Don't bank user T&Cs specifically disallow sharing of your username and passwords though? Why would the bank be happy with a third party interrogating their systems in this way and allow the massive flow of traffic to a [successful] companies IP addresses? Surely there has to be some oversight from the bank?

I think this would be illegal in the UK under Computer Misuse Act, or somesuch, as it's unauthorised access to a computer system; the user doesn't have the authority to grant others access.

Once you give them the login info, how can they get the data from the bank?