A Sydney fintech founder — six-person team, $2.4 million seed closed in February, building a credit decisioning engine for BNPL and small-ticket personal loans — reads the 13 July 2026 ACCC media release announcing the go-live of product data sharing under the non-bank lending designation. She books a Friday standup with her CTO. “We’re getting the CDR API keys and pulling live product and transaction data from Nimble, Prospa, MoneyMe, Wisr and the majors — decisioning engine live end of Q3.” The CTO opens the Consumer Data Standards published by the Data Standards Body, confirms the endpoints are documented, and quotes a two-week integration. What neither of them has priced is that the CDR API is not something a fintech consumes on API-key credentials — it is a regulated data-sharing regime under Part IVD of the Competition and Consumer Act 2010 (Cth), and every request the decisioning engine makes has to originate with an accredited person or one of the narrow disclosure pathways carved out for advisers, sponsors and representatives. There is no build path that starts with an integration and ends with an accreditation; the accreditation is the pre-condition to the integration.
That gap between what a fintech founder thinks the Consumer Data Right is and what the Rules actually require sits behind most of the failed roadmaps we see. The regime is now six years old on banking, four on energy, one week old on non-bank lending, and reset once in the middle. Here is what it looks like in 2026.
The Framework — Four Regulators, One Regime
The CDR sits in Part IVD of the Competition and Consumer Act 2010 (Cth), with subordinate rules in the Competition and Consumer (Consumer Data Right) Rules 2020 and Consumer Data Standards published by the Data Standards Body chair (Dr Ian Oppermann, appointed 1 March 2025). Four regulators divide the work:
- The ACCC makes the CDR Rules, maintains the CDR Register, accredits data recipients and enforces the Rules against both data holders and accredited data recipients (ADRs).
- The OAIC administers the thirteen CDR Privacy Safeguards in Division 5 of Part IVD — a parallel privacy code that overlays (and in places displaces) the APPs for CDR data.
- The Treasury sets policy, drafts amending rules and designates sectors under section 56AC.
- The Data Standards Body publishes the Consumer Data Standards — the technical API specifications, the InfoSec profile built on FAPI 1.0, the CX standards for consent flows.
Three sectors are currently designated: banking (live since 2020), energy (live from November 2022), and non-bank lending under the Consumer Data Right (Non-Bank Lenders) Designation 2022 — product data sharing for initial providers commenced 13 July 2026, consumer data sharing for initial providers commences 9 November 2026, and large providers follow on 10 May 2027. Insurance, superannuation and telecommunications remain on the CDR Strategic Assessment Consultation Paper released 22 July 2025 but are not designated.
The Accreditation Pathways — Four Doors, Different Costs
Founders who want to receive CDR data have four operative pathways, each with different obligations:
- Unrestricted accreditation. The full ADR pathway — the entity applies to the ACCC, satisfies the fit and proper test in Rule 5.5, produces an InfoSec implementation aligned with the controls in Schedule 2 to the Rules and procures an independent assurance report under ASAE 3150. There is no ACCC application fee, but the assurance work, cyber insurance and control-remediation typically cost between $50,000 and $250,000 depending on starting posture, and time from clean application to grant runs at four to nine months. A founder building a decisioning engine that ingests CDR data at scale ends up here.
- Sponsored accreditation. An affiliate model — a smaller entity is sponsored by an unrestricted ADR and inherits a reduced information security standard because the sponsor holds the data. Useful for startups whose data touch is limited.
- CDR Representative model. A principal-agent structure introduced in the February 2022 amending rules. The startup contracts with a CDR Representative Principal (an unrestricted ADR); the Principal collects the data and discloses it to the Representative under a CDR Representative Arrangement. Lowest barrier to entry, fastest to launch, but the Representative is exposed to the Principal’s continued good standing and every consumer-facing CX obligation still flows through.
- Trusted Adviser disclosure. A narrower disclosure pathway allowing accountants, lawyers, financial advisers, mortgage brokers and tax agents in defined professions to receive CDR data from a consumer under an insights or data disclosure consent. Not itself an accreditation — the adviser sits outside the accreditation perimeter but inside the consent perimeter.
The choice of pathway is not architectural preference — it is the risk allocation between speed to market and control of the data. A CDR Representative arrangement can be operational in weeks; unrestricted accreditation cannot.
The Thirteen Privacy Safeguards
The privacy overlay in Division 5 of Part IVD is not the Australian Privacy Principles by another name. It is a parallel code — thirteen safeguards, ordered by data lifecycle, that apply to CDR data end-to-end. Safeguard 3 limits collection to what a consumer has consented to. Safeguards 5 and 6 ration use and disclosure to the purposes in the consent. Safeguard 11 requires quality; Safeguard 12 requires security. Safeguard 12 in particular has been the enforcement focus — encryption in transit and at rest, access control, logging and monitoring at parity with the InfoSec profile in Schedule 2 to the Rules. The overlay matters because the maximum civil penalties in section 56EO track the 2022 Privacy Act uplift — the greater of $50 million, three times the benefit, or 30% of adjusted turnover.
Enforcement Is No Longer Theoretical
The ACCC’s first meaningful enforcement wave arrived in 2025. On 19 June 2025 National Australia Bank paid $751,200 across four infringement notices for alleged failures to accurately disclose credit-limit data in response to CDR requests. On 9 December 2025 Commonwealth Bank paid $792,000 across four notices for failing to enable data sharing for non-individual accounts set up with a Trading Entity Business Name. The OAIC issued its first CDR determination on 14 May 2025 — Commissioner Initiated Investigation into Regional Australia Bank Limited (Privacy) [2025] AICmr 89 — finding the bank breached CDR privacy safeguards over a February 2023 incident in which a fault in third-party provider Biza’s software mixed the data of 197 customers, and confirming under section 84(2) of the CCA that outsourcing the technology does not outsource the accountability. That last point is the one to underline for a fintech CDR Representative: the data flows through your Principal’s software, but your regulatory liability does not.
Action Initiation Remains Dormant
The Treasury Laws Amendment (Consumer Data Right) Act 2024 (Cth) received Royal Assent on 26 August 2024 and enabled a write-access CDR — accredited persons initiating payments, switches and account actions on a consumer’s behalf. Six days earlier, then-Assistant Treasurer Stephen Jones had described the CDR as “a good idea, badly executed” and announced the reset — no action types would be declared until the ecosystem was on sustainable footing. Assistant Treasurer Daniel Mulino, sworn in on 13 May 2025, has continued the pause. As at July 2026 no action initiation designation instrument is in force and none is on the near-term legislative program. Founders building product on the assumption that CDR write-access is a 2026 or 2027 capability should plan for read-only and a longer runway.
What Founders Should Do Now
The compliance discipline is discrete. First, choose the pathway before the architecture — Representative for speed, Sponsored for a middle ground, Unrestricted only where the data touch justifies six-to-nine-months of accreditation runway. Second, map the data flows against the thirteen Privacy Safeguards, not the APPs — the CDR overlay operates independently and the compliance surface is not the same. Third, read the CBA and NAB infringement notices as guidance — the ACCC has telegraphed that data quality and coverage of business account types are live enforcement priorities. Fourth, contract the outsourcing risk down the stack — the RAB determination is the template for what happens when third-party technology fails; DPAs, indemnities and audit rights against Biza-equivalent providers are non-optional. Fifth, do not build for action initiation — the framework is on the statute book but not in force, and government posture in 2026 is continuity with the Jones-era pause.
The Bottom Line
The Consumer Data Right is not an API. It is a regulated data-sharing regime under Part IVD of the Competition and Consumer Act 2010, four regulators deep, four accreditation pathways wide, and — since 13 July 2026 — live across banking, energy and the first tier of non-bank lending. The 2025 enforcement wave against NAB and CBA and the first OAIC determination against Regional Australia Bank have moved the regime from a compliance exercise to an enforcement one. Founders who pick the right accreditation pathway before writing a line of integration code, treat the thirteen Privacy Safeguards as the operative privacy overlay and price the outsourcing liability into every vendor contract launch on time. Founders who read the API docs first end their quarter on a Friday call with the ACCC.
Viridian Lawyers advises Australian fintech startups on CDR accreditation applications, CDR Representative arrangements, Privacy Safeguard compliance, data-holder obligations under the non-bank lending designation and ACCC and OAIC enforcement responses. If your startup is applying for accreditation, structuring a Representative Principal relationship or responding to a regulator inquiry, get in touch.
