Consumer Data Right
BNPL Under CDR: What Buy Now Pay Later Providers Need to Know
How CDR obligations apply to BNPL providers in Australia. Covers covered products, compliance timeline, data sharing requirements, and preparation for July 2026.
Buy Now Pay Later (BNPL) is now explicitly within the scope of Australia's Consumer Data Right. The CDR Rules amendments published in March 2025 include BNPL products as covered products in both the banking and non-bank lending sectors. For BNPL providers, this creates new data sharing obligations with specific compliance deadlines starting in July 2026.
Why BNPL Is Now Part of CDR
BNPL has grown from a niche payment option to a significant part of Australia's consumer credit landscape. Millions of Australians use BNPL services for everyday purchases. Until now, this data sat outside the open banking ecosystem — consumers couldn't share their BNPL account information with other financial services through CDR.
The inclusion of BNPL products means consumers will be able to share and link their BNPL data across financial service providers. This enables better visibility of consumer debt obligations for lenders, more accurate affordability assessments, and new product comparison capabilities.
What Counts as a BNPL Product Under CDR
The CDR Rules define BNPL as a covered product in both the banking sector (for banks offering BNPL) and the non-bank lending (NBL) sector. A consumer is in-scope with respect to a BNPL provider if they have:
- An open account that relates to a BNPL product
- That account is set up for online access
This mirrors the existing rule for banking products — only accounts with digital access are within scope.
Compliance Timeline for BNPL Providers
BNPL providers fall under the non-bank lending expansion timeline. The specific dates depend on whether a provider is classified as an initial or large provider:
Provider Thresholds
- Initial providers: Over $10 billion in resident loans and finance leases (12-month average)
- Large providers: $1 billion or more with at least 1,000 customers
Most standalone BNPL providers will fall into the large provider category. The largest providers (those exceeding $10 billion) face earlier deadlines as initial providers.
Key Dates
| Obligation | Initial Providers | Large Providers |
|---|---|---|
| Product data sharing | 13 July 2026 | 13 July 2026 |
| Consumer data sharing (standard) | 9 November 2026 | 10 May 2027 |
| Complex consumer data requests | 15 March 2027 | 13 September 2027 |
Banks that offer BNPL products alongside their existing banking products will need to include BNPL in their existing CDR data sharing obligations from 13 July 2026.
What Data Must Be Shared
Product Data (From July 2026)
Product reference data describes the BNPL products available — fees, terms, limits, eligibility criteria, and features. This data doesn't contain consumer-specific information and must be made available in a machine-readable format via CDR APIs.
Consumer Data (From November 2026 / May 2027)
Consumer data includes account-level information that a consumer authorises for sharing:
- Account balances and limits
- Transaction history (up to 2 years)
- Payment schedules and instalment details
- Account status and terms
The data retention requirement has been reduced from seven years to two years, which is particularly relevant for BNPL where account lifecycles tend to be shorter than traditional credit products.
Infrastructure Requirements
To comply with CDR data sharing obligations, BNPL providers need:
Technical Infrastructure
- CDR-compliant APIs conforming to the Consumer Data Standards
- Consent management — systems for collecting, managing, and revoking consumer consent
- Consumer dashboard — a portal where consumers can view and manage their active CDR consents
- Security standards — FAPI 2.0 compliant authentication and authorization
- Data quality assurance — accurate, timely product and consumer data
Governance and Compliance
- CDR policy approved by the Information Commissioner (separate from privacy policy)
- Dispute resolution procedures for CDR-related complaints
- ACCC registration as a data holder
- Ongoing reporting obligations to regulators
What This Means for BNPL Business Models
CDR inclusion has several implications for BNPL providers:
Increased transparency. Lenders and other financial service providers will have visibility of consumers' BNPL obligations, which increases the transparency of consumer debt obligations across all lending products.
Better affordability assessments. With BNPL data available through CDR, responsible lending assessments can include a more complete picture of consumer debt obligations.
Competitive comparison. Product reference data sharing enables direct comparison of BNPL terms, fees, and features — making it easier for consumers to switch providers.
Compliance investment. Building CDR infrastructure is a significant investment. Providers should assess whether to build in-house or partner with a managed CDR platform to reduce cost and accelerate compliance.
Preparing for Compliance
With the first deadline (product data) in July 2026, BNPL providers should be taking steps now:
- Classify your provider status. Determine if you're an initial or large provider based on your loan book size and customer numbers.
- Audit your product data. Ensure product reference data is accurate, structured, and ready for machine-readable distribution.
- Evaluate infrastructure options. Decide whether to build CDR data holder infrastructure in-house or outsource to a managed platform.
- Plan consent management. Design consumer consent flows and dashboard interfaces that meet CDR standards.
- Engage with regulators. Register with the ACCC and begin the CDR policy approval process with the Information Commissioner.
- Map your consumer data. Identify all account-level data that will need to be shared from November 2026 (initial) or May 2027 (large).
The Broader Context
BNPL's inclusion in CDR is part of a broader regulatory tightening around the sector. Alongside CDR obligations, BNPL is also subject to new credit regulation under the National Consumer Credit Protection Act amendments. These parallel requirements mean BNPL providers face a significant compliance workload through 2026 and 2027.
For the broader open banking ecosystem, BNPL data filling a gap in the consumer financial picture is a net positive. It enables more accurate lending decisions, better financial advice, and more complete personal finance management tools.
Fiskil helps businesses meet CDR data holder and data recipient obligations with managed open banking infrastructure. Learn about our Data Provider platform.
