Open banking in Australia lets a consumer direct an accredited data recipient to collect eligible banking data under the Consumer Data Right (CDR). The consumer chooses what to share and can withdraw consent.
For mortgage brokers, this can replace some manual statement collection. Coverage and the lender's evidence requirements decide when you still need statements or another collection method.
How Open Banking Works Under the Consumer Data Right
CDR sharing starts with the client's consent to an accredited recipient collecting and using specified data. The client then authorises their bank to release it. The bank transfers the data electronically through an application programming interface (API).
The client authenticates with their bank, using the bank's identity check, rather than giving the recipient their online banking password. They can manage or withdraw consent through the sharing service. The official CDR sharing process explains these steps.
Product data describes the lender's products, including published interest rates and fees. It is public information. Consumer data describes an individual customer's accounts and transactions, and sharing it requires their consent. A published product rate does not tell you a client's negotiated rate.
The CDR administration overview identifies each body's role. Treasury leads policy and rule development. Its Data Standards Body develops data-sharing standards. The Australian Competition and Consumer Commission (ACCC) manages accreditation and the register, monitors compliance with the rules and takes enforcement action. The Office of the Australian Information Commissioner (OAIC) regulates privacy and confidentiality and handles CDR privacy complaints and eligible data breach notifications.
Accredited Recipients vs Login-Based Statement Tools
Accredited CDR sharing and credential-based collection use different authorisation paths. With credential-based collection, the client enters online banking login details into the statement service so it can retrieve information. That authorisation follows the service's terms. It does not itself establish that a retrieval uses CDR.
| Question | CDR Sharing | Credential-Based Collection |
|---|---|---|
| Where does the client authenticate? | With their bank through its CDR authorisation process. | Through the statement tool's bank-login flow. |
| What permission applies? | Consent specifying the data, use and sharing period, with withdrawal controls. | The authorisation and duration described in the service's terms. |
| What security distinction matters? | The recipient does not need the client's online banking password. | The collection service handles credentials. Its handling and retention terms matter. |
| Which accounts are available? | Eligible accounts and data supported by the participating bank and recipient. | Institutions and account types supported by that tool's retrieval connections. |
CashDeck and illion BankStatements are examples of statement tools brokers use. CashDeck's help centre documents a bank-credential flow: an expired username or password produces an error and the client must re-add the bank. That documents a collection path, not every connection the provider can supply.
BankStatements' security page says credentials are discarded after they are encrypted and passed to the bank. It describes a one-time retrieval authorised by the customer. Its published end-user terms also describe credential-based retrieval and PDF statement collection.
Choose the connection for the client's accounts, rather than treating a tool's name as proof of CDR sharing. A provider can have different collection paths. Confirm which path your request uses before explaining consent and password handling to the client.
The Non-Bank Lending Timeline
Non-bank lending joins CDR in stages. Product data sharing began in 2026. Consumer data sharing is scheduled to start later in 2026 for initial providers, followed by the first group of large providers in 2027.
The official non-bank lending timetable gives exact commencement dates and provider definitions. Lenders that qualify as large providers later follow a timetable measured from when they qualify. Smaller lenders can participate voluntarily.
These phases do not make every non-bank loan available through CDR at once. The non-bank rules exclude complex requests, including requests relating to joint accounts or consumers with nominated representatives. Keep a statement collection path for affected accounts.
What Changes for Statements and Serviceability Evidence
Consented transaction data can replace collecting PDFs where it covers the required accounts and period, and the receiving lender accepts that evidence. It can support living-expense checks and show repayments that need to be matched to declared liabilities.
Check account ownership and the period covered before relying on a report. Identify missing accounts, transfers between the client's own accounts and transactions whose categories need correction. Collect statements or other evidence when coverage is incomplete or the lender requires it.
Open banking changes how you collect evidence. It does not remove the broker's responsibility to make inquiries or check the client's financial situation. The Australian Securities and Investments Commission (ASIC) explains these duties in RG 209 Credit licensing: Responsible lending conduct.
Explain why you need the data, who receives it and how it will be used. Keep the collection and later handling within the client's consent and the privacy obligations that apply to your brokerage. The wider broker technology stack explains where collection tools fit beside other application systems.
Open Banking Uses in a Mortgage Application
Open banking data can support budgeting conversations and application evidence by showing the client's recorded income and spending. Recurring payments can prompt questions about commitments missing from the fact find.
For example, in a hypothetical application, a monthly transfer labelled as a loan repayment needs an explanation from the client. Match it to the declared liability and supporting evidence before using the figure. The transaction label alone does not establish the debt's balance or credit limit.
Data availability and categorisation differ between accounts and tools. A spending summary needs review before you use its totals in a serviceability assessment. Use the data to ask better questions about the client's circumstances, including expenses that fall outside the collection period.
Controls for a Brokerage
Set a brokerage process for approved providers and client data before staff send collection requests. Apply it to CDR services and credential-based tools.
- Use only providers approved through your brokerage or licensee's process. Identify the accredited recipient and the permitted sharing arrangement when using CDR.
- Record the client's consent, its purpose and the data requested. Explain how the client can withdraw sharing and route withdrawal requests to the service that controls it.
- Restrict staff access to the files and tools their work requires. Remove access when duties change or a staff member leaves.
- Define a retention period that meets applicable record-keeping duties. Apply deletion or de-identification rules when information is no longer required.
- Give clients a route to correct errors. Record the correction and update the evidence used for the application.
- Require human review of AI-generated categorisation or summaries. Check the source transactions and resolve errors before relying on an output.
The CDR consumer rights guidance explains consent controls and correction rights. Use the client data security guide for mortgage brokers to set the broader access and handling controls around your collection process.
