database. What happens to your data when a fintech shuts down covers that scenario, which is the one where these rights are hardest to exercise.
Doing this before it matters
The whole problem is easier to avoid than to fix.
Check retention before you connect, not after. The privacy policy states it, or fails to. A specific period — 90 days after account closure, 30 days for analytics — indicates a provider that has thought about this. “As long as necessary” indicates one that has not committed to anything. How to read a privacy policy in fifteen minutes covers finding it quickly.
Prefer apps that let you delete in-product. A self-service deletion control is a strong signal, because building one requires the company to actually know where your data is across its systems. Many do not.
Connect fewer accounts. An app that only needs your current account does not need your savings and your mortgage. Scopes are per-account on most banks’ consent screens, and the data you never shared is the data you never have to chase.
Audit quarterly. Consents accumulate silently, and old ones for services you stopped using are still pulling. How to audit which apps can reach your money covers the full sweep across all six places where access hides.