Open banking in Australia: what is it and how does it work?

Open banking is available in Australia, giving customers who wish to participate the ability to share their data with accredited financial institutions. So, what exactly is open banking and what does it mean for you?

With open banking, customers can give permission for various different aspects of their financial data to be shared with accredited third parties, such as banks and fintech organisations.

Australian Banking Association (ABA) CEO Anna Bligh said open banking would allow consumers to “search for a better deal on banking products”.

“This sharing of data is a watershed moment for competition in the banking industry and, in time, will enable every Australian to use their data for their own benefit,” she said.

Let’s take a look at how open banking works and what some of the benefits and challenges may be around this scheme.

What is open banking?

Open banking is an opt-in system that allows your financial data to be stored by and shared with accredited providers, with your permission. According to the ABA, the types of data that can be shared include:

• personal information such as phone numbers, email and physical addresses
• account balances
• information about your financial products, including rates, fees and features
• banking and credit card transaction details, including amounts deposited and spent

Open banking is regulated by the Australian Competition and Consumer Commission (ACCC), and any third parties who receive your banking data must be ACCC-accredited. The third parties involved may be other banks, financial institutions or other authorised organisations such as fintech businesses.

Open banking is not a free-for-all, and institutions can only access your data with your permission. That means that once you opt in, you are in control of which third party can access your data and how they can use that data under the open banking framework.

How can open banking be used?

As a consumer, open banking can streamline the process of dealing with banks and financial institutions. When you opt in and agree to share your data, accredited banks and financial institutions can store data relating to various transactions you’ve made, and with your permission, this data can then be shared with other accredited banks and financial institutions.

To understand how open banking can be used, consider the following example: you have decided to switch providers in order to open a new credit card account. Typically, you would need to gather copies of documentation such as your transaction history and ID, and then apply online or over the phone. With open banking, you can request to have your current bank or lender send this information to your new one at the click of a button, potentially speeding up the process and saving you time.

What types of data can I request to share through open banking?

Open banking allows customers to share data relating to such things as:

• credit or debit cards
• term deposits
• transaction and savings accounts
• home loans (mortgages)
• personal loans
• business loans.

How do you use open banking?

You can start using open banking through the website or app of an ‘accredited data recipient’ – this is a provider, such as a bank, that has been authorised by the ACCC to receive consumer data relevant to open banking. (You can find a list of accredited providers here). You can then follow prompts to share your data with a recipient.

The Consumer Data Right (CDR) website outlines this process:

1. Give consent: On the accredited data recipient’s website or app, you will be asked to give permission for them to access your data held by your financial institution.
2. Perform an identity check: You will then be redirected through to your financial institution’s CDR page to verify your identity. This will be via a One Time Password.
3. Confirm data to be shared: Your financial institution will then ask you to confirm what data you want to share, how you would like it to be shared and for what period.
4. Share data: Your data will then be electronically transferred  to the data recipient.
5. Use the provider’s service: Once your data is shared, you will then be directed back through to the accredited data recipient’s app or website to begin using their service. For example, if you’ve decided to share your data with an accredited budgeting website, you’ll now be ready to receive information and alerts based on your real data.

Where can my data be sent and received with open banking?

With open banking, your banking data can be sent and received by accredited businesses such as banks, financial institutions and organisations. Most banks, or authorised deposit-taking institutions (ADIs), are automatically included under open banking to receive and hold data.

Non-ADI organisations, such as fintech companies who wish to receive data through open banking, will need to become accredited data recipients. They can apply for accreditation via the ACCC and will need to comply with strict requirements.

Initially, the federal government mandated that the big four banks (ANZ, Commonwealth Bank, NAB and Westpac) were to allow their customers to opt in to open banking from July 2020. Since then, banks outside of the big four were also required to be ready to participate.

Now many others have signed on, either as holders or recipients of data (or both), and many more are currently going through the accreditation process.

What value can open banking deliver to consumers?

According to the ABA and Australian Government, key benefits of open banking may include:

How is open banking connected to the Consumer Data Right?

The Consumer Data Right (CDR) aims to give consumers the right to share their data between providers through secure technology.

According to the Australian Government, the CDR is designed to make it easier for consumers to compare products and services and access new and improved services.

Consumers’ data is transferred directly between approved providers, following the Government’s framework. You can access a full list of accredited providers via the Consumer Data Right website.

Is open banking secure?

All open banking participants must be accredited by both the ACCC and the Australian Information Commissioner (OAIC), meaning that they are subject to strict accreditation criteria as well as privacy and information security standards.

Mr Mickenbecker said although some consumers may be nervous about the security of open banking, they can take reassurance in the safeguards in place.

“Data recipients have to jump through many hurdles to be approved, and need to satisfy all sorts of requirements with their systems and security,” he said.

Mr Docherty said in order for Frollo to gain accreditation as a data recipient, they had to answer a range of security and data privacy objectives, as part of a “very stringent” accreditation process through the ACCC.

He also pointed out the CDR was aiming to empower consumers, with consent, vital.

“Customers will need to confirm their consent preferences from the very beginning, and after 12 months data recipients will need to delete any data they have unless a customer gives permission for that recipient to continue using it,” Mr Docherty said.

Consumers will also never be asked for their current online banking password when accessing the CDR to share content.

Data protections and standards development for open banking is led by CSIRO’s Data61, while the Office of the Australian Information Commissioner (OAIC) oversees privacy protections for the scheme. For more information on the privacy safeguards for CDR, you can visit the OAIC website.

What are your rights under open banking?

Data holders and accredited data recipients must follow strict regulations under the CDR to protect your data and privacy under open banking.

According to the Australian Government, providers must make it clear on their website or app:

• what information you’re sharing and how it will be used
• who will have access to your data
• how long they’ll have access to your data for
• how you can manage and withdraw consents.

Under the CDR rules, you can withdraw your consent to share data at any time either through the data recipient or data holder. If you do withdraw your consent, the data recipient must stop using your data and delete or de-identify any previously collected data.

If you think your data has been mishandled or you think your privacy has been breached when using open banking, you can make a formal complaint to the data recipient or data holder. If they do not respond or you are not satisfied with their response, the Australian Government said you should:

• Lodge your complaint to the Office of the Australian Information Commissioner
• Contact the Australian Financial Complaints Authority

What should I consider before using open banking?

If you are looking to use open banking to share your data, Mr Mickenbecker said there are a few considerations before jumping in.

“As long as you are comfortable with the security of your existing bank and the data recipient, and can say that they have been scrutinised by the relevant authorities, then it should be okay for you to use,” he said.

“What you do need to ask yourself is whether you are comfortable with particular recipients receiving your data – that is the key.”

Mr Mickenbecker said consumers should carefully consider why they want to share their data and for what purpose, and then try to use it to their advantage.

Original story by Elise Donaldson, with additional reporting by Alasdair Duncan and Ann Lund.

Cover image source: MK photograp55/Shutterstock.com.