CDR is officially expanding to Non-Bank Lenders by mid-2026. Here's what you need to know about the latest CDR updates.
The Australian Government has announced the publication of the CDR rules for non-bank lenders, making key adjustments to improve efficiency and reduce costs. These changes follow a consultation process that concluded in December last year and are set to take effect from mid-2026. This move has major implications for businesses across the financial sector and beyond.
Key Changes in the CDR Expansion
1. Inclusion of Non-Bank Lending Products
Non-bank lenders will now be required to participate in the CDR framework, giving consumers access to their financial data across a broader range of services.
This means product data requests will go live on 13 July 2026, and consumer data requests will go live either on:
- 9th November 2026 for 'Initial providers' – non-bank lenders with more than $10 billion in resident loans and finance leases for the calendar month preceding the commencement date and on average over the 11 previous calendar months; or
- 10 May 2027 for 'Large providers' – non-bank lenders with more than $1 billion (but less than or equal to $10 billion) in resident loans and finance leases in the calendar month preceding the commencement date and on average over the 11 previous calendar months, and has over 1000 customers.
2. Buy Now, Pay Later (BNPL) Products Covered
With BNPL adoption growing rapidly, these providers will now fall under CDR obligations. This means consumers can securely share their BNPL data with accredited third parties, improving access to tailored financial services.
3. Reduced Data Retention Requirements
The mandatory data retention period will be reduced from seven years to two years, significantly cutting compliance costs for data holders while still supporting consumer rights.
4. Targeted Data Sharing
Certain niche financial products—such as asset finance, consumer leases, reverse mortgages, margin loans, and foreign currency accounts—will no longer be required to share consumer or product data under CDR, streamlining compliance for providers.
What This Means for Businesses
Increased Competition and Innovation
With non-bank lenders and BNPL providers included in the CDR, competition will increase as fintechs and traditional lenders gain better access to consumer data. This creates opportunities for more personalised financial products and services.
New Market Opportunities
Businesses that leverage CDR-enabled data-sharing can develop innovative solutions to improve lending decisions, streamline financial management tools, and offer enhanced customer experiences. Fintechs, credit providers, and data aggregators stand to benefit significantly.
Compliance and Regulatory Adjustments
For non-bank lenders, this means new compliance requirements. Businesses must prepare for technical implementation, security measures, and data governance frameworks to meet CDR standards. While this presents short-term challenges, it also offers long-term competitive advantages.
Cost Savings for Smaller Lenders
By reducing the data retention period and eliminating some reporting obligations, the changes reduce compliance burdens—particularly for smaller lenders who previously faced high regulatory costs.
Preparing for the Future
Businesses should start assessing their CDR-readiness now. This includes evaluating existing data infrastructure, ensuring compliance capabilities, and exploring partnerships with accredited data recipients (ADRs) to leverage open banking opportunities.
With the Government committed to making CDR a cornerstone of Australia’s digital economy, this expansion is a signal for businesses to embrace data-driven innovation and enhance financial services for consumers.
Stay ahead of the curve. If you’re a financial institution, fintech, or data-driven business, now is the time to align with CDR changes and unlock new opportunities.