CDR is officially expanding to Non-Bank Lenders by mid-2026. Here's what you need to know about the latest CDR updates.

Key Changes in the CDR Expansion

1. Inclusion of Non-Bank Lending Products

Non-bank lenders will now be required to participate in the CDR framework, giving consumers access to their financial data across a broader range of services.

This means product data requests will go live on 13 July 2026, and consumer data requests will go live either on:

• 9th November 2026 for 'Initial providers' – non-bank lenders with more than $10 billion in resident loans and finance leases for the calendar month preceding the commencement date and on average over the 11 previous calendar months; or
• 10 May 2027 for 'Large providers' – non-bank lenders with more than $1 billion (but less than or equal to $10 billion) in resident loans and finance leases in the calendar month preceding the commencement date and on average over the 11 previous calendar months, and has over 1000 customers.

2. Buy Now, Pay Later (BNPL) Products Covered

With BNPL adoption growing rapidly, these providers will now fall under CDR obligations. This means consumers can securely share their BNPL data with accredited third parties, improving access to tailored financial services.

3. Reduced Data Retention Requirements

The mandatory data retention period will be reduced from seven years to two years, significantly cutting compliance costs for data holders while still supporting consumer rights.

4. Targeted Data Sharing

Certain niche financial products—such as asset finance, consumer leases, reverse mortgages, margin loans, and foreign currency accounts—will no longer be required to share consumer or product data under CDR, streamlining compliance for providers.

What This Means for Businesses

Increased Competition and Innovation

With non-bank lenders and BNPL providers included in the CDR, competition will increase as fintechs and traditional lenders gain better access to consumer data. This creates opportunities for more personalised financial products and services.

New Market Opportunities

Businesses that leverage CDR-enabled data-sharing can develop innovative solutions to improve lending decisions, streamline financial management tools, and offer enhanced customer experiences. Fintechs, credit providers, and data aggregators stand to benefit significantly.

Compliance and Regulatory Adjustments

For non-bank lenders, this means new compliance requirements. Businesses must prepare for technical implementation, security measures, and data governance frameworks to meet CDR standards. While this presents short-term challenges, it also offers long-term competitive advantages.

Cost Savings for Smaller Lenders

By reducing the data retention period and eliminating some reporting obligations, the changes reduce compliance burdens—particularly for smaller lenders who previously faced high regulatory costs.

Preparing for the Future

Businesses should start assessing their CDR-readiness now. This includes evaluating existing data infrastructure, ensuring compliance capabilities, and exploring partnerships with accredited data recipients (ADRs) to leverage open banking opportunities.

With the Government committed to making CDR a cornerstone of Australia’s digital economy, this expansion is a signal for businesses to embrace data-driven innovation and enhance financial services for consumers.

---

Stay ahead of the curve. If you’re a financial institution, fintech, or data-driven business, now is the time to align with CDR changes and unlock new opportunities.