Comment by arccy
8 hours ago
risk management is all about what the bank is willing to trust. in this case it decided it was risky because have any information on the provenance of your overlay, but you could source an overlay from somewhere they trust, like the default app store.
The bank wouldn't (hopefully ※) do that if it was illegal or technically too complex. Letting the bank decide is fundamentally problematic IMHO.
※ I'm aware expecting HSBC to follow the law would be extremely naive given their track record.