CDR accreditation. Four tiers. From $80k/year to $1k/month.
To receive CDR data on behalf of a customer, you must be an Accredited Data Recipient (ADR). Four tiers — Tier 1 unrestricted (full access, $80-150k Year 1), Tier 2 restricted (limited use cases, ~half cost), Sponsored Representative (operate under a Tier 1 sponsor), Affiliate (low-risk add-on under principal ADR). Most XIntelliSync SMB customers use existing ADR partners; direct accreditation is the right call when CDR data is core to your product.
Why this lives on XIntelliSync, not on the cdr.gov.au accreditation page
XIntelliSync does not hold ADR accreditation. We chose the partner-consumption path: bank-feed CDR data flows to us via an accredited partner (Basiq is the canonical Australian-bank CDR feed). For SMB customers, that partner-path is the standard — direct accreditation costs $80-150k Year 1 and is only the right call when CDR data is core to your product. What XIntelliSync DOES: automated-bank-reconciliation uses the CDR feed read-only for transaction matching, cashflow-forecast projects forward cash position. The article below is the 4-tier accreditation framework + when direct accreditation is worth it vs the partner path.
Four accreditation tiers
From most to least demanding.
Tier 1 — Unrestricted ADR
Scope — Full access to all CDR data + all use cases. Direct relationship with consumers + data holders. Required: external information-security audit (annual), professional indemnity + cyber insurance ($2M+ combined), comprehensive privacy + consent + dispute-resolution infrastructure, dedicated CDR compliance officer.
Used by — Used by major fintechs (Frollo, Yodlee, Basiq, Adatree), accounting platforms (Xero, MYOB), lending platforms (Athena, Tic:Toc, Pepper Money), and large finance brokers.
Timeline — 4-9 months from application to accreditation. Application fee + ongoing accreditation fees. Annual audit + recertification.
Tier 2 — Restricted ADR
Scope — Limited access to CDR data — restricted use cases (e.g. financial counselling, specific product comparison). Lower compliance burden than Tier 1. Required: external info-sec audit (lighter scope), PI + cyber insurance ($1M+), simplified consent infrastructure.
Used by — Used by financial counsellors, specific-purpose comparison sites, smaller fintechs with narrower use cases.
Timeline — 2-6 months from application to accreditation. Lower fees than Tier 1. Annual audit + recertification.
Sponsored Representative
Scope — Operate under a Tier 1 ADR sponsor's accreditation. Sponsor takes regulatory responsibility for the representative's CDR conduct. Sponsor + representative jointly liable. Used to onboard small fintechs + niche use cases without full Tier 1 lift.
Used by — Common for early-stage fintechs + product-specific add-ons within larger fintech ecosystems.
Timeline — 1-3 months from sponsor agreement to operating. Fees split between sponsor + representative. Sponsor handles annual audit obligations.
Affiliate
Scope — Limited access to CDR data for low-risk add-on use cases (e.g. read-only display of customer's data within a partner app). Affiliate operates under principal ADR's accreditation + consent flow. Used to extend ADR functionality across multiple sub-brands.
Used by — Common for white-label deployments + niche add-on use cases attached to a primary ADR product.
Timeline — 1-2 months from agreement with principal ADR. Lowest fees. Principal ADR handles audit + recertification.
Eight ongoing requirements (Tier 1)
What ACCC + OAIC audit on every renewal.
External information-security audit by registered auditor (Tier 1 = annual; Tier 2 = lighter scope)
Professional indemnity + cyber insurance ($2M+ Tier 1; $1M+ Tier 2)
CDR-specific privacy policy + consent flow + customer dashboard (informed + voluntary + specific + current + time-bound + withdrawable)
Comprehensive dispute-resolution process + AFCA membership (financial-services use cases)
Dedicated CDR compliance officer + documented compliance management system
Information-security maturity aligned to ACSC Essential 8 ML 2-3 (cross-references Pillar #7)
Adequate financial resources (audited financials + ongoing solvency monitoring)
Fit-and-proper-person requirements for officers + key personnel
Where to apply + verify
ACCC + cdr.gov.au accreditation portal.
cdr.gov.au — Become Accredited
Official application portal. Per-tier requirements + application form + ACCC review process + audit guidance.
CDR Provider Register
Official register of currently-accredited ADRs + data holders + sponsored representatives + affiliates. Verify accreditation before granting CDR consent + before contracting with a partner.
ACCC — CDR Rules
CDR Rules 2020 + amendments. Detailed accreditation requirements, conduct obligations, consent rules, breach reporting, sector-specific overlay rules.
cdr.gov.au — Sponsored Representative + Affiliate
Authoritative guidance on Sponsored Representative + Affiliate arrangements. Sponsor + principal-ADR responsibilities, representative + affiliate obligations, agreement structures.
All 22+ industries served
Recommended CDR engagement model per industry.
Construction
Use case — Cash-flow visibility across project accounts via accredited finance brokers + accounting integrations.
Healthcare
Use case — Health sector designation under consideration in 2025-2026 Treasury review. My Health Record adjacent.
Hospitality
Use case — Multi-venue cash-flow consolidation + supplier-payment optimisation via accredited finance partners.
Retail
Use case — Settlement-account reconciliation + payment-provider data flows via banking sector + future merchant data.
Professional Services / Consulting
Use case — Practice cash-flow + invoice-financing decisions via accredited fintech partners.
Digital / Tech / SaaS
Use case — Many fintech SaaS apply for Accredited Data Recipient (ADR) status to consume CDR banking + energy data on behalf of customers.
Finance / Mortgage Brokers
Use case — Mortgage brokers + non-bank lenders + BNPL providers use CDR banking data for serviceability assessment + credit decisions.
Legal
Use case — Trust-account reconciliation + matter-cost forecasting via accredited accounting integrations.
Childcare / Early Learning
Use case — CCS + family payment reconciliation + parent-payment visibility via accounting partners.
Education / RTOs
Use case — Student-fee reconciliation + scholarship + grant payment tracking.
Manufacturing
Use case — Supplier-payment + customer-receivables cash-flow consolidation via accounting + ERP integrations using banking data.
Transport / Logistics
Use case — Fuel-card + customer-payment reconciliation + driver-payment tracking via banking data.
Mining / Resources
Use case — Royalty-payment + government-receivable reconciliation. Energy data critical for energy-intensive sites.
Agriculture / Primary Production
Use case — Farm-management-deposit (FMD) + grain/livestock-buyer payment + government-grant reconciliation.
Fitness / Health Clubs
Use case — Member DD payment + franchise-royalty payment reconciliation via banking sector data.
Not-for-Profit
Use case — Donation reconciliation + grant-payment tracking + ACNC reporting via accounting partners using banking data.
Events / Conferences
Use case — Ticketing-platform + sponsor-payment + supplier-payment reconciliation via banking sector data.
Creative / Photography / Production
Use case — Client-deposit + Screen Australia funding + royalty-payment tracking via banking sector data.
Marketing / Advertising Agencies
Use case — Client-retainer + media-buying account reconciliation via banking sector data.
HR / Recruitment
Use case — Placement-fee + payroll-on-charge reconciliation + invoice-finance use via banking sector data.
Insurance Brokers / Underwriters
Use case — Insurance brokers + underwriters increasingly use CDR for premium-finance + underwriting + risk assessment. Insurance sector designation under Treasury review 2025-2026.
Real Estate / Property Management
Use case — Trust-account + tenant-bond + commission reconciliation via banking sector data.
FAQs
CDR accreditation — answered.
How long does CDR accreditation take?
Tier 1 unrestricted typically 4-9 months from initial application to accreditation. Tier 2 restricted 2-6 months. Sponsored Representative 1-3 months from sponsor agreement. Affiliate 1-2 months from principal-ADR agreement. Allow 6-12 months total for Tier 1 (including pre-application preparation, audit, ACCC review). ACCC publishes guidance on application steps + reasonable time expectations.
How much does CDR accreditation cost?
Tier 1 unrestricted: ACCC application fee (~$30k initial application + ~$15k annual) + external audit (~$25-50k initial + $15-25k annual) + insurance (~$15-30k annual for combined PI + cyber $2M+) + internal compliance resources. Total Year 1: $80-150k. Subsequent years: $50-80k. Tier 2: roughly half. Sponsored Representative: split with sponsor + much lower setup. Affiliate: lowest, mostly principal-ADR fee share.
What is the difference between an ADR and a Data Holder?
Data Holder = the business that originally collected the customer's data (e.g. customer's bank, customer's energy retailer). Required to share data with consenting customer's designated ADR via the CDR API. Accredited Data Recipient (ADR) = a business accredited under Pt IVD that receives customer's data from the data holder via the CDR API after the customer authorises. Same business can be both — e.g. a non-bank lender is a Data Holder for its existing customers + an ADR for serviceability assessment of new customers.
Can I lose my CDR accreditation?
Yes. ACCC can suspend or revoke accreditation for non-compliance. Common triggers: failed annual audit, material privacy breach, failure to honour consent withdrawal, false statements in application, ongoing failure to maintain compliance management system, financial difficulty affecting capacity to comply. Suspension typically with remediation plan; revocation for serious or persistent non-compliance. Both publicly listed on ACCC + cdr.gov.au registers.
Should I become accredited or use a partner?
Most XIntelliSync SMB customers should use an existing ADR partner rather than seek accreditation. Direct accreditation makes sense if: (1) CDR data is core to your product offering, (2) you have $80-150k Year 1 budget + ongoing $50-80k, (3) you can dedicate a CDR compliance officer + audit budget, (4) the use case is broader than what existing ADR partners offer. Otherwise: integrate with an existing ADR (Frollo, Basiq, Adatree, Xero, MYOB) + benefit from their accreditation + audit infrastructure.
What is the Sponsored Representative model?
A Tier 1 ADR sponsor takes regulatory responsibility for a representative's CDR conduct. The representative operates under the sponsor's accreditation. Sponsor + representative jointly liable for compliance. Useful for: early-stage fintechs without resources for full Tier 1; niche use cases within a broader fintech ecosystem; rapid market entry while building toward full accreditation. Commercial agreement typically includes data-handling restrictions + revenue share + termination clauses.
How does XIntelliSync engage with the CDR ecosystem?
XIntelliSync is NOT a directly-accredited ADR. We integrate with the CDR ecosystem via accredited data partners (typically Tier 1 ADRs covering banking + energy data). Customers connect their bank + energy accounts through the partner consent flow + grant XIntelliSync read-only access to relevant data via partner API. We use the data for cash-flow forecasting + reconciliation + tax-payment tracking. Consent is time-bound + withdrawable + visible in the CDR Dashboard at both the data holder + the partner ADR.
Continue reading