Open Banking Update: CDR Legislation

The Federal Government recently passed the Consumer Data Right (CDR) legislation, which ushers in the new era of Open Banking for the financial sector.

On 1 August 2019, the Federal Government passed the Treasury Laws Amendment (Consumer Data Right) Bill 2019, which subsequently received Royal Assent on 12 August 2019. Open Banking is the first instalment of the Consumer Data Right legislation (CDR) in Australia, which gives individuals more control over their own data.

This legislation will allow individuals and businesses the right to obtain certain types of their data, which they have already shared with their financial institution, as well as provide authorised third parties access to this data.

Open Banking Rules & Guidelines

The Australian Competition and Consumer Commission (ACCC) has since published the final version of the Consumer Data Right (CDR) legislation governing elements that are central to the implementation of the CDR in the financial sector.

As the CDR regime will allow consumers to request data holders to provide their data to accredited entities, the ACCC have now also released draft guidelines on the CDR accreditation process and on the insurance and information security requirements of accreditation. The intent of the guidelines is to provide information to assist applicants with lodging an application for accreditation as well as guidance on how applicants are to meet the obligations to protect data from misuse and unauthorised access.

Timeline

The current CDR regime rollout timeline is as follows:

Date	Requirement
July 1, 2019	Big 4 Banks to provide generic product data for deposit accounts and credit cards via API
Feb 1, 2020	Big 4 Banks to provide customer specific data for deposit accounts and credit cards, and generic data for mortgages and home loans, mortgage offset accounts and personal loans, via API
July 1, 2020	All other ADIs to provide generic data for deposit accounts and credit cards via API
July 1, 2020	Big 4 Banks to provide customer specific data for mortgages and mortgage offset accounts, and generic data for all other loans, leases and specialist accounts (e.g. trust accounts, pensioner deeming accounts), via API
Feb 1, 2021	All other ADIs to provide customer specific data for deposit accounts and credit cards via API, and generic data for home loans, mortgage offset accounts and personal loans via API
Feb 1, 2021	Big 4 Banks to provide customer specific data for all other loans, leases and specialist accounts (e.g. trust accounts, pensioner deeming accounts) via API
July 1, 2021	All other ADIs to provide generic data for all other loans, leases and specialist accounts (e.g. trust accounts, pensioner deeming accounts), and customer specific data for home loans, personal loans and mortgage offset accounts, via API
Feb 1, 2022	All other ADIs to provide customer specific data for all other loans, leases and specialist accounts (e.g. trust accounts, pensioner deeming accounts) via API

The ACCC has advised that the Big 4 Banks have already commenced providing generic product data (as required by 1 July 2019) on a pilot basis. The ACCC has also now selected ten entities to participate in the testing of the CDR ecosystem in the run up to the next milestone in February 2020. The selected participants offer a broad range of innovative services to consumers, including services to manage personal finances, facilitate book keeping and assess a consumer’s financial status.

Requirements for Indue ADI Clients

From 1 July 2020, all of Indue’s ADI clients will be required to meet the obligation advised above. The required APIs for data transfer will need to be developed in accordance to the Consumer Data Standards, which have been finalised by CSIRO’s Data61 as the appointed Data Standards Body for the CDR regime. Indue recommends that clients engage with their core banking platforms to understand what API solutions are available to support these new requirements.

Indue is currently looking into opportunities for hosting client sessions on Open Banking to assist in the understanding of requirements, impacts and implications of this new data regime for our clients.