Open banking and the Consumer Data Right in business lending

“Connect your bank” has become one of the most common steps in an online business loan application. For some owners it feels like the obvious, quick option. For others it feels like handing over the keys. Both reactions make sense, and the truth sits in the detail: what’s being shared, under which system, with whom, and for how long.

This page explains Australia’s Consumer Data Right in the context of business lending, so you can make an informed choice — and recognise when something doesn’t look right.

What is the Consumer Data Right?

The Consumer Data Right, or CDR, is an Australian government framework that lets people choose to share data held about them with accredited providers. According to cdr.gov.au, it’s an opt-in system that currently operates in banking and energy, with non-bank lending designated as the next sector to follow. It applies to individuals and small businesses.

In banking, CDR is what most people mean by “open banking”. It lets your bank send your transaction and account data securely to an accredited recipient you choose — such as a lender or a data service working for a lender — after you’ve given explicit consent.

What can and can’t be done with CDR data?

CDR data sharing does	CDR data sharing doesn’t
Share read-only account and transaction data you choose	Give anyone the ability to make payments from your account
Send data only to accredited businesses	Allow your data to be shared without consent
Let you specify the purpose the data can be used for	Last forever — consent expires after 12 months
Give you a dashboard to manage and withdraw consent	Require you to give your banking password to the recipient

The OAIC explains that you choose who can access your data, which kinds of data move and the purpose they may be used for — and that you can end the sharing whenever you like. You can also ask for your data to be deleted once it’s no longer needed.

How does a CDR connection work in a loan application?

A typical flow looks like this:

1. The lender (or its data provider) explains what data it wants and why — for example, 12 months of transactions to assess your application.
2. You’re redirected to your bank’s own website or app to log in and authorise the sharing. The recipient doesn’t see your password.
3. You choose which accounts to share.
4. The data arrives with the lender, ready for analysis.
5. You can review or withdraw consent later from the recipient’s dashboard or your bank’s data-sharing settings.

Once the data arrives, it’s analysed in the same way as any bank statement — see how lenders read your bank statements.

Is every “connect your bank” option CDR?

No, and this matters. Some services collect bank data by asking you to enter your internet banking login into their own screen, then retrieving statements on your behalf. This is often called screen scraping. It’s still widely used in lending, but it works differently: you’re giving the login to a third party rather than authorising sharing through your bank.

Before you connect, look for:

• whether you’re redirected to your own bank to approve the sharing
• the name of the accredited recipient, which you can check on cdr.gov.au
• a clear explanation of what data is collected and for how long
• a way to withdraw consent later

If you’re unsure, ask the lender which method they use, or choose to upload PDF statements instead. We compare the options in open banking or PDF statements.

How do you stay safe when sharing bank data?

• Only start a data-sharing process from a link inside the application you started yourself, not from an unexpected email or text.
• Never give your banking password or a one-time code to anyone over the phone, by email or by SMS.
• Check the recipient’s name and accreditation if it’s a CDR connection.
• Share only the accounts the lender actually needs.
• Review active connections in your bank’s settings after the loan is decided, and withdraw any you no longer need.

Scammers increasingly imitate lenders and “verification” services. Our page on online loan scams covers the warning signs, and data security and privacy explains how legitimate lenders handle your information. If you’d like to talk through which sharing method suits you, start a quick enquiry and raise it on the call.

Why do lenders prefer a direct connection?

For lenders, data that arrives straight from the bank can’t have been edited, which removes a whole layer of fraud checks. It also arrives in a consistent format, so analysis is faster and more accurate. For you, that usually means fewer follow-up questions and a quicker answer. It’s one of the reasons online lenders can decide in hours rather than weeks for straightforward applications.

What should you do after the loan is decided?

Whatever the outcome, tidy up. Check your bank’s data-sharing settings for active connections and stop any you no longer need, unless the lender needs ongoing access for a facility such as a line of credit. Keep a note of what you shared, with whom and when. It takes five minutes and keeps your data footprint small.

Ready to apply with confidence?

Sharing bank data is easier when you know exactly what’s happening. Begin your online enquiry — it takes about a minute and doesn’t involve a credit check. Your details go to one specialist rather than a crowd of lenders, and that specialist will tell you which data the matched lender needs and how it’s collected before anything is shared. Accurate answers in the form help us get the right lender, and the right data request, on the first attempt.