Reaching HSBC Uruguay iBanca account data from your own code

Behind the iBanca login sit two account books at once — a personal one and a company one — each carrying live balances in pesos and dollars, a running movement history, queued payments and transfers, and a currency buy/sell desk. iBanca is HSBC Uruguay's transactional channel for both, available around the clock per its own listing. Getting that material out of the app and into your own systems, on a schedule you control, is the job this page scopes.

The honest bottom line: Uruguay has no live open-banking rail to call yet, so the dependable way to reach this data today is the account holder's own authorized session — the same channel iBanca already uses — read through a client we build and hand you. We lead with that, and we shape the code so the BCU's consent rails can slot in later without you rewriting anything.

What iBanca holds behind the login

Naming the surfaces the way the app does, mapped to what an integrator would actually do with each:

Getting to the data, and the route we'd take

Authorized interface integration of the iBanca session

We work out how the app authenticates and how it requests saldos, movimientos and transfer state, then reproduce that exchange in a client that runs under the account holder's authorization. Reachable: everything the table above lists. Effort is moderate and front-loaded into the protocol-analysis phase; durability is good as long as we keep a thin re-validation step in maintenance. This is the route we recommend for work that needs to start now.

BCU Open Finance, once it is in force

The Banco Central del Uruguay has published a consent-based Open Finance scheme as part of its payment-system roadmap, with a stated 2030 horizon that depends on the bill passing. When those rails exist they become the cleanest long-run path. They are not callable today, so we treat this as the upgrade target, not the starting point.

Native sharing and export as a supplement

iBanca has added an account-data sharing feature, per its release notes. Where it fits, we use that consented export to seed a backfill, then keep the session client for the fields it does not cover. Access to a consenting account or a company sandbox is arranged with you during onboarding — that setup is part of the engagement, not something you sort out first.

What lands in your repo

The headline deliverable is code that runs, not a stack of paper:

• A client library in Python and Node.js wrapping the iBanca login, session refresh, balance read, and the movement and transfer-status calls — typed, with examples.
• A poller / webhook-style runner that turns movement deltas and international-transfer milestone changes into events your services can consume.
• An automated test suite built on recorded fixtures of the auth and movement responses, covering the login chain and a representative movement page.
• A batch backfill plus incremental sync design: a date cursor over movements, with the movement id as the dedupe key.

Alongside the code: an OpenAPI/Swagger description of the surfaced endpoints, a short protocol and auth-flow report covering the session and device-binding as observed during the build, interface documentation, and data-retention guidance lined up with Ley N° 18.331. Those round out the package; the client and its tests are what you run on day one.

The client, in outline

Illustrative only — endpoint paths and exact field names are confirmed during the build against a consenting account, not lifted from any published constant.

# Python sketch of the iBanca client
from ibanca_uy import Session

# device-bound login; face/fingerprint is satisfied on the handset, not here
s = Session.from_device(consent=CONSENT_REF)
s.refresh()                       # rotate the short-lived session before it lapses

for acct in s.accounts():         # personal + iBanca Empresas accounts the consent covers
    bal = s.balance(acct.id)      # -> {moneda, saldo_disponible, saldo_contable}

    cursor = None
    while True:
        page = s.movements(acct.id, since="2026-05-01", cursor=cursor)
        for mv in page.items:     # fecha, importe, moneda, concepto, contraparte, estado
            emit(acct.id, mv)     # mv.id is the dedupe key
        if not page.next:
            break
        cursor = page.next        # delta cursor for the next slice

Where teams plug this in

• Treasury position. Each morning, pull available balances across the personal and company accounts in both currencies into one cash-position view.
• Accounting import. A nightly movement delta lands in the ledger, deduped on movement id, with concepto mapped to your own categories.
• Cross-border ops. Poll international-transfer milestones and raise an event when a wire changes state, instead of someone refreshing the app.
• Payout reconciliation. Match scheduled and frequent transfers against the movements that actually cleared.

Consent, the BCU, and Uruguay's data law

Today the firm basis for this work is the account holder's own consent — a customer authorizing the reading of their own balances and movements. That is what every build runs on, with consent recorded and revocable, the data scope kept to what the integration needs, and an NDA where the client wants one.

The regulatory direction is set but not yet operative. The Banco Central del Uruguay has presented an Open Finance scheme on its 2026–2030 payment-system roadmap, framed so that the customer owns their financial data and chooses whom to share it with; the BCU itself ties the 2030 target to legislative timing. We track that, and design so the move onto official consent rails is a swap, not a rebuild. Personal-data handling, meanwhile, sits under Ley N° 18.331 of 2008 and its regulator, the URCDP, which governs how customer data is collected, stored and transferred — the baseline our retention and logging follow.

What we account for in the build

Two things about iBanca specifically shape the work, both handled on our side:

• Two currencies in one account. Balances and movements come back in pesos and dollars, and a single account can hold both legs. We key every figure on the moneda field and normalize to ISO currency codes, so a UYU movement is never quietly summed into a USD total.
• Company accounts are multi-user. iBanca Empresas routes transactions through an administrator approval step. We model that flow as a state machine — pending, approved, executed — and scope the sync per authorized user, so an operator's view and an admin's view stay separate and the approval queue is captured rather than flattened.
• A short, device-bound session. Login is gated by facial recognition or fingerprint on the handset, and the resulting session is bound to that device. We arrange a consenting account and a device for the build with you at onboarding, and the client handles session-token refresh internally so a multi-page pull does not stall.

Interface evidence

The app's own store screenshots, for reference on the surfaces above.

Other Uruguay finance apps in the same picture

A buyer aggregating Uruguayan accounts usually wants more than one institution. These sit in the same retail-finance space as iBanca and tend to come up alongside it; named for context, not ranked.

• App eBROU — Banco República's retail app, holding balances, movements and transfers for the state bank's customers.
• BROU Llave Digital — BROU's credential app that authorizes logins and operations.
• Itaú UY — Banco Itaú Uruguay's app for accounts, cards and transfers.
• Banco Santander Uruguay — Santander's retail app covering accounts, cards and payments.
• Scotia Móvil — Scotiabank Uruguay's mobile banking, with balances and transfers.
• Prex — a prepaid-account fintech with instant transfers between users.
• OCA — a card issuer's app exposing card balances and statements.
• Midinero — Redpagos' prepaid-account app for everyday payments.
• Mercado Pago — the region-wide wallet with balances, payments and QR transfers.

Questions integrators ask

Can the client keep a sync running against iBanca's short-lived, biometric-gated session?

Yes. Login is bound to the handset and gated by face or fingerprint, and the session token is short-lived, so the client rotates it before it lapses and resumes the movement pull where it left off. The build runs against a consenting account and device that we set up with you during onboarding.

Does the data come back with the peso and dollar legs separated?

It does. iBanca carries balances and movements in both Uruguayan pesos and US dollars, and the client keys every figure on the account's moneda field, normalized to ISO currency codes, so a peso movement is never folded into a dollar total.

Can it cover iBanca Empresas, where company admins approve transactions, not just personal accounts?

Yes. We model the corporate approval flow — pending, approved, executed — as a state machine and scope the sync per authorized user, so an operator's view and an administrator's view stay distinct.

If Uruguay's Open Finance framework comes into force, does the integration get rebuilt?

No rebuild on your side. The Banco Central del Uruguay has set out a consent-based Open Finance scheme on its 2026 to 2030 payment-system roadmap, with a 2030 horizon that depends on legislation. The client is structured so those consent rails can sit behind the same interface once they exist, leaving your calls unchanged.

Where these facts come from

Checked in June 2026 against the app's own material and Uruguay's published rules: HSBC Uruguay's iBanca product page and its Google Play listing for the feature set and platform support; the Banco Central del Uruguay notice on the 2026–2030 payment-system roadmap for the Open Finance direction; and the text of Ley N° 18.331 for the data-protection baseline. Where a detail is not public — internal endpoint paths, for instance — it is confirmed during the build, not asserted here. Compiled by OpenFinance Lab — integration engineering, 2026-06-08.

To put a first iBanca client in front of your team, a working login plus balance and movement sync usually lands in one to two weeks. Take it as runnable source you own outright, from $300, paid only after delivery once it does what you asked; or call our hosted iBanca endpoints instead and pay per call, with nothing up front. Either way, all we need to begin is the app name and what you want out of its data — tell us at openfinance-lab.com/contact and we will scope it.