its meant to be able to stop anything coming in through you web browser.
But it screws around with your PC at API level.
The worrying thing about it is that it is meant to allow the bank to be able to push instructions to your PC and also it allows the bank to pull a status from it.
Because it embeds its self at quite a low level API it basically has legitimate access to everything. It also back ground updates so it can inject what ever it likes into your PC.