Open Banking and the CDR for Accountants

Open banking lets clients share bank data through Australia’s Consumer Data Right (CDR). Accountants can receive that data as eligible trusted advisers through a participating service.

What Open Banking is in Australia

Open banking is the banking part of the CDR, a regulated system for sharing data with the customer’s permission. Treasury’s CDR overview explains the opt-in model and the regulators’ roles.

The bank holds the original data. An accredited data recipient collects the data the client agrees to share. A separate permission can allow disclosure to the client’s accountant.

Banking CDR data can include account details and transactions, as well as saved payees. What your practice receives depends on the service and the client’s permissions.

How Consent and Sharing Work

The CDR sharing procedure separates the client’s consent from their bank’s authorisation:

1. The client chooses a participating service and agrees to its stated use of their data.
2. The service directs the client to their bank to confirm their identity and select accounts.
3. The bank sends the approved data electronically in a format software can read.
4. If the service supports trusted adviser disclosure, the client separately nominates the eligible adviser who can receive it.

CDR providers must explain the data requested and its purpose. Their consent information must also identify who receives it, how long sharing lasts and how the client can withdraw. These are consumer rights under the CDR.

For example, a client could share one business account through a service that delivers transaction records to their accountant. The accountant still needs to establish what period those records cover before using them for a reconciliation.

Clients can withdraw consent. Stopping future sharing and dealing with copies already received are separate tasks. Record the change in your client file and apply the retention obligations relevant to the information your practice holds.

Accountants as Trusted Advisers Under the CDR

Eligible accountants can receive CDR data as trusted advisers without becoming accredited data recipients themselves. The OAIC’s trusted adviser guidance identifies the professional classes and disclosure requirements.

Relevant classes include qualified accountants under the Corporations Act and registered tax agents or BAS agents. Calling yourself a bookkeeper does not establish eligibility. An eligible registered business can also qualify.

The sharing service must take reasonable steps to confirm that the recipient belongs, and continues to belong, to an eligible class. Supply the registration or professional membership evidence that supports your status.

The client must nominate the adviser and give trusted adviser disclosure consent. Their permission for the service to collect bank data does not automatically permit delivery to your practice.

Confirm which person or business receives the data, then restrict staff access to the work they perform. Agree on the requested accounts and period with the client. Keep those details with the authority for the job.

Receiving data through this route does not authorise your practice to collect directly from banks as an accredited recipient. Direct collection is a separate role with its own accreditation requirements.

Open Banking Versus Bank Feeds

Open banking is a regulated sharing method. A bank feed is the delivery of bank transactions into accounting software. A bank feed can use open banking, so the two categories overlap.

Xero’s Australian bank reconciliation guidance describes bank connections that bring transactions into Xero automatically. It also identifies statement imports as an alternative where a direct feed is unavailable.

MYOB’s bank feed information distinguishes classic feeds from open banking connections. Availability depends on the bank and account eligibility. A familiar software name alone does not establish which connection the client uses.

Compare the Connection and Its Output

Route	How Data Reaches You	What to Establish
CDR trusted adviser sharing	A participating service discloses approved data to the nominated adviser	Recipient eligibility, disclosure consent and the delivered period
Bank feed into Xero or MYOB	Transactions arrive in the client’s accounting file	Connection method, available history and any gaps
Screen scraping	A third party uses the client’s login details to collect information	Credential handling and the terms governing collection
Statement import	A file supplies transaction rows for the selected period	File completeness and overlap with existing transactions

Treasury describes screen scraping as collecting data through login details supplied to a third party. CDR sharing uses a different arrangement. The CDR consent standards state that third parties do not need consumer passwords.

For a client whose older records remain in PDFs, a bank statement converter helps turn statements into rows. Compare the imported period with existing bank transactions before adding it, so overlapping records do not create duplicates.

Privacy Safeguards for Bank Data

The CDR has 13 privacy safeguards. They cover matters including consent-based collection, permitted use and disclosure, security and correction. Providers must also explain their handling of redundant data.

These safeguards and the Australian Privacy Principles (APPs) have different roles. The OAIC’s explanation of their interaction distinguishes accredited recipients from banks acting as data holders.

For accredited recipients handling CDR data within the system, the safeguards generally replace the corresponding APP obligations. Banks generally remain subject to the APPs, with specified exceptions and overlapping transparency duties.

Once data reaches a trusted adviser who is not accredited, CDR safeguards no longer protect that copy. Applicable Privacy Act duties and professional obligations still govern the practice’s handling.

Before accepting the records, identify who can access them and where they will be stored. Apply your retention rules to downloaded copies. Explain those arrangements to the client, including how to request a correction or raise a privacy concern.