That XKCD strip is very true for financial standards. :(

I think you missed a question (unless it was intentional :), but how do you deal with enduser bank credential storage (both technically and legally when dealing with bank ToS)?

For example, on the technical side, do you store the credentials themselves or just session tokens/cookies?