Open banking or PDF statements: which should you use for a business loan?

At some point in almost every online business loan application, you’ll face a choice: connect your bank account, or upload statements. It looks like a technical detail. It’s actually a decision about speed, control and how much you trust the process — and there’s no single right answer for everyone.

This guide sets out how each option works, what you’re consenting to, and how to decide.

How does a bank-data connection work?

There are two broad types of connection, and it matters which one you’re using.

Consumer Data Right (CDR) connections. Under the CDR, you authorise your bank to share specific data with an accredited recipient. You’re redirected to your own bank to log in and approve, so the recipient never sees your password. According to the OAIC, you choose who can use your data, which kinds of data are shared and the purpose; your consent expires after 12 months; and you can stop sharing at any time through a dashboard, as well as ask for your data to be deleted. cdr.gov.au says the CDR currently operates in banking and energy and applies to individuals and small businesses.

Credential-based connections. Some services instead ask you to enter your internet banking login into their own screen, then retrieve your statements on your behalf. This is often called screen scraping. It’s still common in lending, but you’re giving your login details to a third party rather than authorising sharing through your bank.

Both deliver your transaction data to the lender. The difference is in how access is granted and what protections apply.

How do PDF statements work?

You log in to your own internet banking, download statements for the period requested — usually six or twelve months — and upload them through the lender’s secure portal. Nobody else touches your login. The lender’s software extracts transactions from the PDFs and analyses them in much the same way as connected data.

The trade-off is verification. Because PDFs can in theory be edited, lenders run integrity checks, and may ask for a fresh download or a connection if anything looks unusual. Original, complete PDFs straight from your bank pass those checks easily; screenshots, spreadsheets and combined files are harder.

How do the two options compare?

	CDR connection	Credential-based connection	PDF upload
Speed	Fast	Fast	Slightly slower
Verification	Direct from bank	Retrieved from bank	Integrity checks needed
Your password	Stays with your bank	Entered into a third party’s screen	Stays with you
Control over what’s shared	Choose accounts and data types	Varies by provider	Choose exact files and periods
Ongoing access	Up to 12 months, can withdraw	Varies — check terms	None after upload
Effort	A few clicks	A few clicks	Download, check, upload

When does connecting make most sense?

• Speed matters. You need a fast decision, and every extra check costs time. See what same-day funding really requires.
• You have several accounts. Selecting them in one flow is easier than downloading many PDFs.
• Your bank’s PDFs are awkward — split by month, missing balances, or hard to download for long periods.
• You want fewer follow-up questions. Verified data removes doubt about authenticity.
• The lender needs ongoing data, for example to review a line of credit limit.

When are PDFs the better choice?

• You want to review exactly what’s being shared before it leaves your hands.
• You’re not comfortable with ongoing access, even if it’s limited and revocable.
• The connection offered is credential-based and you’d rather not enter your banking login anywhere except your bank.
• Your bank isn’t supported by the lender’s data provider.
• You’re sharing with a specialist first to get advice before choosing a lender.

How do you tell which type of connection you’re being offered?

Look for these signs of a CDR connection:

• you’re redirected to your own bank’s website or app to log in and approve
• the screen names the accredited recipient, which you can check on cdr.gov.au
• you choose specific accounts and see what data will be shared and for how long
• you’re told how to withdraw consent

If instead you’re asked to type your banking username and password into a form that isn’t your bank’s, it’s a credential-based connection. That isn’t necessarily unsafe — many legitimate lenders use it — but you should know that’s what you’re doing and read the provider’s terms. If in doubt, ask the lender, or choose PDFs. Our explainer on open banking and CDR goes into more detail.

What security habits apply either way?

1. Start from your own application. Only connect or upload through links inside an application you initiated, never from an unexpected email or SMS.
2. Never share passwords or one-time codes with a person. No legitimate lender or specialist needs them.
3. Use a secure network. Avoid public Wi-Fi for banking and uploads.
4. Share only what’s needed — the requested accounts and periods.
5. Tidy up afterwards. Withdraw connections you no longer need and delete downloaded PDFs from shared folders.

Scamwatch, run by the National Anti-Scam Centre within the ACCC, collects reports of scams that impersonate lenders and verification services. If something feels off, stop and verify independently. See online loan scams for warning signs.

Does the choice affect your chances of approval?

Not directly. Lenders assess the same transactions either way. Indirectly, a connection can help by removing questions about authenticity and speeding up the process — and slow, stop-start applications are more likely to stall. On the other hand, a clean set of complete, original PDFs is perfectly acceptable to most lenders. What matters far more than the method is what the statements show. Our guide to getting statements lender-ready covers that.

What happens to your data after the decision?

With a CDR connection, the recipient must offer a dashboard where you can manage your consent and request deletion, according to the OAIC. Consent also lapses after 12 months. With a credential-based connection, check the provider’s terms for how long data is kept and how to revoke access — and consider changing your banking password afterwards if you entered it anywhere other than your bank. With PDFs, the lender holds the files you uploaded under its privacy obligations; see data security and privacy.

Can you change your mind halfway through?

Yes. If you start a connection and feel uncomfortable, stop and tell the lender or your specialist you’d prefer to upload PDFs. Most will accommodate it. Likewise, if you’ve uploaded PDFs and the lender asks for a connection to speed things up, you can ask why it’s needed and decide then. You’re in control of how your data is shared at every step.

A simple way to decide

Ask yourself three questions:

1. Is speed critical? If yes, lean towards a CDR connection.
2. Am I comfortable with the connection type offered? If it’s credential-based and you’re not, use PDFs.
3. Do I want to review the data first? If yes, download PDFs, check them, then upload.

Either way, the right lender will work with your choice.

What do we do at eBusiness Loans?

We never ask for your banking password, and your first enquiry doesn’t require any bank data at all. Once a specialist has talked to you and a lender has been chosen, we’ll tell you which methods that lender accepts so you can pick the one you’re comfortable with.

Ready to share on your terms?

Whichever method you prefer, the application should work around you. Start your online enquiry in about 60 seconds — there’s no credit check to enquire, your details go to one specialist instead of a crowd of lenders, and a real person will explain exactly how the matched lender collects bank data before anything is shared. Accurate answers in the form help us choose a lender whose process suits you, first time.