What is Open Banking in Australia?

It’s the banking part of the Consumer Data Right: a law that lets you tell your bank to share your data with an app you choose, with your consent.

The Consumer Data Right started with banking and has been extended to other parts of the economy, such as energy. Only businesses accredited by the ACCC, or working under one as a CDR representative, can receive your data.[1]

Open Banking at a glance

Who runs it
The ACCC, with privacy overseen by the OAIC
What's shared
Account details, balances and transactions, for the accounts you choose
How long consent lasts
Up to 12 months
Can an app move money?
Not through Open Banking data sharing
What it costs you
Nothing

The ACCC accredits the businesses that receive data, and the OAIC oversees privacy.[2] Consent can last at most 12 months.[3]

How is it different from giving an app your bank password?

With Open Banking you never hand over your password. You approve on your bank’s own screen, and the app only gets the data you chose.

The older approach, screen scraping, works by giving an app your internet banking login so it can sign in as you and read what it finds.

Open Banking Screen scraping
Your banking password Never shared Given to the app
How you approve On your bank’s own screen By typing your login into the app
What the app can see Only the accounts and data you chose Everything your login can see
How you stop In the app or your bank, any time Change your banking password
Covered by the Consumer Data Right Yes No
A quick test

If an app asks for your internet banking password, it isn’t using Open Banking.

What data is shared?

Account details, balances and transactions, only for the accounts you choose.

  • Account name, type and number, often partly hidden
  • Balances
  • Transactions: dates, amounts and descriptions
  • Direct debits and scheduled payments, if the app asks for them

Your banking password is never shared, and data sharing doesn’t let an app make payments.

You choose an app, your bank asks you to confirm, and data only starts flowing after you approve.

1You choose an appand ask it to connect your bank.
2You're sent to your bankits own website or app, not the app's.
3You choose and approvewhich accounts to share.
4Data flowsfor the accounts you chose, to the app you chose.
5You can stopany time, in the app or at your bank.
How consent works under Open Banking.

Consent lasts up to 12 months. You can stop sharing any time, in the app or in your bank’s own app or internet banking.

Banks list the data sharing you’ve approved in a dashboard, usually under settings or security. Stopping there works the same as stopping in the app.[3]

How do I check an app is legitimate?

Check three things before you connect.

  1. 1Look for the name on the consent screen.The consent screen should name an accredited data recipient, or a CDR representative and the accredited business it works under.
  2. 2Look it up on the public register.Search for that business on the government's Consumer Data Right register.
  3. 3Consent on your bank's own screen.You should approve on your bank's website or app, never by giving the app your password.

The register lists every accredited business and CDR representative.[4]