I know that banks in Europe are bound by law to follow PSD2, which is a set of guidelines to propose APIs. I found a stackoverflow post to generate the required certificates for that but those are only supposed to be for testing purposes https://stackoverflow.com/questions/50045376/how-to-create-eidas-certificate-with-qwac-and-qsealc-profiles-psd2-specific-att
You can use the PSD2 api to fetch the transactions from your account directly, that would be a lot less troublesome. There is also the woob (formerly weboob) project that has web scraping for a lot of banks (specifically french but also some American ones like amex)
They get hated on because :
they inspect packets. They terminate the TLS sessions at their servers and reencrypt to forward to the backend. This allows them to analyze the data to spot spam, optimize compression and such
they are used everywhere. If they go down, 30% of the internet goes with them.