Banno Banking

What is Banno?

Banno is the digital banking platform of Jack Henry & Associates, a US financial technology company headquartered in Monett, Missouri. Originally a startup from Iowa acquired by Jack Henry in 2014, Banno now powers the online banking and mobile apps of many US community banks and credit unions. When someone searches for banno online banking or banno bank, they are usually looking for the login of their own institution, which runs on Banno under the institution's brand.

The platform includes Banno Online (web banking), Banno Mobile (branded iOS and Android apps), alerts and push notifications, Banno Marketing for targeted campaigns inside the digital banking experience, Banno People for support staff, and a developer platform with APIs and plugins. It is a hosted service: the institution configures it, and Jack Henry runs it.

Data and cookies collected

Banno processes some of the most sensitive personal data there is: identity and contact details, account numbers, balances, transactions, payments, device information and login history. In the browser, Banno Online relies on first party session and authentication cookies and browser storage to keep the user securely logged in, and on device recognition to support multi factor authentication; exact cookie names are not publicly documented. These elements are strictly necessary for the service.

Banno push notifications reach the mobile apps through Apple Push Notification service and Firebase Cloud Messaging, using a device token, after the user allows notifications. Banno Marketing uses account and usage data to display targeted messages within the app, and many institutions add Google Analytics or Google Tag Manager on their public website; the banno.com site itself uses Google Tag Manager.

GDPR and ePrivacy implications

Banno targets the US market, where the Gramm Leach Bliley Act, the CCPA and banking regulators set the rules. GDPR applies when an institution offers services to people in the EU or monitors their behaviour, for example EU resident customers or visitors tracked on the public website. In that case, under ePrivacy art. 5(3), CNIL guidelines, German TDDDG § 25 and Spanish LSSI CE art. 22.2, only cookies strictly needed for login and security are exempt from consent.

Consent requirements

Authentication, fraud prevention and session cookies need no consent. Push notifications require an explicit opt in through the operating system prompt, and users must be able to turn them off. Analytics tags, advertising pixels and marketing campaigns based on usage or account data require prior consent for EU users, and using account data for marketing also requires a clear legal basis and transparent information.

Data transfers to the United States

Banno data is hosted in the United States by Jack Henry, which has announced a strategic partnership with Google Cloud, and push notifications involve Apple and Google. For EU users, these transfers must rely on the EU US Data Privacy Framework for certified recipients or on SCC 2021/914 with a transfer impact assessment following Schrems II. Financial institutions should obtain Jack Henry's subprocessor list and security documentation.

Practical compliance steps

Map the data flows of your Banno deployment, including push notifications and Banno Marketing, and carry out a DPIA if GDPR applies. Make sure your contract with Jack Henry covers processor obligations, transfer safeguards and incident notification, and check DORA requirements if you are an EU financial entity.

On the public website and in digital banking, block analytics and marketing tags until consent with a consent management platform such as FlowConsent, keep security cookies separate as strictly necessary, and update your privacy and cookie notices to describe Banno, push notifications and marketing campaigns.