Compliance, Complexity, and Competition: The Operational Realities of CDR Expansion for Non-Bank Lenders

The Technical Build Behind the Mandate

When the Australian Government announced the expansion of the Consumer Data Right (CDR) to non-bank lenders, it signalled more than a policy shift — it triggered one of the most significant technology and compliance undertakings the sector has faced. Non-bank lenders, many of which operate with leaner technology teams than the major banks, have had to build or integrate CDR-compliant data sharing infrastructure within a compressed timeframe.

Product data sharing obligations commenced on 13 July 2026, requiring designated non-bank lenders to make product information — including interest rates, fees, charges, and eligibility criteria — available through standardised CDR channels. Consumer data sharing obligations follow from 9 November 2026 for initial providers, with large providers required to comply from 10 May 2027.

Regulatory Relief for Smaller Lenders

Recognising the disproportionate burden on smaller institutions, the Government built several cost-reduction measures into the expansion. The data retention period for shared consumer data has been reduced from seven years to two years, significantly cutting the storage and retrieval costs associated with historical data.

Additionally, the scope of products subject to mandatory sharing has been narrowed. Niche products such as asset finance (excluding standard auto finance), consumer leases, reverse mortgages, margin loans, and foreign currency accounts have been excluded from the initial rollout. The Government also confirmed that Buy Now, Pay Later products would be covered by data sharing obligations, ensuring the framework captures emerging credit models.

These adjustments reflect a deliberate balancing act: expanding CDR coverage to promote competition while avoiding unnecessary regulatory burden on smaller lenders that lack the compliance resources of major banks.

The Compliance Landscape: What ACCC Expects

The ACCC has signalled that data quality and adherence to implementation timeframes are its primary compliance priorities for the non-bank lending rollout. Non-bank lender data holders are expected to make the Get Status, Get Outages, and Get Metrics API endpoints available simultaneously with their consumer data sharing obligations.

The regulator has previously taken enforcement action against CDR participants for non-compliance, underscoring that the expansion is not merely aspirational. Banks including the Commonwealth Bank and National Australia Bank have faced penalties for alleged CDR breaches, setting a clear precedent that obligations carry real consequences.

Emerging Implementation Challenges

Early evidence from the rollout suggests that compliance is not without friction. By August 2026, reports emerged that 26 non-bank lenders had published residential mortgage Product Reference Data (PRDs) without including an interest rate — a critical omission that undermines the utility of the data for comparison purposes.

This highlights a broader challenge: technical compliance with data sharing formats does not automatically translate into meaningful consumer benefit. The value of CDR depends not only on data being shared, but on that data being accurate, complete, and presented in ways that support genuine comparison.

For lenders treating CDR as a compliance checkbox rather than a strategic opportunity, the risk is two-fold: regulatory scrutiny and competitive disadvantage. As one industry analysis noted, “early movers will use CDR as a commercial weapon — fast credit decisions, lower fraud risk, ATO data integration. Lenders treating CDR as a cost will lose ground”.

The Strategic Imperative

The non-bank lenders that succeed in this new environment will be those that view CDR not as a burden but as infrastructure for competitive differentiation. Real-time data sharing enables faster credit decisions, reduces fraud risk, and opens the door to products and services that were previously technically infeasible.

The ACCC’s official guidance and the CDR rollout page provide comprehensive resources for data holders navigating their obligations, reinforcing that the framework is designed to support — not hinder — sector participation.