| Open banking lets a customer authorise a bank to share specified account information or initiate a payment through a third-party service. In New Zealand, regulated open banking operates under the Customer and Product Data Act 2025 and banking regulations. The customer approves access through the bank, without giving the third party their banking password. |
Businesses can use it for payment collection, bank-data checks and supported software feeds. Availability depends on the bank, account, authorisation and provider. Some business accounts are already supported, while wider channel obligations take effect on 1 June 2027. Check the actual connection before planning a replacement for an existing process.
Here is a hypothetical. A finance company asks every loan applicant for recent bank statements. They arrive as clean exports, phone screenshots and scanned printouts, and an assessor keys income and regular outgoings into the loan system, chasing applicants for anything missing.
With the applicant’s authorisation, a connection through an accredited provider can bring the transactions straight into the assessment. The assessor still validates categorisation, income and exceptions, and the lender’s responsible lending obligations stay the same. What changes is where the data comes from and how much retyping it needs.
What Does Open Banking Mean for a New Zealand Business?
It changes where customer bank data comes from and how it reaches you. The customer authenticates with their own bank, approves what is shared or paid, and the bank sends it to an accredited requestor through a regulated connection.
A bank named in the regulations is a data holder. An accredited requestor is a business that MBIE has accredited to request data or payments from that bank on a customer’s authorisation. The regulations bar a data holder from charging an accredited requestor for the regulated service itself.
Is open banking the same thing as a bank feed?
No. A bank feed is one product built on bank data. Open banking supplies regulated application programming interfaces, or APIs, that such products can use.
APIs and direct bank arrangements existed before December 2025, alongside screen scraping and PDF statements. Some feeds may move onto regulated connections over time. Ask your software vendor which method each feed uses, rather than assuming every feed changes at once.
What did businesses use before open banking arrived?
PDF statements sent by the customer, direct arrangements between banks and software vendors, and screen scraping. Screen scraping meant a customer gave a data provider their internet banking login so the provider could sign in and copy the data, which left a working credential with a third party and broke each time a login page changed.
What Can a Business Use Open Banking For?
Three uses stand out, each with practical limits.
- Payments. Request a payment from a customer account, which the customer approves at their bank
- Lending and other checks. Read account data, with consent, to support an assessment
- Bank feeds. Bring transactions into accounting or lending software through a supported connection
How does payment initiation differ from a card payment?
Payment initiation asks the customer’s bank to make a payment, which the customer approves in their own banking channel. The designation covers specified New Zealand dollar payments through the bulk electronic clearing system that one customer can authorise.
Account-to-account payments can avoid card processing charges. Provider fees, bank account charges, payment limits, failed payments and reconciliation still matter. Check provider support for the actual one-off or recurring workflow before treating it as a replacement for card subscriptions.
What does open banking do for a credit or affordability decision?
Bank transactions can support an assessment, arriving in a consistent structure rather than as a document to retype. Categorisation, income interpretation, missing data and exceptions still need validation.
A feed does not make an affordability decision or change a lender’s obligations. If you are choosing a loan system, start with what lending software has to handle.
How does open banking change bank reconciliation?
A supported feed can remove the download-and-import step. A regulated connection does not eliminate support faults, and some institutions and accounts may still use other methods. Your accountant or software vendor can tell you which connection each feed uses.
Which Banks Provide Open Banking, and From When?
ANZ, ASB, BNZ and Westpac have had regulated obligations since 1 December 2025, and Kiwibank has phased obligations through 2026. On 28 May 2026 Kiwibank announced payments and data sharing through internet banking and its app for individual and business customers, describing the majority of the required features as delivered ahead of its deadline.
| Date | Milestone | How to read it |
|---|---|---|
| 1 December 2025 | Regulated obligations begin for ANZ, ASB, BNZ and Westpac | Not the first existence of bank APIs in New Zealand |
| 28 May 2026 | Kiwibank announces early payments and data sharing | Covers individual and business customers |
| 1 June 2026 | Kiwibank statutory payment milestone | A legal date, separate from its launch date |
| 1 December 2026 | Kiwibank account-information obligation | A legal deadline, not a first-availability date |
| 1 June 2027 | Wider electronic channel obligations | Subject to current definitions and exclusions |
Other deposit takers can opt in. Check the MBIE register of participants and your provider’s coverage. A bank can appear on the register as an accredited requestor without offering its own customer accounts as a data holder, so do not infer coverage from a name alone. MBIE’s overview sets out the rollout.
When are business bank accounts covered?
Some business accounts are supported now, through banks such as Kiwibank and through providers. Under the current regulations, the electronic facility definition excludes facilities used predominantly by large entities, and transitional named channels apply to ANZ, ASB, BNZ and Westpac until 1 June 2027.
Check whether a trading account is supported now through the customer’s bank and chosen provider. Existing electronic access does not on its own settle who can authorise data sharing or payments, and complex signing mandates and delegated access need specific confirmation. MBIE is considering delegated authority and trust account issues; treat those as matters to verify, not settled entitlements.
Which Law Sets the Rules for Open Banking in New Zealand?
The Customer and Product Data Act 2025 sets the overall framework for a consumer data right, administered by the Ministry of Business, Innovation and Employment. Designation regulations then determine the data holders, data and actions covered in each sector, and the Act also contains protections and regulatory provisions.
Banking was designated first. Open banking is the everyday name for what the banking designation regulations require.
Who regulates open banking, and where do complaints go?
MBIE regulates compliance with the consumer data right and publishes the register. It is not the only complaints destination.
Start with the complaints process of the provider or bank, use the relevant dispute resolution scheme where applicable, and take privacy concerns to the Privacy Commissioner. Contact the bank promptly about suspected payment fraud. The Commerce Commission has a separate role in retail payments under the Retail Payment System Act 2022.
Does the Act cover anything besides banking?
Electricity is the next planned sector. MBIE says the Government has decided to make regulations designating the electricity sector, with implementation expected later. It is not yet operating on the same terms as banking.
How Does a Business Get Access to Open Banking Data?
Through an accredited requestor, either your own accreditation or a provider that holds the right accreditation. MBIE distinguishes non-intermediaries, which request data for their own services, from intermediaries, which act on behalf of other organisations, called fourth parties.
Your business may be able to use an accredited intermediary rather than obtain its own accreditation. Confirm that its accreditation covers the data or payment service and your role. Agree customer disclosures, permissions, data handling, incident reporting and complaints. Buying access does not remove your own privacy, security or lending obligations.
What does accreditation cost?
MBIE publishes GST-exclusive application and renewal fees, which differ for intermediary and non-intermediary accreditation. Banking requestors also pay an annual levy in bands set by statutory gross annual revenue, a defined term rather than a casual turnover estimate. Provider and implementation charges are separate.
Should you become accredited or use a provider?
Compare control, volume, obligations, dependence on the provider and total cost. A software vendor whose customers all need the same connection weighs this differently from a lender using one provider’s product. Whichever route you take, check the provider’s accreditation on the MBIE register and get the contract right, because your business still holds the relationship with the customer who gave the authorisation.
Is Open Banking Safer Than Sharing a Banking Password?
It removes one clear risk: the customer authenticates with their own bank, and the third party does not receive their banking password. That is the useful distinction.
It does not remove every risk. API credentials, tokens and payment permissions still need protection, and read-only access and payment initiation carry different consequences. Use least privilege, protected secrets, controlled administrator access, audit logs and an incident route. Confirm hosting, subprocessors, retention and deletion before launch. Accreditation does not certify every downstream system or make a service immune to fraud or outages.
How should authorisation and withdrawal work?
Show the account holder what data or payment action is requested, for what purpose and by whom. Confirm the actual duration and renewal process, because an annual notification is not the same as annual expiry.
Withdrawal through the bank or requestor stops future access under that authorisation. It does not automatically erase information already lawfully held, reverse completed payments, cancel a subscription or discharge a debt. Build a fallback for declined, expired or withdrawn access, and give customers a separate route for questions about retained information.
Is open banking data personal information?
It can be. Bank data can contain sensitive personal information, including transactions about identifiable people. The Privacy Act concerns identifiable individuals, so purely corporate information is not automatically personal information. Apply the relevant duties and agreed safeguards to the actual dataset, including where it is stored and whose law can reach it there.
What happens to screen scraping?
The Commerce Commission’s 5 March 2026 letter expects the larger banks to begin removing screen scraping access for API-supported use cases from June 2026, once APIs are delivered and accredited access has run for six months. It expects the bulk of the transition by the end of 2026, while recognising coverage limits and the need for an orderly transition.
That is not one statutory shutdown date for every bank and use case. Ask your provider which connections still use customer credentials, what API alternative covers them and the confirmed migration plan, and keep an agreed fallback for unsupported institutions and accounts.
What Does Open Banking Cost to Set Up and Run?
The bank cannot charge an accredited requestor for the regulated service itself, but that does not make every other cost disappear. Budget for the provider, configuration, integration, support, compliance and any transaction or bank account charges that apply.
Build the business case from your own process. Measure the time spent chasing and keying bank data, then set provider fees, setup and integration work against it. Released staff time becomes a cash saving only where spending actually changes, and money already spent on an old method is a sunk cost, not part of the comparison.
What does it take to connect open banking to your systems?
It depends on the software and provider. For lenders using finPOWER Connect, Intersoft’s finPOWER Connect 6.00.03 release notes describe a bank account enquiry service powered by Akahu, and Akahu describes its embedded Apply option as needing no technical integration. Confirm the version, licences, provider account, configuration and intended workflow.
Akahu also distinguishes regulated connections, classic connections and PDF processing, so a provider’s accreditation does not mean every connection in a mixed product uses the regulated API. Confirm the method for each institution. An affordability data feed is also not the same as built-in payment initiation.
For other systems, getting a feed into a loan system or an accounting package is ordinary integration work. Scope it the way you would any connection between two business systems.
How Should a Business Prepare for Open Banking?
Work out which processes depend on customer bank data, then check what is supported before choosing a route.
List the processes
Note every task where a customer sends bank data, a statement or a payment, and how long each takes.
Check coverage
Confirm which banks, accounts and channels your customers use, and what your provider supports now.
Choose a route
Compare an accredited provider with your own accreditation on control, volume, obligations and total cost.
Confirm the connection method
Ask which connections use the regulated API, which use other methods and the migration plan for each.
Set up data handling
Agree permissions, retention, deletion, incident and complaints processes before going live.
Plan the fallback
Keep a manual route for unsupported banks and for declined, expired or withdrawn authorisations.
eInvoicing is a related change for many businesses, moving structured documents between two businesses on an agreed standard. Open banking moves customer bank data on that customer’s authorisation. If invoicing is the more pressing problem, read how eInvoicing works first.
Get Help With an Open Banking Connection
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide. Tell us which bank-data or payment task you want to improve and which software you use. Our business software team can assess the supported provider, connection method, configuration, costs and support responsibilities, including finPOWER Connect where relevant.
We work with your chosen accredited provider and your existing software. For a wider review of your technology, our IT assessment is a separate service.
NEXT STEP
Which bank-data or payment task would you improve first?
Tell us the task and the software you use. Our business software team can assess the supported provider, connection method, configuration, costs and support responsibilities.
Or read more about finPOWER Connect.
Frequently Asked Questions
What is open banking and how does it work?
A customer authorises a bank to share specified data or initiate a payment through a third-party service. Authentication stays with the bank. Regulated banking obligations in New Zealand began on 1 December 2025, building on earlier industry services.
Is open banking compulsory for New Zealand banks?
ANZ, ASB, BNZ, Westpac and Kiwibank have phased obligations, and other deposit takers can opt in. Check current bank, account, channel and provider coverage rather than assuming every customer is supported.
What is the Customer and Product Data Act 2025?
It establishes the consumer data right framework for New Zealand. Sector regulations specify the data holders, information and actions covered. It does not create a right to obtain any information from any business.
Does my business have to be accredited with MBIE?
It depends on your role. An accredited intermediary may provide access for your business, so check its permitted class and your agreement. Your own privacy, security and other applicable obligations remain.
What does open banking accreditation cost?
MBIE charges GST-exclusive application fees that differ for intermediary and non-intermediary accreditation, with lower renewal fees. Banking requestors also pay an annual levy set by statutory gross annual revenue band. Provider and implementation charges are separate, so check the current MBIE schedule.
Is it safe to give a company my internet banking password?
Avoid giving a third party your banking password. Regulated open banking uses bank authentication instead. Check the actual connection method and permissions, and protect received data, tokens and administrator access.
What is payment initiation?
It lets an authorised third party request a payment from the bank account of a customer. The New Zealand designation covers specified NZD bulk electronic clearing system payments that need one customer to authorise them. Provider support, limits and charges still matter.
Will open banking replace screen scraping?
The Commerce Commission expects a transition towards bank APIs, with the bulk targeted for the end of 2026. This is not one universal shutdown deadline. Ask your provider about each connection and its migration plan.
What data does an open banking connection release?
Specified customer and account details, balances, transactions and statements can be shared for covered accounts. Actual access depends on the designation, account, authorisation and connection. Data sharing and payment permissions are different.
When does open banking cover business bank accounts?
Some are supported now, and Kiwibank announced business data sharing and payments in May 2026. Wider channel obligations start on 1 June 2027, with exclusions. Confirm the bank, account, signing authority and provider.
Can a customer cancel an open banking consent?
Yes. Use the supported withdrawal controls of the bank or requestor. This stops future access under that authorisation, but does not automatically delete retained information, reverse completed payments or cancel a separate contract.
Can Exodesk connect open banking to our systems?
Exodesk can assess the supported connection and setup, including finPOWER Connect options. Confirm the provider, version, configuration, costs and support scope. Built-in enquiry features and custom payment integrations are different deliverables.
Contact us or call 0800 396 337 to talk about an open banking connection.
