After a pause of a couple of years while Treasury worked to ‘break down the barriers’ and ‘reboot the system’, the next stage of the Consumer Data Right (CDR) rollout is now underway and non-bank lenders are next to join the CDR.
Key takeaways
- As planned, the CDR has expanded to the non-bank lending sector, following its commencement in the banking (2020) and energy sectors (2022). At least 35 new data holders will enter the regime as a result.
- From 13 July 2026, designated non-bank lenders must meet product data sharing obligations. The commencement of consumer data sharing obligations will be staged from 9 November 2026 onwards, depending on the size of the provider.
- No timeline has been announced yet for the rollout of the CDR to the superannuation, insurance, and telecommunications.
Remind me – what is the CDR regime?
The CDR is a multi-sector regime established under Part IVD of the Competition and Consumer Act 2010 (Cth) (CCA). It enables consumers and small businesses to authorise the secure sharing of their data with accredited or permitted recipients for specified purposes, such as comparing products and services, accessing better-value products and services, or obtaining general financial management assistance. The CDR is jointly regulated by the ACCC and the Office of the Australian Information Commissioner (OAIC), which enforce stringent obligations on CDR participants.
The CDR rollout has been staged. It began with the major banks sharing data in 2020 and expanded into the energy sector in 2022. Now, designated non-bank lenders are required to make available to share product data (such as interest rates, fees, charges and eligibility criteria).
Which non-bank lenders are caught by these changes?
From 13 July 2026, designated non-bank lenders are part of the CDR, extending the regime beyond authorised deposit-taking institutions and into a broader segment of the lending market.
Non-bank lenders are defined under the designating legislation as any corporation that:
- is a registrable corporation under section 7 of the Financial Sector (Collection of Data) Act 2001 (Cth) (i.e., corporations that are not authorised deposit taking institutions), or
- would be a registrable corporation if paragraph 7(2)(i) of that Act did not apply (which excludes corporations whose lending is below a certain threshold).
Practically, this means that a corporation might be a ‘relevant non-bank lender’ despite not being a registrable corporation under that Act.
At a high level, non-bank lenders are financial institutions that provide credit or loans, but do not hold a full banking licence. For example, mortgage lenders, car finance and other asset finance providers, personal loan providers, personal credit or charge card account providers, and ‘Buy Now Pay Later’ providers.
What are the CDR obligations on non-bank lenders and when do they come into force?
CDR obligations for non-bank lenders will commence in phases.
From 13 July 2026, non-bank lenders must comply with product data sharing obligations. Product data includes information about the product itself i.e. identifying or describing the product, prices including fees, charges or interest rates, features or benefits, terms and conditions, and eligibility criteria.
Relevant products include any goods or services connected with taking money on deposit, making advances of money, letting goods on hire including hire-purchase, other prescribed banking-business financial activities, and purchased payment facilities.
Consumer data sharing obligations will begin for initial providers on 9 November 2026, and on 10 May 2027 for large providers. Consumer data includes information about a customer and their use of a product, including identifying or eligibility information and contact details, and account identifiers, balances, transaction information and authorisations connected with the account.
Initial providers are relevant non-bank lenders that on the 4 March 2025, had a combined total value of resident loans and resident finance leases reported to APRA (including associated non-bank lenders’ balances), of over $10 billion both for the most recent reported calendar month and an average of over $10 billion during the preceding 12 months.
Large providers are relevant non-bank lenders that are not initial providers, and if on 4 March 2025 or a 1 July after that day, had over 1,000 customers and a combined total value of resident loans and resident finance leases reported to APRA (including associated non-bank lenders’ balances), of over $1 billion both for the most recent reported month and the previous 12-month average. A non-initial-provider accredited person can also be a large provider.
These obligations for non-bank lenders are relatively similar to those that apply to authorised deposit-taking institutions.
What does this mean?
The ACCC called the expansion into the non-bank lending sector a ‘significant step’ with at least 35 new data holders to enter the CDR. This will give consumers access to more information about a wider range of financial products. Over 1.3 million Australians are already using the CDR (a 135% increase in the past year) and this expansion is expected to result in further uptake.
Given that non-bank lenders are an important part of the credit market, their involvement in the CDR framework will allow consumers to better understand some of their major household costs, including mortgages, power bills, car finance and personal loans, in addition to accessing better value and improved loan options. For clients in this sector, the CDR arrives with a host of compliance obligations as well as potential opportunities where non-bank lenders wish to become accredited as accredited data recipients.
