If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking credentials, I'm just storing lists of recent transactions and information like which accounts exist and their corresponding transactions, service tokens, banks or credit card companies, credit limits and so on, do I need PCI compliance? What security requirements are there for such an application?
If you’re not a merchant (ie you don't take payment cards) and you are not a service provider to merchants or banks, then there is probably no one who is contractually asking you to comply with PCI DSS -- and so the decision is yours. If you have payment card numbers (the 15/16 digit number in the middle of the card) then you may want to consider it as a good baseline. For another good baseline consider the CIS 20 critical controls.
Also - if you’re in the EU you need to be aware of the EBA's security RTS under PSD2 because it sounds like you may be providing Account Information services. However if you are in the EU, once PSD2 comes into effect (13 Jan 2018)it specifically says that the account number is not 'sensitive data'.