Pillar · Consumer Data Right (CDR) Australia
CDR + Open Banking — every accredited recipient. Every sector. Every customer consent.
The Consumer Data Right is Australia's economy-wide data-portability regime. Banking went live July 2020. Energy followed November 2022. Non-bank lending from November 2024. Telecommunications + insurance + health under Treasury review for 2025-2026. To receive CDR data, you become an Accredited Data Recipient (ADR) under one of 4 tiers — OR consume via accredited fintech partners. XIntelliSync integrates via partners; you authorise via the CDR Dashboard at cdr.gov.au.
Why this lives on XIntelliSync, not on the cdr.gov.au registry
XIntelliSync uses CDR via accredited partners. We do not hold ADR accreditation directly. Read-only, one direction, no shortcuts.
CDR is Australia's economy-wide data-portability regime. To receive CDR data on behalf of a customer, you become an Accredited Data Recipient (ADR) under one of 4 tiers (Tier 1 unrestricted, Tier 2 restricted, Sponsored Representative, Affiliate) — OR you consume CDR data via an existing accredited partner. XIntelliSync chose the partner path: the data we use for cash-flow forecasting + bank reconciliation flows to us through accredited fintech partners (Basiq is the canonical Australian-bank CDR feed), under the customer's explicit consent at both the Data Holder (the bank) and the Accredited Data Recipient (the partner).
The accountability chain is honest: the bank holds the data, the accredited partner is the ADR, the customer authorises consent in the CDR Dashboard at both, and XIntelliSync is the downstream consumer that uses the data ONLY for the purposes covered by consent. We cannot fake the accreditation, cannot bypass the customer-consent flow, and cannot retain data after the customer withdraws consent. The platform's automated-bank-reconciliation agent reads the feed read-only — there is no write-back, no outbound payment initiation, no portability of the data outside the consent scope.
XGVS — 42 layers, 6 stages, 356+ gates across 34 compliance frameworks. Every action passes every gate that applies — or the action halts and tells you why. CDR Rules, Privacy Act overlay on bank-feed data, APP 8 cross-border safeguards, and APP 11 reasonable security on the read-only feed are four of those 34. CDR accreditation itself stays with our partner; the read-only consumer behaviour stays with us.
See the bank-reconciliation agent that uses the CDR feedThe four pillars of Australian CDR compliance
Accreditation · Sector Rollout · Consent · International Comparison.
Every business operating in the CDR ecosystem must answer the same four questions. Am I accredited (and at what tier)? Which sectors am I receiving data from? How do I manage customer consent properly? How does Australia's CDR compare to UK + EU Open Banking?
CDR Accreditation + Recipient Types
Tier 1 unrestricted, Tier 2 restricted, Sponsored representative, Affiliate.
CDR accreditation under Competition and Consumer Act 2010 (Cth) Pt IVD · ACCC + OAIC joint regulators · 4 accreditation tiers
To receive CDR data on behalf of a customer, a business must be an Accredited Data Recipient (ADR) under one of 4 tiers. Tier 1 (unrestricted) for full data access; Tier 2 (restricted) for limited use cases; Sponsored Representative model for businesses sponsored by an existing Tier 1 ADR; Affiliate model for low-risk add-on use. Application + audit + ongoing compliance required for all tiers. ACCC + OAIC are joint regulators.
CDR Data Flow — Banking + Energy + Beyond
Banking live since July 2020. Energy live since November 2022. Non-bank lending from November 2024.
Banking sector designation 2020 · Energy sector designation 2022 · Non-bank lending 2024 · Telecommunications + Insurance + Health under review
Banking was the first CDR sector — all major + many smaller banks have been data holders since July 2020 (Tier 1 banks first; smaller ADIs phased in by July 2022). Energy followed November 2022 (electricity data first; gas + water later). Non-bank lending sector designation took effect November 2024. Telecommunications + insurance + health under Treasury review for designation in 2025-2026. Each new sector adds new data holders + new use cases.
CDR Customer Consent Management
Consent must be informed, voluntary, specific, current, time-bound — and withdrawable.
Privacy Act 1988 + CDR rules + ACCC compliance guides · 12-month maximum consent duration · plain-English consent flow
CDR consent is a strict subset of privacy consent — informed (clear explanation of what data + why), voluntary (no bundled consent), specific (granular per data set + use case), current (no rolling re-consent without explicit refresh), time-bound (12-month maximum duration before re-consent), and withdrawable (one-click revocation honoured within 2 business days). The CDR Dashboard is the consumer-facing visibility + control surface.
CDR vs UK/EU Open Banking
Australia's economy-wide CDR vs UK's sector-specific Open Banking.
Australia CDR — economy-wide · UK Open Banking — banking-only via PSD2 · EU Open Banking + PSD2/PSD3 · Brazil + Saudi Arabia open finance
Australia's CDR is more ambitious in scope than UK Open Banking — Australia covers banking + energy + non-bank lending (and expanding) under one accreditation framework, while UK Open Banking is banking-only under PSD2 + the Open Banking Standards Body. EU Open Banking via PSD2 (PSD3 from 2026) is similar to UK. Brazil + Saudi Arabia + Singapore + Hong Kong have launched open finance regimes since 2020 with mixed-and-matched approaches.
What XIntelliSync actually does about CDR
Two binaries, both backed by real platform behaviour. No third — because CDR accreditation stays with our accredited partner.
1. Bank-feed CDR data drives bank reconciliation, cash-flow forecasting, and budget-vs-actual. The agent automated-bank-reconciliation reads the bank feed via the accredited partner (Basiq) and matches transactions against your invoices, expenses, and payroll. cashflow-forecast projects forward cash position from the same feed. automated-budget-vs-actual-alerts compares actual spending to budget. Read-only, one direction.
2. Customer consent is verifiable end-to-end via the CDR Dashboard. Every consent the customer grants is visible at both the Data Holder (the bank's CDR Dashboard) and the Accredited Data Recipient (the partner's CDR Dashboard). When the customer withdraws consent at either Dashboard, the partner notifies us within 2 business days and the data flow stops. We do not retain the data beyond the consent scope. This is the honest accountability chain CDR was designed to enforce.
What XIntelliSync deliberately does NOT do. No direct ADR accreditation — XIntelliSync is not a Tier 1 / Tier 2 / Sponsored Representative / Affiliate ADR; we consume via partners. No outbound CDR data sharing — the read-only feed flows IN, not out. No CDR-Dashboard hosting — that responsibility sits with the bank and the accredited partner, not us. No bypass of customer consent — if you withdraw consent at the Dashboard, the data flow stops, period. No CDR data export to third parties beyond the partner ecosystem — the accountability chain stays clean.
Three real agents in scope. One accredited-partner relationship. Zero direct accreditation responsibility on us. The CDR Rules accountability chain stays clean: bank → accredited partner → XIntelliSync (read-only consumer).
See the agents that consume CDR dataWhere to engage with CDR
Authoritative ACCC + OAIC + cdr.gov.au sources.
cdr.gov.au — Consumer Data Right Australia
Official CDR portal. Consumer-facing dashboard + CDR sector rollout status + accredited-data-recipient register + CDR rules + Treasury sector designation instruments.
ACCC — Consumer Data Right
ACCC's regulatory + accreditation oversight role. CDR rules + accreditation guidelines + compliance enforcement + sector designation policy. Joint regulator with OAIC.
OAIC — Consumer Data Right Privacy
OAIC's privacy-regulation role within CDR. Consumer-facing privacy guidance + CDR-specific privacy obligations on top of APPs + breach reporting (NDB scheme overlap).
Treasury — Consumer Data Right Policy
Treasury's policy oversight + sector designation instruments + CDR rules amendments + Open Finance roadmap. Source for upcoming sector designations + policy reform.
CDR Provider Register
Official register of accredited data recipients (ADRs) + data holders + sponsored representatives + affiliates. Verify any party's accreditation status before granting CDR consent.
AustLII — Competition and Consumer Act 2010, Pt IVD (CDR)
Free public access to the legal source for CDR — Pt IVD of the Competition and Consumer Act 2010 (Cth). Use as the legal reference for accreditation + consent + sector designation.
All 22+ industries served
CDR role + use case + sector status per industry.
Construction
Consumer (via partner)Use case — Cash-flow visibility across project accounts via accredited finance brokers + accounting integrations.
Sector status — Banking sector live — most builders connect via accounting/finance partners using ADR-issued data.
Healthcare
Future sectorUse case — Health sector designation under consideration in 2025-2026 Treasury review. My Health Record adjacent.
Sector status — Not yet designated. Banking sector data flows still apply for practice-financial use cases.
Hospitality
Consumer (via partner)Use case — Multi-venue cash-flow consolidation + supplier-payment optimisation via accredited finance partners.
Sector status — Banking sector live — single-venue cafés rarely use; multi-venue groups use via finance partners.
Retail
Consumer (via partner)Use case — Settlement-account reconciliation + payment-provider data flows via banking sector + future merchant data.
Sector status — Banking sector live. Retail-specific designation not on roadmap. Marketplace open data parallel via Open Finance.
Professional Services / Consulting
Consumer (via partner)Use case — Practice cash-flow + invoice-financing decisions via accredited fintech partners.
Sector status — Banking sector live. Consulting firms typically consume banking data via accounting + invoice-finance partners.
Digital / Tech / SaaS
ADR / RecipientUse case — Many fintech SaaS apply for Accredited Data Recipient (ADR) status to consume CDR banking + energy data on behalf of customers.
Sector status — Active ADR ecosystem. Tier 1 + Tier 2 + Sponsored representative + Affiliate accreditation pathways available.
Finance / Mortgage Brokers
ADR / RecipientUse case — Mortgage brokers + non-bank lenders + BNPL providers use CDR banking data for serviceability assessment + credit decisions.
Sector status — Active ADR ecosystem. Banking sector live since July 2020. Non-bank lending sector designation effective from November 2024.
Legal
Consumer (via partner)Use case — Trust-account reconciliation + matter-cost forecasting via accredited accounting integrations.
Sector status — Banking sector live — trust-account flows visible via ADR partners.
Childcare / Early Learning
Consumer (via partner)Use case — CCS + family payment reconciliation + parent-payment visibility via accounting partners.
Sector status — Banking sector live. Centrelink + government payment data not in CDR scope (separate myGov ecosystem).
Education / RTOs
Consumer (via partner)Use case — Student-fee reconciliation + scholarship + grant payment tracking.
Sector status — Banking sector live. CRICOS / VET FEE-HELP / HECS-HELP data not in CDR scope.
Manufacturing
Consumer (via partner)Use case — Supplier-payment + customer-receivables cash-flow consolidation via accounting + ERP integrations using banking data.
Sector status — Banking sector live. Energy sector live since 2022 — useful for energy-intensive manufacturing.
Transport / Logistics
Consumer (via partner)Use case — Fuel-card + customer-payment reconciliation + driver-payment tracking via banking data.
Sector status — Banking sector live. Energy data useful for fleet operators with EV transition.
Mining / Resources
Consumer (via partner)Use case — Royalty-payment + government-receivable reconciliation. Energy data critical for energy-intensive sites.
Sector status — Banking sector live. Energy sector live since 2022 — critical for energy-intensive mining + processing.
Agriculture / Primary Production
Consumer (via partner)Use case — Farm-management-deposit (FMD) + grain/livestock-buyer payment + government-grant reconciliation.
Sector status — Banking sector live. Farm-debt-mediation cases benefit from comprehensive banking data flow.
Fitness / Health Clubs
Consumer (via partner)Use case — Member DD payment + franchise-royalty payment reconciliation via banking sector data.
Sector status — Banking sector live. Most clubs use indirectly via accounting + payment-provider integrations.
Not-for-Profit
Consumer (via partner)Use case — Donation reconciliation + grant-payment tracking + ACNC reporting via accounting partners using banking data.
Sector status — Banking sector live. ACNC + grant agency data not in CDR scope (separate ACNC + grant systems).
Events / Conferences
Consumer (via partner)Use case — Ticketing-platform + sponsor-payment + supplier-payment reconciliation via banking sector data.
Sector status — Banking sector live. Event-cancellation insurance + ticketing-platform data not in CDR scope.
Creative / Photography / Production
Consumer (via partner)Use case — Client-deposit + Screen Australia funding + royalty-payment tracking via banking sector data.
Sector status — Banking sector live. Most creative SMBs use indirectly via accounting partners.
Marketing / Advertising Agencies
Consumer (via partner)Use case — Client-retainer + media-buying account reconciliation via banking sector data.
Sector status — Banking sector live. Most agencies use indirectly via accounting partners.
HR / Recruitment
Consumer (via partner)Use case — Placement-fee + payroll-on-charge reconciliation + invoice-finance use via banking sector data.
Sector status — Banking sector live. Recruitment industry rarely directly accredited; consume via partners.
Insurance Brokers / Underwriters
ADR / RecipientUse case — Insurance brokers + underwriters increasingly use CDR for premium-finance + underwriting + risk assessment. Insurance sector designation under Treasury review 2025-2026.
Sector status — Banking sector live. Insurance sector designation under consideration. APRA-regulated entities have additional CPS 234 + APRA prudential overlay.
Real Estate / Property Management
Consumer (via partner)Use case — Trust-account + tenant-bond + commission reconciliation via banking sector data.
Sector status — Banking sector live. State-licensing trust-account audits remain separate from CDR.
FAQs
CDR + Open Banking — answered.
What is the Consumer Data Right?
CDR is an Australian economy-wide data-portability + consent regime introduced in 2019 via the Treasury Laws Amendment (Consumer Data Right) Act. Customers (consumers + businesses) can authorise an Accredited Data Recipient (ADR) to receive their data from a Data Holder (e.g. their bank) for a specified purpose (e.g. cash-flow forecasting). Joint regulators: ACCC (compliance + accreditation) + OAIC (privacy). Sectors live: banking (2020), energy (2022), non-bank lending (2024). Telecommunications + insurance + health under Treasury review.
Do I need to become accredited to use CDR data?
Yes if you receive customer data directly. Four pathways: (1) Tier 1 unrestricted ADR for full access; (2) Tier 2 restricted ADR for limited use cases; (3) Sponsored Representative model — a Tier 1 ADR sponsors your business + you operate under their accreditation; (4) Affiliate model for low-risk add-on use cases. Most SMBs use CDR INDIRECTLY via fintech / accounting partners that hold ADR status — no direct accreditation required.
What is the difference between Tier 1 and Tier 2 accreditation?
Tier 1 (unrestricted) provides full access to all CDR data + all use cases — typically taken by major fintechs, banks, accounting platforms, and lending platforms. Tier 2 (restricted) limits the scope of data + use cases — typically taken by businesses with narrower use cases. Tier 1 carries higher compliance burden (annual security audit, broader insurance, more comprehensive privacy + consent infrastructure). Tier 2 is a faster + cheaper accreditation path with operational restrictions.
How long does CDR consent last?
Maximum 12 months from grant. Customer can specify shorter durations (1 day to 12 months). At expiry, consent must be RENEWED via fresh consent flow — no rolling re-consent without explicit customer action. Customer can withdraw consent at any time via the CDR Dashboard at the data holder OR the ADR. Withdrawal honoured within 2 business days. Records of consent + withdrawal retained per Privacy Act + CDR rules.
How does CDR interact with Privacy Act + APP?
CDR is a privacy-protective regime that applies on top of the Privacy Act. CDR consumers benefit from CDR-specific protections (consent + dashboard + withdrawal) AS WELL AS Privacy Act protections (APPs + NDB scheme). Where they overlap, CDR rules typically prevail (more specific + more protective). ADRs handle CDR data under both regimes — APP entity obligations PLUS CDR-specific obligations. ACCC + OAIC enforce jointly.
What is the difference between Australia's CDR and UK Open Banking?
Scope: Australia's CDR is economy-wide (banking + energy + non-bank lending + expanding) under one accreditation framework. UK Open Banking is banking-only under PSD2 + the Open Banking Standards Body. Maturity: UK launched 2018 (more mature); Australia launched 2020 (sector-by-sector). Adoption: UK has higher consumer adoption in payments use cases (Open Banking Payments Initiation); Australia has stronger data-aggregation use cases (banking + energy together). PSD3 from 2026 will narrow the UK gap.
How does XIntelliSync use CDR data?
XIntelliSync integrates with the CDR ecosystem via accredited data partners — we do NOT hold ADR accreditation directly. Customers connect their bank + energy accounts via the partner consent flow + grant XIntelliSync read-only access to the relevant data. We use the data for cash-flow forecasting + reconciliation + budget vs actual + super-payment verification + tax-payment tracking. Consent is time-bound + withdrawable + visible in the CDR Dashboard at both the bank + the partner.
Continue reading