Reaching the account and card records held behind Citytouch

Citytouch keeps up to roughly a year of transaction history on each account and the last two statements on each credit card, all sitting behind a single Citytouch ID and password — that is the data an integrator actually wants, and per City Bank's own listing it can be exported to PDF from inside the app. City Bank PLC has run this service since the bank's early move into digital channels, and it now carries the everyday balances, statements, card ledgers and transfer history for a large retail base in Bangladesh. The question for anyone building on top of it is not whether the data is rich. It is how to reach it under proper authorization in a market whose open-banking rulebook is still being written.

The route we would run here is consented interface integration: documented analysis of the app and web session, exercised against an account whose holder has authorized the work. There is no live national open-banking API to ride yet, so the dependable basis is the accountholder's own consent — and the integration is designed so it can switch onto Bangladesh Bank's standard once that lands.

What data Citytouch actually holds

The map below follows the names City Bank uses in the app rather than inventing generic buckets.

The routes that apply

Consented interface integration (the one we recommend)

Replay and instrument the authenticated app and web session for an account whose holder has authorized it, then build a clean client around the calls that return balances, statements, card data and transfer records. Reachable: effectively everything the user sees. Effort: moderate — the heavy lift is the auth and session handling, not the data parse. Durability: good while the front end is stable; it moves when City Bank reworks the portal, which we plan maintenance around. We arrange the consenting account and access scope with you at onboarding.

Native PDF export as a backfill

Citytouch lets the user download statements as PDF for the available window. That is a low-friction way to seed history on day one — we parse those documents into the same schema the live integration emits, so the two agree. It is a supplement, not the spine: PDFs lag and carry less structure than the session calls.

Standardized open-banking API (forward path)

Bangladesh Bank has signalled it intends to publish open-banking guidelines and standardized API protocols around mid-2026 per local reporting, with a working committee expected first. When that exists and City Bank exposes it, it becomes the cleanest long-run channel. We build the consented integration now with an auth layer that can be repointed at the standard later, so today's work is not thrown away.

A consented session, sketched

Illustrative shape only — exact field names are confirmed against the live session during the build, not guessed here.

// authorized session for a consenting Citytouch account
POST /citytouch/auth/login
  body: { citytouch_id, password, device_fingerprint }
  -> 200 { session_token, requires_otp: true }

POST /citytouch/auth/otp
  body: { session_token, otp }
  -> 200 { access_token, expires_in }       // short-lived; refresh on expiry

GET /citytouch/accounts            (Bearer access_token)
  -> [ { account_id, product_type:"savings",
         balance:{ amount, currency:"BDT" }, tagged:true } ]

GET /citytouch/accounts/{id}/statement?from=2025-06-01&to=2026-06-01
  -> { window_capped_at_days: 365,           // mirrors the portal's own ceiling
       txns:[ { posted_at, narrative_en, narrative_bn,
                debit, credit, running_balance } ] }

// normalize EN/BN narratives -> single schema; map rail status per transfer
on_error(429|503): backoff + retry; never replay a transfer instruction

What lands at the end

Each engagement produces a working integration plus the documents to run and audit it, tied to the surfaces above:

• An OpenAPI / Swagger spec describing the normalized Citytouch endpoints we expose (accounts, statements, cards, transfers).
• A protocol and auth-flow report covering the login, OTP and token-refresh chain as it behaves on this app.
• Runnable source for the key endpoints in Python or Node.js, including the EN/BN narrative normalization and per-rail transfer mapping.
• Automated tests against recorded sessions, including the one-year statement cap and the card two-statement window.
• Interface documentation plus data-retention and consent-logging guidance for operating it lawfully.

Consent and the law it runs under

City Bank is supervised by Bangladesh Bank, and as of this writing the country does not yet have a live, mandated open-banking scheme — reporting indicates the central bank aims to publish guidelines and standardized APIs around mid-2026. Because there is no statutory data-sharing rail to invoke today, the integration rests on the accountholder's explicit authorization: the consenting customer grants access to their own Citytouch data, and that consent is scoped, time-bound and revocable. On the privacy side, Bangladesh's Personal Data Protection (Amendment) Ordinance was gazetted in early 2026 per reporting, and banking is among the sectors it treats with localization and lawful-sharing scrutiny. We operate authorized and logged, minimize what is pulled to what the use case needs, keep consent records, and sign an NDA where the work touches anything sensitive.

Things we account for on this build

• The history ceiling is real and server-side — about a year per account and two statements per card. We design pagination and backfill around those caps so the sync reflects what the portal genuinely exposes, and we schedule captures where a longer archive is wanted.
• Citytouch is bilingual. Transaction narratives arrive in English or Bangla depending on the user's toggle, so we normalize EN and BN labels into one stable schema rather than leaking the language choice downstream.
• Transfers span BEFTN, RTGS, NPSB, Cash by Code and CityPay QR, each with its own settlement timing and status vocabulary. We map those per rail into a single transfer object and treat initiation as non-idempotent — an instruction is never silently replayed.
• The regime is mid-change. We keep the auth layer modular so the same integration can be repointed at Bangladesh Bank's standardized API once it is published, without re-architecting the data layer.

Freshness and reliability

Statement and balance data is as live as the session: a refresh re-runs the authenticated calls and re-reads what the portal shows. The known constraints are the history caps and OTP-gated login, which we handle with token refresh and backoff rather than hammering the auth endpoint. When City Bank reships the front end, parsers can drift — a re-validation pass is part of maintenance so a layout change surfaces as a caught test, not a silent gap.

Interface evidence

Screens from the published Citytouch listing, useful for confirming which surfaces map to which data domain.

Pricing and how it runs

Source-code delivery for a Citytouch integration starts at $300, payable after delivery once you are satisfied with what runs: runnable source, the OpenAPI spec, the protocol and auth-flow report, tests and interface docs, shipped in one to two weeks. If you would rather not host it, the pay-per-call hosted API is the other model — we run the endpoints, you call them and pay only for the calls, with no upfront fee. You give us the app name and what you want out of its data; access, the consenting account and any compliance paperwork are arranged with you as part of the work. Tell us what you need from Citytouch and we will scope it.

Similar apps in the same data picture

These hold comparable Bangladeshi banking or wallet data; an aggregator usually wants several normalized behind one schema.

• bKash — the dominant mobile wallet, holding balance, P2P, cash-out and merchant-payment history.
• Nagad — the Bangladesh Post Office wallet, with balances and a large transaction ledger.
• Rocket — Dutch-Bangla Bank's mobile financial service, carrying agent, bill-pay and transfer records.
• Upay — UCB's wallet, holding transfers, top-ups and bill payments.
• Nexus Pay — Dutch-Bangla Bank's card and account banking app, with balances and card data.
• Astha — BRAC Bank's retail banking app, exposing accounts, cards and statements.
• EBL Sky Banking — Eastern Bank's internet banking app, with accounts and statement views.
• Cellfin — Islami Bank's digital wallet and account app, holding balances and transaction history.

Questions integrators ask

Can you reach more than a year of Citytouch transactions?

The portal itself caps account transaction history at roughly one year and the credit-card view at about the last two statements, as the app describes it. We mirror that ceiling rather than pretend there is more behind it, and where a longer record matters we set up scheduled captures so each window is archived as it becomes available.

Which transfer rails does the integration cover — BEFTN, RTGS or NPSB?

Citytouch initiates and records transfers across BEFTN, RTGS and NPSB, plus its own Cash by Code and CityPay QR flows. Each rail settles on different timing and returns different status semantics, so we map the status codes per rail into one normalized transfer object instead of flattening them together.

Bangladesh has no live open-banking API yet — what is the route for Citytouch?

The working route is consented interface integration under the accountholder's own authorization, with documented protocol analysis of the app and web session. Bangladesh Bank has said it intends to publish open-banking guidelines and standardized API protocols around mid-2026 per local reporting; we structure the auth layer so the same integration can adopt that standard once it ships, without a rebuild.

How do you handle Citytouch's English and Bangla responses?

Citytouch serves both English and Bangla. We normalize the EN and BN field labels at the parsing layer so downstream consumers get one stable schema and consistent keys regardless of which language the user has toggled in the app.

How this was checked, and sources

Checked in June 2026 against City Bank's published Citytouch material and current reporting on Bangladesh's open-banking and data-protection plans. The data surfaces, the one-year and two-statement windows and the transfer rails come from the app's own listing and FAQ; the regulatory timeline comes from local press; the privacy position from data-protection coverage of the 2026 ordinance.

• Citytouch on Google Play (feature list, package ID)
• Citytouch FAQ (statement windows, transfer behaviour)
• The Business Standard — Bangladesh open-banking plans and timeline
• DataGuidance — Bangladesh Data Protection Act overview

Mapped by the OpenBanking Studio integration desk · June 2026.