Fiscora's banking guides optimise the visible variables: yield, fees, access, protection limits. Those are real and worth optimising. They also describe a relationship in which the money is the smaller half of what you hand over.
The larger half is the record. This article is about that — what it contains, who ends up holding it, and the one written exercise that makes the question tractable.
What a transaction history actually is
The register that governs this publication names ambient surveillance: aggregation destroys practical obscurity; anonymity is not a property of a dataset. Both halves matter, and the second is the one people get wrong.
Consider what is inferable from payments alone, without any additional source:
- Health. Pharmacy patterns, specialist consultations, clinic locations, the timing and nature of treatment.
- Religion and belief. Regular donations, institution memberships, purchase timing around observances.
- Politics. Contributions, subscriptions, event attendance.
- Relationships. Shared payments, who you travel with, when a pattern starts and when it stops.
- Trouble. Legal fees, gambling, sudden liquidations, a first payment to a debt charity.
Several of these are, in the governing instrument's terms, sensitive attributes — and it treats constructing inferences about religion, health, sexuality or political alignment as an absolute prohibition when four conditions stack: the attribute was not disclosed for that purpose, the inference is used to target, price, rank or exclude, the person cannot see it, and the person cannot refuse it without losing a function they depend on.
Banking sits uncomfortably close to that line. The fourth element is where it is most exposed: for most people, refusing to have a bank account is not a live option, so a refusal that costs you the account is not a refusal. Whether any given institution crosses the line depends on facts we cannot see from outside — which is itself the point.
The worst-future-holder assessment
The governing instrument requires operators holding person-level data to perform a written assessment. The question is deliberately blunt: who would hold this in ten years if you failed, were acquired, or were compelled — and what would they do with it?
It is required of operators. It is at least as useful performed by the subject, and almost nobody does it. Four pathways, each real:
| Pathway | What changes |
|---|---|
| Acquisition | Your data passes to an institution with a different business model. The privacy policy you agreed to is superseded by theirs, frequently with notice rather than consent. |
| Insolvency | The customer list is an asset of the estate. It is sold to satisfy creditors, to a buyer selected for price rather than for stewardship. |
| Compulsion | A legal order, in a jurisdiction whose rules may have changed since you opened the account. The institution's intentions become irrelevant. |
| Breach | The holder becomes everyone. This is the one people plan for and the least distinctive of the four. |
The instrument's response is a specific prohibition worth knowing: personal data may not be transferred, as part of an insolvency estate or acquisition, to a holder whose intended use falls outside the purpose for which it was collected — without fresh consent meeting the consent-integrity standard, or destruction. In other words, a change of owner is not supposed to be a change of purpose. In practice, notice-and-continue is the norm, and this is one of the widest gaps between the standard and the market.
The exercise, for youPick your main account. Write three sentences: what this record would reveal about you to someone hostile; which of the four pathways is most plausible for this institution in ten years; and what you would want destroyed rather than transferred. Most people have never articulated the third, and it is the one that changes behaviour.
Custody beyond the horizon
The register's Stratum VI names custody beyond the horizon: data and systems outlive the competence, solvency or intent of the party that assembled them, and pass to a holder the subject never contemplated.
The phrase "never contemplated" is doing the work. When you opened an account you consented to a relationship with an institution as it then existed, under rules as they then stood. Neither is fixed, and the consent does not expire when they change. That is a structural defect in how consent operates over long horizons, not a failure by any particular bank.
The instrument requires operators to publish a custody plan: who holds the data now, what happens on insolvency, acquisition, or the death or incapacity of the operator, and what is destroyed rather than transferred. It also states an inverse duty that is easy to miss — a deployment must not preserve, as permanent record, material about a person that a reasonable custodian would expire: spent findings, retracted claims, resolved disputes, and the ordinary record of a person's youth.
Both limbs apply to banking. The record that never expires and the record that vanishes in a migration are the same harm seen from two directions.
Exit, and why cash is not nostalgia
The last harm here is erosion of exit from the technical order: non-participation ceases to be possible; the digital route becomes the only route, and abstention becomes exclusion.
Payments is where this is furthest advanced. Venues that take no cash, services that require an app, accounts that require a smartphone capable of running current authentication. Each individual step is reasonable and convenient. The aggregate is a system with no alternative, and the people excluded are the ones least able to object: the unbanked, people with certain disabilities, people whose documentation does not match an identity system's expectations, and people who simply decline.
The instrument's duty here is stated at the level of the operator — a person who declines must not thereby lose an entitlement, a livelihood, access to a public space, or the ability to transact for necessities, where the operator controls whether that consequence follows.
For an individual, the practical position is narrower and still worth stating:
- Maintain a second institutionNot for yield. For the week your primary account is frozen — by fraud detection, a legal hold, or an outage. This is the single most valuable resilience step in personal banking and it costs nothing.
- Keep some cashAn amount that covers several days of necessities. Cash is the general-purpose fallback: no counterparty, no authentication, no record.
- Know your export route before you need itStatement history in a documented format, downloaded periodically. Closing an account frequently ends your access to its record.
- Separate the accounts that reveal the mostWhere practical, the account that receives your salary need not be the account that records every purchase.
- Read the acquisition noticeThe one email people delete. It is the moment the four pathways stop being hypothetical.
The bracketed question
Interest on deposits meets the four cumulative elements of the prohibition in this publication's governing licence: an exchange of money, a stipulated increase over principal, stipulated as a condition of the deferral itself rather than as consideration for a distinct service or borne risk, accruing in that capacity.
Fiscora's banking guides rank accounts by that increase. Explaining and comparing is not among the prohibited verbs — originate, service, price, broker, securitise, automate — and general-purpose analysis is expressly outside the prohibition. So the guides are within bounds.
Within bounds is not the same as answered. For readers for whom this matters, the permitted alternatives named in the same instrument are the syllabus: fee-for-service pricing, cost recovery at zero markup, genuine profit-and-loss sharing, and lease or sale structures carrying real asset risk. That is a body of practical knowledge this estate intends to build rather than gesture at, and it is a fair criticism that we have gestured so far.
Honest limits
You have very little leverage here. Individual choices barely affect the pathways described. Choosing a different bank changes which institution holds the record, not whether the record exists or what happens to it on acquisition. This article helps you see clearly; it does not hand you power.
The surveillance has real benefits. The same completeness that makes transaction data revealing is what makes fraud detection work, what recovers a disputed payment, and what lets you audit a subscription you forgot. The instrument's own minimisation duty says so — it is deliberately not absolute, because a blanket rule would forbid fraud prevention and security engineering.
Rights vary by jurisdiction. Portability, erasure, retention limits and objection rights differ enormously. The exercise generalises; what you can compel does not.
And cash is genuinely declining for reasons that are not conspiratorial. It is expensive to handle, easy to steal and awkward to account for. The argument here is for a preserved route rather than a reversal, and the honest version admits the route costs someone money to keep open.
Revision log. Sep 2026: first publication. Written as the mastery track for the banking desk's structural issues, referenced from the "More Details" section of Fiscora's banking guides. Reviewed annually.