Yes, Basiq can be a safe way to share bank data when the connection uses the Consumer Data Right (CDR) and informed consent. Basiq has active, unrestricted CDR accreditation. Your client still needs to know which business receives their information and what happens to it after sharing ends.
The connection method matters. Basiq also supports credential-based bank connections, which follow a different process from CDR sharing. Establish which method your broker tool uses before explaining its safeguards.
What Basiq is
Basiq is an open banking platform that connects financial data to other businesses’ applications. A broker tool or lender can use Basiq to obtain information a client agrees to share, then use it for the stated service.
The Australian Competition and Consumer Commission’s CDR register lists Basiq Pty Ltd as an active accredited data recipient. Its accreditation number is ADRBNK000208 and its accreditation level is unrestricted. Accreditation is permission to participate under CDR rules, not a government endorsement of a product.
In a CDR connection, the client approves the requested data and authenticates with their bank. The bank then transfers the authorised data electronically. CDR’s explanation of data sharing confirms that accredited providers do not receive the client’s banking login or password.
Basiq’s security documentation separately describes Digital Data Capture, which uses bank login credentials to retrieve information through internet banking. A Basiq logo alone therefore does not establish that the connection uses CDR. If the flow requests a banking password outside the bank’s own website or app, pause and identify the access method.
Is Basiq Safe?
Basiq’s CDR accreditation and documented security controls support using it for consented bank-data sharing. They do not remove the risk of a fraudulent request or mishandled information after collection.
Basiq’s CDR policy lists ISO 27001 and SOC 1/SOC 2 certifications for its data-centre infrastructure. It also describes encryption and two-factor authentication for administrative access. Infrastructure certifications must not be presented as proof that every broker application has the same certifications.
The CDR consent requirements give clients control over what they share and who can use it. The request must explain its purpose and duration. Clients can withdraw consent.
Before sending a connection request, work through the details your client will actually see:
- Confirm that the request comes from your brokerage or its authorised provider. An unexpected message needs checking through a known contact number.
- Identify the business receiving the data, including any broker tool named in the consent.
- Request only the accounts and information needed for the agreed service. Explain why transaction history is needed if the request includes it.
- Explain the access period and the withdrawal process before the client approves sharing.
CDR bank-data sharing gives access to information. It does not authorise the broker to transfer money. The practical risks include sharing more transaction history than needed or exposing downloaded reports through an insecure brokerage account.
What the Broker Receives and Keeps
The broker receives the data or report made available by the connected tool, within the client’s consent and the tool’s service. Basiq’s CDR policy lists account and balance details, transaction history and customer information among the available data categories. A particular request does not automatically include all of them.
For example, a loan application might require transaction history to assess income and expenses. A different service might need only loan account details. Read the consent request against the work being done instead of assuming every Basiq connection supplies the same report.
The access period and the loan-file retention period answer different questions. Access determines how long the service can keep collecting information. Retention determines what happens to information already obtained.
Basiq’s policy says data is deleted or de-identified according to the client’s instructions when consent expires or is withdrawn, subject to Australian legal retention requirements. That does not justify promising that every copy in a brokerage’s loan file disappears immediately.
The brokerage’s legal role matters. The Office of the Australian Information Commissioner’s guidance for trusted advisers includes mortgage brokers. A nominated trusted adviser receives data with the client’s consent but does not become a CDR participant merely by receiving it. Privacy Act obligations apply where the brokerage is covered, alongside its professional duties.
For businesses covered by the Australian Privacy Principles, APP 11 requires reasonable steps to protect personal information. Restrict reports to staff who need them and use the brokerage’s approved storage. Apply the documented retention schedule to downloads as well as records in the broker tool.
Explaining Bank Connections to Clients
Explain the actual connection method and its purpose before asking a client to approve access. For a CDR connection, a broker can say:
Basiq helps our provider obtain the bank information you agree to share for your loan application. You authenticate with your bank, and we do not receive your banking password. The consent screen shows the information requested and who receives it. You can stop sharing through the service or your bank. We can explain separately which records our brokerage must retain.
Use that explanation only where it matches the request. A credential-based connection needs its own explanation, including who handles the credentials.
To withdraw CDR consent, the client can open the connected service’s consent settings or their bank’s data-sharing dashboard. Basiq also accepts written withdrawal requests. Identify the relevant service and confirm that sharing has stopped after withdrawal.
If the client also wants existing information removed, handle that as a separate request. Explain any lawful retention requirement and what happens to copies already held by the brokerage. Give the client that answer before they decide whether to connect.
