Concept two
Why API and SSO Access Beats PDF Statements
The PDF bank statement is the default because it is familiar, not because it is good evidence. It is a picture of a record, produced by the party with the most reason to shape it, arriving months late and missing whatever was left out. Authorized retrieval replaces the picture with the record.
The comparison, dimension by dimension
Both methods end with financial records in a lawyer’s hands. What differs is where those records came from and what can be said about them afterward.
| Produced PDF statements | Authorized API retrieval | |
|---|---|---|
| Provenance | A file produced by a party, after passing through that party’s hands, mail, and scanner. | Data retrieved from the institution’s own system under the account holder’s authorization, with a retrieval timestamp. |
| Integrity | Trivially editable. Pages can be altered, cropped, reordered, or omitted with no visible trace. | Re-pullable on demand. A second retrieval reproduces the same records, so alteration is detectable rather than invisible. |
| Completeness | Limited to the accounts a party chooses to list and the months they choose to print. | Enumerates the accounts held at each institution the account holder authorizes, including ones nobody thought to ask about. |
| Granularity | Monthly summaries. Balances between statement dates must be inferred by hand. | Transaction-level records with posting dates, amounts, and descriptions, so any date in the window can be computed. |
| Speed and cost | A subpoena to the custodian, a compliance department queue, custodian fees, and often a motion to compel. | An authorization the account holder completes in minutes, with no third-party subpoena and no custodian cost. |
| Scope control | A subpoena is blunt. It reaches whatever the custodian reads it to reach, and the holder has little say. | Read-only, scoped to the authorized accounts, time-limited, and revocable by the account holder at any time. |
| Burden on the holder | Weeks of downloading, printing, scanning, and Bates labeling, usually at a lawyer’s hourly rate. | One authorization session at the institution’s own login page. |
Authorization is the whole point
Single sign-on is not a convenience feature here. It is what makes the record trustworthy: the account holder proves who they are to their own institution, at their institution’s own login page, and the institution decides what to release. No credential is shared with the attorney, with Plaid, or with this site.
What the attorney receives instead is a scoped token. It authorizes a read of the records the account holder agreed to share, for as long as they agree to share them, and it can be revoked without anyone’s permission.
What this method does not do
Overstating the method would undermine it. Four honest limits, each of which has a practical answer.
- The lookback window is finite. Institutions typically expose 12 to 24 months of transaction history. For an older valuation date, retrieval supplements traditional discovery rather than replacing it.
- Coverage is not universal. Most major banks, credit unions, and brokerages participate, but some institutions and some account types do not.
- Consent is required. The account holder must authorize. A party who refuses still has to be subpoenaed, though the refusal itself is now on the record.
- It is not self-proving at trial. Retrieved data still has to be authenticated and, where hearsay is at issue, brought within an exception. The model brief addresses exactly that.
For the mechanics of how the handshake works, see How the OAuth2 API Works and Where the Data Is Stored.
Read the model brief