How Does a Bank Account Connect to ChatGPT? The Technology Behind ONE ZERO's AI Integration and What SMBs Can Learn

Until recently, anyone who wanted ChatGPT to make sense of their finances had to prepare the data first: export a spreadsheet, remove irrelevant columns, upload screenshots, and explain which account was which. Even then, the model only saw a partial snapshot. A pending charge, a deposit shown elsewhere, or an account at another bank was simply missing.

ONE ZERO's new ChatGPT integration changes the starting point. A customer can ask a question in plain language, and the system can retrieve current, processed financial information, subject to authentication and explicit permission. Public demonstrations included balances, upcoming charges, deposits, savings, and liquid assets. The bank also plans to support the preparation of banking actions, while keeping final approval and authentication inside its own app. Calcalist and Geektime covered the launch in July 2026.

It is tempting to call this 'giving ChatGPT access to the bank', but that hides the most important part of the design. The model does not roam freely through core banking systems or receive the customer's password. Separate layers sit behind the conversation, each with a limited role. That separation is what makes the service useful and what should make it safer.

First, an important correction: this probably is not DNS-AID

If DNS-AID came to mind, the assumption is understandable. DNS-AID is an emerging standard designed to help AI agents discover an organisation's official service endpoints through DNS. However, there is no public evidence that ONE ZERO uses it, and it is not required for a connector that a customer adds to ChatGPT deliberately.

The central technology appears to be an MCP-based connector, or at least one following the same pattern. MCP, the Model Context Protocol, is an open standard for discovering tools, sending structured requests, and receiving structured results. Its documentation compares it to USB-C: build one standard interface, and compatible clients such as ChatGPT and Claude can use it.

MCP does not replace the bank's APIs. It presents selected capabilities as tools the model can call. Instead of exposing a database, a service might offer narrowly defined tools such as 'show upcoming charges' or 'summarise spending by category'. These are illustrative names, not tools published by ONE ZERO. The model may request an operation, but the server decides what is permitted, validates the input, and returns only the required result.

OAuth: permission without sharing a password

When a customer connects the service, they are redirected to authenticate with the bank and review a consent screen. This is the role of OAuth. Instead of handing a username and password to ChatGPT, the bank issues a limited access token. That token can be restricted to specific permissions, expire after a set period, and be revoked without changing the customer's account password.

In a modern MCP setup, ChatGPT is the client, the MCP server is the protected resource, and OAuth establishes the authorised relationship. OpenAI documents an authorization-code flow with PKCE, reducing the risk that an intercepted code can be replayed. For an SMB owner, the principle matters more than the acronyms: every user and integration needs identifiable, limited, and revocable access.

The data layer: APIs, open banking, and one coherent picture

The connector does not know a customer's balance by itself. Behind it are bank systems, APIs, and ELLA's financial data layer. The picture may also include external accounts and cards connected through open banking. The Bank of Israel describes open banking as API-based sharing of financial information, with customer consent and under security and privacy rules. The information may include balances, transactions, credit, deposits, and savings.

Raw data is not an insight. Merchant names appear in several formats, internal transfers can look like expenses, and instalments need different context from one-off charges. A processing layer must clean, reconcile, classify, and enrich the information before it reaches the model. ONE ZERO says only information relevant to the question is sent to the external agent, after being organised. That improves performance and privacy: less unnecessary data means less exposure, fewer tokens, and less room for misinterpretation.

The bank's 2025 annual report adds useful context. It describes an LLM-based service, advanced data analysis, and ongoing updates and recommendations based on account and card data connected through open banking. It also notes an enterprise AWS agreement and core banking services from TCS. This does not prove where every connector component runs, but it shows the service is not a clever prompt attached to an app. It rests on established data, banking, and operational infrastructure.

ELLA and the LLM: who actually does what?

ChatGPT provides the conversational interface: it interprets the request, selects a tool, and explains the result. ELLA supplies financial context and mediates access to bank systems. Language models are good at understanding intent and presenting options. Balance calculations, permission checks, and payment instructions should remain inside deterministic, controlled services.

An archived ONE ZERO job listing describes retrieval-augmented generation, AI agent frameworks, and tooling such as LangChain and LangGraph. This is a clue about how the bank builds AI generally, not an official diagram of this connector. Still, it suggests a controlled path: identify intent, retrieve data, verify it, and only then produce a response.

What changes when the system moves from reading to acting?

The first version of the connection is mainly designed for retrieval and analysis. The next stage is significantly more sensitive. There is an enormous difference between asking, 'How much did we spend on software this month?' and saying, 'Transfer NIS 20,000 to this supplier'.

In a sound action flow, the model never receives final authority. It prepares a structured request, the bank checks limits and permissions, and the customer receives the details in the banking app for approval and additional authentication.

That is meaningful human-in-the-loop control. The approver should see the amount, destination, and effect before execution, and the system should record who requested and approved the action. OpenAI recommends server-side input validation and human confirmation for irreversible actions, partly because of prompt-injection risk.

So where does DNS-AID fit?

MCP answers, 'How do I communicate with this service?' OAuth answers, 'Who is the user, and what are they allowed to do?' DNS-AID answers a different question: 'Where is the organisation's official service?'

The IETF draft uses a structured namespace and existing DNS record types rather than new ones. SVCB is the primary discovery record, carrying the endpoint and its operational parameters. TXT acts as the fallback where SVCB is not available. An optional TLSA record supports TLS identity authentication, and DNSSEC protects the integrity of the published discovery data. The draft makes clear that this is a discovery bootstrap, not a method for retrieving banking data or authorising payments.

In the future, an AI assistant may be able to query a company's DNS, find its official MCP server automatically, and determine which capabilities it publishes. In ONE ZERO's current flow, the user adds and authorises a known connector, so DNS-AID is not a prerequisite. For a deeper explanation, read our guide to DNS-AID and business-agent discovery.

What an SMB can take from this

Most small and medium-sized businesses do not need to build a digital bank or train their own model. They can still adopt the same architectural pattern on a much smaller scale:

1. Start with one business question, not a vague plan to 'add AI': overdue invoices, stuck tickets, or unused Microsoft 365 licences.
2. Establish a reliable source of truth. AI connected to a messy CRM will explain the mess with greater confidence.
3. Expose a few read-only tools through an API or MCP. Return a limited result, not a database dump.
4. Add OAuth or SSO, role-based access, short-lived tokens, and revocation.
5. Add actions only after read access is stable. Drafting can be automatic; sending, repricing, or paying should require approval.
6. Log and test the system. Know which tool ran, what data returned, and what happens when confidence is low.

Imagine a manager asking, 'Which customers are more than 30 days overdue, and what is the total?' The agent reads only invoice data, returns a list, and drafts reminders. The manager reviews and approves them. It is less dramatic than an 'autonomous agent running the business', but far more useful and less dangerous.

The larger lesson from ONE ZERO is not that every company should bring its bank account into a chat window. It is that the model alone is not the product. The value emerges when clean data, well-designed APIs, precise permissions, and human controls meet a convenient conversational interface. For SMBs, that is encouraging. You do not need to compete with AI laboratories. You need to make your existing information and workflows safely accessible to an agent, one controlled use case at a time. If you want help deciding which controls belong around that first use case, NetFortress builds and reviews the security layer behind business AI for Israeli SMBs.