Hey,
It would be really to implement some kind of iban white list for the oauth api. The user may edit the whitelist in the bunq and if an IBAN is on that list the oauth app should be able to transfer money there without further confirmation. Maybe a max transfer amount would be good, too.