CDR for Non-Bank Lenders: Open Finance and AI Compliance

The Consumer Data Right (CDR) now applies to non-bank lenders. In-scope lenders must publish standardised product data and, in stages through 2026 and 2027, share consumer data with accredited recipients on the consumer's consent. For a non-bank lender, CDR is mainly a data and workflow problem, which is why structured automation suits much of the ongoing work.

What does open finance mean for non-bank lenders?

For six years CDR was mostly a banking story. The major banks built the infrastructure, a handful of fintechs consumed the data, and the rest of the lending market watched. The CDR rules for the non-bank lending sector change that, extending obligations to lenders outside the authorised deposit-taking institution (ADI) system.

Under the rules as made, product data sharing obligations for in-scope non-bank lenders commenced on 13 July 2026. Consumer data sharing follows for initial in-scope providers from 9 November 2026 and for large providers from 10 May 2027. Check current ACCC guidance for any changes to these dates.

A lender that operated outside CDR now needs data-sharing infrastructure, consent handling and compliance processes once reserved for the major banks, without a major bank's compliance team.

Which CDR role applies to your business?

CDR imposes very different obligations depending on which side of the data you sit:

• Data holder: holds consumer data and must share it on valid request.
• Accredited data recipient (ADR): receives consumer data to provide a service. Accreditation by the ACCC covers data handling, privacy and information security.
• Trusted adviser: certain professionals, including mortgage brokers and accountants, can receive CDR data a consumer chooses to share with them without full accreditation.

What does your business do with financial data?

• You are a non-bank lender holding consumer loan dataData holder: product and consumer data-sharing duties apply
• You are a fintech or comparison service consuming dataLikely need accredited data recipient status
• You are a mortgage broker advising individual clientsConsider the trusted adviser pathway
• You only use your own internal dataNo direct CDR obligation, but watch competitive impact

The role decides the work. A data holder faces an engineering and compliance build. A recipient faces accreditation and governance. A broker on the trusted adviser pathway has lighter but real handling obligations. A business that is none of these still faces a strategic question, because open finance changes what customers expect and what competitors can offer.

What does the CDR data holder obligation involve for non-bank lenders?

It arrives in two waves.

Wave 1: product reference data. In-scope lenders publish standardised information about their products, including advertised rates, fees and charges, and key eligibility settings, in a consistent machine-readable format. The hard part is standardisation. Product data scattered across marketing pages, PDFs and spreadsheets must map to a common schema and stay accurate as products change.

Wave 2: consumer data sharing. Under the rules, initial in-scope providers (non-bank lenders the ACCC named, with more than $10 billion in loans and leases) share consumer data on consent from 9 November 2026. Large providers, with at least 1,000 customers and more than $1 billion in loans and leases, follow from 10 May 2027. That requires consent capture, identity and authorisation flows, secure data-sharing endpoints and reliable handling of consent withdrawal.

1. 1MapProduct and consumer data to the CDR schema
2. 2PublishStandardised product reference data
3. 3ConsentCapture and verify consumer authorisation
4. 4ShareSecurely to the accredited recipient

Around the whole regime sit the 13 Privacy Safeguards in Part IVD, enforced by the OAIC. They govern how CDR data is collected, used, disclosed, corrected and destroyed or de-identified when no longer needed. The non-bank lending rules also shorten the historical data window a holder must share, which reduces storage and response cost. The core obligation stays: know what data you hold, share the right slice on consent, and prove you did it correctly.

Why does CDR compliance break manual processes?

The instinct at a busy lender is to give new compliance to one capable person with a few scripts. That struggles here for a structural reason. CDR continues after go-live:

• Every product change ripples into published data.
• Every consent has a lifecycle that must be tracked and acted on when withdrawn.
• Data requests must be met within required timeframes.
• The audit trail must survive regulatory scrutiny.

	Manual and ad hoc	Structured and automated	Impact
Product reference data	Retyped from marketing PDFs	Mapped once, synced from source of truth	Accurate
Consent lifecycle	Tracked in spreadsheets	Captured, monitored and expired automatically	Reliable
Data request response	Handled case by case	Serviced through a governed workflow	Timely
Privacy Safeguard evidence	Reconstructed after the fact	Logged continuously	Provable
Data deletion duties	Easily forgotten	Scheduled and enforced	Compliant

A lender that shares the wrong data, or keeps data it no longer has a basis to hold, is exposed under both CDR and general privacy law. The same discipline is what operational risk standards expect across financial services, as covered in our guide to APRA CPS 230 and AI service providers.

Where does AI help non-bank lenders with CDR?

AI does not make a lender CDR-compliant on its own, and claims otherwise deserve suspicion. It absorbs the high-volume, structured work so accountable people spend time on judgement and governance. Four areas stand out.

1. Data mapping and quality. Expressing rates, fees and eligibility rules from several internal systems in the CDR schema is a translation problem. AI-assisted mapping and validation flags inconsistencies and detects when a published figure has drifted from its source.

2. Consent and authorisation workflow. A CDR consent is granted for a purpose, has a duration, can be amended and can be withdrawn. Automating capture, tracking and expiry, and confirming a withdrawal stops the data flow, removes a category of risk manual tracking cannot manage reliably.

3. Recipient-side assessment. Brokers, aggregators and fintechs receiving CDR data on consent get richer, structured financial information. AI can structure it and surface what matters for credit assessment and product matching. A person makes the credit decision, with clear records. See AI agent governance and human override and our guide to automated decisions under the Privacy Act.

4. Evidence and audit. Continuous logging of what data was shared, on which consent, with whom and when produces the audit trail as a by-product of the workflow.

• Manual: mapping and re-checking product dataOngoing, error-prone
• Manual: tracking consent lifecycles by handFragile at volume
• Automated: schema mapping and validationContinuous, consistent
• Automated: consent capture, monitoring and audit trailRuns in the background

For lenders evaluating a "model as a service" or vendor CDR solution, ask where the data is processed, who can access it, and whether a person approves anything that reaches a consumer or a system of record.

What is a realistic CDR timeline for a non-bank lender?

Because obligations arrive in waves, stage the work against the regulatory dates.

1. NowConfirm scope and roleEstablish whether you are a data holder, a recipient, or both, and which wave applies
2. Through 2026Product data and consent buildPublish standardised product reference data and build consent and sharing infrastructure
3. From 9 Nov 2026Consumer data sharing liveInitial in-scope providers begin sharing consumer data on consent
4. From 10 May 2027Large providers in scopeObligation reaches large providers; recipients scale their use of the data

Open finance runs both ways. A lender must share its data, and the same regime lets it, or the brokers who distribute its products, consume a consumer's fuller financial picture with consent. Lenders that treat incoming data as an asset, and automate its responsible use, can make better-evidenced decisions faster. Related reading: AI for mortgage brokers and financial services AI compliance under APRA and ASIC.

What should non-bank lenders do now about CDR?

1. Confirm your role (holder, recipient, or both) and which wave applies.
2. Inventory where product and consumer data actually lives.
3. Build consent handling and data sharing as governed capabilities with owners, monitoring and logs.
4. Align CDR controls with your wider Privacy Act compliance for AI. The same investment in structured data handling, consent management and audit logging serves both regimes.

How Solve8 can help

Our consultants and engineers help financial services organisations map their data, build consent and audit workflows, and connect CDR platforms to loan systems through our system integration work. Automation runs on your infrastructure in Australia, and a person approves before anything reaches a consumer or system of record. Talk to us about your CDR scope.

This article is general information, not legal or compliance advice. Confirm your CDR obligations against current ACCC and OAIC guidance and qualified advice.