Open banking in Australia: what the Consumer Data Right means for budgeting apps

Open banking in Australia is the banking part of the Consumer Data Right (CDR). It lets you choose to share your banking data, such as your transaction history, with a provider accredited by the Australian Competition and Consumer Commission (ACCC), so a budgeting app can show your accounts without you re-typing anything. It is opt-in, your consent lasts up to 12 months, and you can withdraw it at any time. This guide explains how that works, what it means for budgeting apps, and what to do if an app does not use it.

What is the Consumer Data Right?

The Consumer Data Right is an Australian Government scheme that gives you more control over your data. The CDR site describes it as letting you access and share your data with accredited third parties, and says it is an opt-in service: you choose whether to share, with visibility of who gets the data and why.

It is designed to be rolled out sector by sector. According to cdr.gov.au, it has already been rolled out to banking and energy, with non-bank lending to follow as the third sector. Open banking is the name people commonly use for the banking part.

The CDR site lists three things it can make easier: comparing products and services, accessing better value and improved services, and assisting financial and cashflow management. The last one is where budgeting apps come in.

How does open banking work step by step?

You start on an accredited provider’s website or app, and the data then moves directly between providers. The CDR site sets out the steps:

1. Give consent. You give permission for the provider to access your data, on the provider’s website or app.
2. Identity check. Your existing bank verifies you with a one time password.
3. Digital link. You are taken to your bank’s website or app, where you confirm the data you want to share. You can see and manage what you have consented to, and withdraw consent at any time.
4. Data is shared. The data is transferred to the accredited provider in a machine-readable format.
5. You start using the service. For a budgeting app, that means your accounts appear in the app.

The transfer uses application programming interfaces (APIs), so it happens electronically. The format and process are set by the Data Standards Body.

An accredited provider should never ask for your banking password. The OAIC says an accredited business should never ask for your personal password, and in this process your identity is checked by your own bank.

Who can receive your data? Accreditation explained

Providers accredited by the ACCC can offer services using the CDR, and the CDR site also lists CDR representative arrangements, where a business operates under an accredited provider. The CDR site says providers must go through a rigorous accreditation process, managed by the ACCC.

The OAIC adds that to become accredited, businesses must meet strict requirements for data collection, use and storage, information security, protecting your privacy and obtaining your consent. If they do not meet these requirements, their accreditation can be suspended or cancelled, or they can be fined or face other regulatory action.

You can check whether a provider is accredited, and find accredited providers, on the CDR site’s find a provider page. If an app says it uses open banking, that is the place to confirm it.

How does consent work, and how long does it last?

Consent is the foundation of the CDR. The OAIC says a business may only collect, use and disclose your data with your express consent, and that you can withdraw consent at any time.

On the length, the OAIC states that your consent to use your consumer data expires after 12 months. Your consent can end sooner if you stop sharing. After expiry, you would need to give consent again if you want the service to continue.

The CDR site says providers must make clear to you, on their website or app:

• exactly what data you have agreed to share and how it will be used
• who will have access to your data
• how long they will have access to your data
• how you can manage and withdraw consents

The OAIC adds that each business must provide an online consumer dashboard so you can manage your CDR activity, see what you have consented to and what the data is used for, and withdraw consent.

What are your privacy rights under the Consumer Data Right?

The CDR has its own privacy safeguards, found in the Competition and Consumer Act 2010. The CDR site says there are 13 legally binding privacy safeguards. Among them, according to cdr.gov.au:

• You have the right to ask for your data to be corrected if it is inaccurate.
• Your data cannot be sent overseas except in strictly limited circumstances.
• Your data cannot be used for direct marketing unless you consent and the CDR Rules allow it.
• Your data must be destroyed or de-identified when it is no longer needed or at your request, unless an exception applies.

The OAIC also says businesses must comply with the Notifiable Data Breaches scheme, including telling you and the OAIC about a serious data breach.

If you think a business has mishandled your CDR data, you can complain. The CDR site says to complain to the business first and allow a reasonable time to respond, generally 30 days. If you are not satisfied, you can go to the external dispute resolution scheme named in the business’s CDR policy, or to the OAIC.

What does open banking mean for budgeting apps?

For a budgeting app, open banking can mean your accounts and transactions update without you downloading statements. That is the main appeal: less manual work and a more current view.

It also changes what a budgeting app has to be. Only accredited providers, or businesses operating under an accredited provider’s arrangement (CDR representatives), can offer services using the CDR. The CDR site’s find a provider page covers both, and the consent and privacy rules above apply. When you are choosing an app, useful questions are:

• Is the provider, or the accredited provider it works under, listed on cdr.gov.au?
• Does it tell you plainly what data it receives, for what purpose and for how long?
• Can you see and withdraw your consent, and delete your data, easily?
• Is the app read-only, so that it can show your money but not move it?

Open banking does not make a budgeting app give personal advice, and it does not remove the need to check the figures yourself.

What are the alternatives to open banking today?

If an app does not offer open banking, or you would rather not share a live connection, you can still get your transactions into a budgeting app by importing them yourself. Common routes are:

• Statement files. Download a statement or transaction export from your bank’s website or app and import it.
• CSV exports. Many banks let you export transactions as a CSV file, which a budgeting app can read.
• Typing in balances. For a few accounts, entering current balances yourself gives a rough picture, though it takes more effort and shows no transactions.

Importing keeps you in control of exactly what goes into the app, because it only ever sees the file you give it. The trade-off is effort: you repeat the import to keep things current, and categories may need checking.

Which route suits you depends on how many accounts you have and how current you want your view. Neither is better in every case.

Where does Finsplore stand on open banking?

Finsplore does not use open banking today. It works from statements you import, with no banking login, and it is read-only: it cannot move your money. It is not a bank or lender, and it does not give personal financial advice.

CDR connections are planned for a later release. They are not available now, and Finsplore is not claiming accreditation or an open banking connection. If that changes, this guide will be updated, with the date shown at the top.

For how Finsplore handles the data you do add, see security and privacy. If you are thinking about connecting an AI assistant to a finance app, our guide to whether it is safe to connect an AI assistant to your money covers the questions to ask, and explains why screen scraping and sharing your banking login carry different risks from the Consumer Data Right.

If you want help deciding what is right for your situation, consider speaking with a licensed financial adviser.