| Open banking lets a bank customer instruct their bank to share account data with another business, or to make a payment, through a secure connection the customer switches on and can switch off. In New Zealand it runs under the Customer and Product Data Act 2025, and the four largest banks have been obliged to provide it since December 2025. |
A Christchurch finance company assesses about thirty loan applications a week. Every one of them arrives with ninety days of bank statements attached.
The statements turn up in whatever form the applicant managed. Some are clean exports, some are photographs of a phone screen, and one or two are printouts scanned at a library.
An assessor reads them and keys the income and the regular outgoings into the loan system. Anything missing means a phone call to the applicant and a file that waits until they call back.
The applicant’s bank holds all of it already, in a form that would drop into the loan system untouched, and until recently nobody had a way to ask for it.
The figures below are illustrative. The firm employs fourteen people and lends on vehicles and light equipment across Canterbury and Otago.
Six hours a week goes on chasing and re-keying statements. That comes to 312 hours a year, and at a loaded assessor rate of $38 an hour it costs $11,856.
The firm also pays $220 a month for a service that logs into applicants’ internet banking on their behalf and pulls the transactions down. That adds $2,640 a year.
Recurring cost of getting bank data into the loan system: $14,496 a year.
One-off spending is separate and does not net against that figure. A bank changed the layout of its PDF statement in 2024 and the firm paid a developer $4,300 to rebuild the parser that reads them.
Open banking cuts into both figures. The applicant gives the instruction and the bank sends the data in a fixed layout without anybody handing over a password.
Work your own version out from your application volume and your assessor rate. It takes an afternoon and does not need anybody technical.
What Does Open Banking Change for a New Zealand Business?
Open banking changes where a customer’s bank data comes from and how much handling it needs on arrival. The data comes straight from the bank, on the customer’s instruction, in a structure your software can read without anybody retyping it.
Lenders, accountants, property managers, insurers and anyone running a payment plan all make decisions on the strength of somebody else’s bank account.
Somebody in your office spends part of every week chasing customers for documents their banks could send in seconds.
Before December 2025 there were two ways to get it. The customer emailed a PDF, or the customer handed a third party an internet banking password and let it sign in as them.
A bank named in the regulations, a data holder, now has to supply that data whenever the customer asks. The business receiving it has to be accredited, and MBIE’s rules bar the bank from charging it for the service.
Is open banking the same thing as a bank feed?
No. A bank feed is one product built on bank data. Open banking supplies the regulated application programming interface, or API, that several such products can now use.
Accounting bank feeds have existed for years and mostly ran on screen scraping or on private arrangements between a bank and a software vendor. The feed your accountant relies on will move onto the regulated connection over the next year or so, and most owners will notice nothing beyond a different consent screen.
What did businesses use before open banking arrived?
Screen scraping, mostly. A customer gave a data provider their internet banking username and password, and the provider signed in as the customer and copied what it found. That breached the bank’s terms in most cases, and it left a working credential with a third party.
It also failed whenever a bank changed its login page.
The Christchurch firm’s $220 a month pays for exactly this arrangement.
Start with the process your staff complain about most. Open banking will reach it inside two years if it has not reached it already.
What Can a Business Use Open Banking For?
Three things, and each one replaces manual work you already pay for.
- Take a payment out of a customer’s account, with their approval, without a card
- Read a customer’s account data, with their consent, to make a decision
- Run an accounting or lending feed without anybody handing over a password
How does payment initiation differ from a card payment?
A payment initiation moves money straight out of the customer’s bank account, and the customer approves it in their own banking app. No card number and no stored credential reaches your side. The rules cover payments in New Zealand dollars through the bulk electronic clearing system, the system New Zealand banks use to clear everyday direct credits and debits, where one customer’s authorisation is enough.
A business billing monthly stops losing collections to expired cards. On a large one-off payment, the merchant service fee disappears too.
What does open banking do for a credit or affordability decision?
Open banking puts source data in front of the assessor within seconds of the customer agreeing to share it.
Income, rent, existing repayments and the pattern of deposits are all there, and nobody has retyped any of it.
Responsible lending obligations have not changed and the evidence behind them gets cleaner. Most lenders will take open banking data in through a loan management system, and if you are choosing one, start with what a loan management system has to handle.
Exodesk supplies finPOWER Connect to New Zealand lenders, so this is ground we work on directly.
How does open banking change bank reconciliation?
Open banking removes the download-and-import step that most reconciliation still begins with.
Most accounting packages already pull transactions in overnight. The regulated connection puts that feed on a legal footing the bank has to honour, so a broken feed stops being a support ticket nobody can close. Your accountant or bookkeeper will know which of those feeds still run on screen scraping.
Their answer decides how much of this affects you over the next twelve months.
Which Law Sets the Rules for Open Banking in New Zealand?
The Customer and Product Data Act 2025 sets the rules, and regulations made under it do the detailed work. The Act received Royal assent in March 2025 and is administered by the Ministry of Business, Innovation and Employment.
The Act creates what is called a consumer data right, shortened to CDR, and designates nothing on its own. Regulations name a sector, name the businesses inside it that have to comply, and name the data and the actions covered.
Banking was designated first, under the Customer and Product Data (Designations for Banking and Other Deposit Taking) Regulations 2025, and open banking is the everyday name for what they require.
Who is a data holder and who is an accredited requestor?
A data holder is the bank holding the account. An accredited requestor is the business that has passed MBIE’s accreditation and may ask that bank for the data.
Your business is probably neither. Most firms reading this are the requestor’s customer, buying a product that carries the accreditation on somebody else’s behalf.
Nothing moves until the customer gives an instruction, and that instruction goes to the bank, so the requestor never touches a banking credential.
Only the requestor needs accreditation. That keeps your own business outside the regime and inside an ordinary commercial contract.
Who regulates open banking in New Zealand?
MBIE regulates it. The Ministry of Business, Innovation and Employment both administers the consumer data right and enforces it, and it publishes the register of accredited participants.
The Reserve Bank and the Commerce Commission are the two most often named by mistake. The Commerce Commission has a live interest in open banking payments, and its powers there come from the Retail Payment System Act 2022, a separate regime.
That matters when something goes wrong with a provider. Complaints about a data holder or an accredited requestor go to MBIE.
Does the Act cover anything besides banking?
Yes, in time. Banking is the first designated sector and electricity is the second, with regulations still in progress.
Nothing else has been designated. A business waiting on insurance or telecommunications data has years to wait, and the banking rules are the ones worth reading now.
Which Banks Have to Provide Open Banking, and From When?
ANZ, ASB, BNZ and Westpac have had to provide open banking in New Zealand since 1 December 2025, and Kiwibank joined for payments on 1 June 2026. MBIE’s designation summary puts Kiwibank’s obligation to supply account data at 1 December 2026.
Every other deposit taker may opt in and none has to. A customer banking with a credit union or a smaller bank may find nothing available, so check coverage before you design a process around it.
If a real share of your customers bank outside the designated group, keep the manual route running beside the new one. Whether open banking covers your customers depends on your customer list more than on your software.
| Date | What starts | What it means for your business |
|---|---|---|
| 1 December 2025 | ANZ, ASB, BNZ and Westpac must supply account data and accept payment instructions | Most consumer customers are covered from day one |
| 1 June 2026 | Kiwibank must accept payment instructions | Payment initiation reaches close to full consumer coverage |
| 1 December 2026 | Kiwibank must supply account data | Account data catches up with payments |
| 1 June 2027 | Coverage widens beyond the main personal banking apps | Company accounts on business channels come into scope |
The 2027 date is the one to diarise if you deal with companies. Until then the obligation reaches only the accounts your customer can open through the main personal banking app, and a company account used on a business channel may fall outside it.
What changes on 1 June 2027?
Coverage stops being limited to the main personal banking apps. From that date a data holder has to cover accounts on its other electronic channels, with narrow exclusions for facilities used mainly by large entities.
A lender assessing a sole trader usually needs the trading account, and the 2027 date brings it into range. Build for consumers now and expect company coverage to fill in after that.
Ask your provider now what happens on that date. A provider already handling the personal channels will extend to the rest with a configuration change, and one that has not planned for it will need longer.
How Does a Business Get Access to Open Banking Data?
Through an accredited requestor. You either apply to MBIE for accreditation yourself or buy the capability from a business that already holds it.
Most businesses will buy. Accreditation carries an application, an evidence pack, an annual levy and a standing compliance obligation, and it pays for itself only where data access is central to what you sell.
You can change your mind later. A business that starts with a provider can apply for accreditation once the volume justifies it, and the integration work it has already paid for carries over.
What does it cost to become an accredited requestor?
The application fee is $1,500 excluding GST for a non-intermediary and $2,000 for an intermediary, with renewals at $1,000 and $1,700 on the published fee and levy schedule. If you are weighing up whether to build or buy, the lower number is the one that applies to you.
The levy is the larger number. An accredited requestor in banking pays an annual levy scaled to revenue, from $1,300 for a business turning over up to $1 million to $85,000 for one above $100 million. Compare those figures with what a provider would charge you.
A small lender buying access will usually spend less than its own levy would cost.
Should you become accredited or buy from a provider?
Buy, unless selling data access forms part of your business model.
Accreditation is worth the money for a software vendor whose customers all need the same connection, or for a large lender with the volume to carry the compliance work. Everyone else is buying a feature.
Ask any provider quoting for the work whether they hold accreditation, and check the answer against MBIE’s public register of participants.
Get the contract right whichever way you go. The provider holds the accreditation, and your business still owns the relationship with the customer who gave the consent.
Is Open Banking Safer Than Sharing a Banking Password?
Yes. The customer signs in at their own bank and the bank decides what to release. Your business never holds a credential that could be used to move money out of the account.
A consent is specific and time limited. It names the data and names the requestor, and the customer can withdraw it at the bank without asking you first.
A regulated connection controls how the data reaches you. Once it is in your system, your own access controls decide who reads it.
Your obligations do not end when the data arrives. Open banking data is personal information as soon as it reaches you, so where your systems keep it, and whose law can reach it there, is worth settling before you connect anything.
What happens to screen scraping?
Screen scraping is being turned off. The Commerce Commission told the banking sector in March 2026 that it expects screen scraping access to be withdrawn from June 2026, with the bulk of it transitioned by the end of that year.
If a supplier of yours still signs in as your customers, ask when they move and what replaces it. Any process of yours resting on screen scraping now has an end date, and open banking replaces it.
How does a customer stop sharing bank data?
In their banking app, under the list of businesses they have authorised.
They can also cancel with the requestor. Either route halts the flow, so any process you build needs a fallback for the customer who changes their mind halfway through an application.
How Much Does Open Banking Cost to Set Up and Run?
The bank side is free. Your bill comes from whoever supplies the connection, because the regulations bar a data holder from charging an accredited requestor for a regulated data service.
What a provider charges varies with volume and with what else the product does. Categorisation, affordability scoring and payment initiation are usually priced apart from the raw API feed.
Set that price against the handling cost you already carry. The Christchurch firm could hold a quote up against $14,496 a year. A business that has never done that arithmetic has nothing to compare a quote with.
The Christchurch firm connected through an accredited provider for $180 a month, or $2,160 a year. Assessor time on statements fell from six hours a week to about one, so 52 hours a year at $38 comes to $1,976.
Recurring cost went from $14,496 a year to $4,136, a saving of $10,360 a year.
The one-off stays separate and does not net off. Integration into the loan system cost $6,500 once, and the $4,300 spent on the PDF parser in 2024 is a sunk cost.
Which parts of open banking do you pay for?
Everything except the connection itself. Accreditation, the annual levy, your provider’s fee and the integration work all come out of your budget, and the bank’s regulated data service is the only part supplied free.
Integration is the line item owners forget. Getting an open banking feed into a loan system or an accounting package is ordinary software work. Price it the way you would price any connection between two business systems.
How Should a Business Prepare for Open Banking?
Work out which of your processes depend on somebody else’s bank account, then decide whether you buy the connection or wait for your software vendor to supply it.
- List every process where a customer sends you bank data or a bank statement, and note how long each one takes.
- Price that time, so the case for changing it carries a number.
- Ask your existing software vendors when they will support the regulated connection, and get the answer in writing.
- Check where your customers bank, since a credit union or smaller bank may not have opted in.
- Decide between accreditation and a provider on volume, and read the MBIE fee and levy schedule before you assume accreditation is expensive.
- Diarise 1 June 2027 if you serve business customers, since their accounts come into scope on that date.
None of this needs a technology project. The first two steps are an afternoon with your process list and your payroll rates.
Put a name and a date against each step before the list leaves the meeting.
eInvoicing is the closest thing to this that New Zealand businesses already use, and it moves a document between two businesses on an agreed standard.
Open banking moves a customer’s own record out of their bank on that customer’s instruction. If invoicing is the more pressing problem, read how eInvoicing works first.
The Christchurch firm spent $14,496 a year retyping information its applicants’ banks were already holding. The regime that stops it has been running since December 2025.
How Much of Your Week Goes on Other People’s Bank Statements?
Exodesk has supported South Island businesses since 1989 and works with clients across Canterbury, Otago and Southland from offices in Christchurch and Dunedin. Our business software team connects open banking feeds and payment initiation into the loan and accounting systems our clients already run.
We will tell you which of your processes open banking can replace this year and which have to wait for the 2027 coverage.
Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.
Frequently Asked Questions
What is open banking and how does it work?
Open banking is a regulated way for New Zealanders to have their bank release account information, or make a payment, to a business they have chosen. The bank checks who the customer is and releases only what the consent covers, so no login details change hands. The New Zealand version began with the four biggest banks on 1 December 2025.
Is open banking compulsory for New Zealand banks?
Open banking is compulsory for the banks named in the regulations and voluntary for every other deposit taker. ANZ, ASB, BNZ and Westpac were designated from 1 December 2025, Kiwibank followed during 2026, and credit unions and smaller banks may opt in without being required to.
What is the Customer and Product Data Act 2025?
The Customer and Product Data Act 2025 created New Zealand’s consumer data right, which lets a person direct any business holding their information to release it to somebody else. Parliament passed it in 2025 and MBIE runs it. Designation happens through regulations, so the Act on its own obliges nobody.
Does my business have to be accredited with MBIE?
No, as long as you buy access from a provider that already holds accreditation. Accreditation with MBIE is required only for the business making the request to the bank, so a lender using an accredited provider’s product stays outside the regime.
What does open banking accreditation cost?
MBIE charges an application fee of $2,000 excluding GST for an intermediary and $1,500 for everyone else, and renewal costs less. The annual levy is the bigger number: a banking requestor turning over less than $1 million pays $1,300 and one above $100 million pays $85,000. A provider’s own fee comes on top.
Is it safe to give a company my internet banking password?
No. Sharing an internet banking password hands a third party full access to the account and usually breaches the bank’s own terms. Open banking replaces that arrangement: the customer signs in at their own bank, and only what the consent allows leaves it. The business asking for the data never sees a login.
What is payment initiation?
Payment initiation lets a business ask a customer to approve a payment straight out of their bank account, which the customer confirms in their own banking app. No card number and no stored payment credential reaches the business. In New Zealand the designated action covers New Zealand dollar payments through the bulk electronic clearing system that one customer can authorise.
Will open banking replace screen scraping?
Yes, and the switch has already begun. In a March 2026 update to the sector the Commerce Commission said it expected banks to start withdrawing screen scraping access in June 2026 and to finish the bulk of the move within the year. Screen scraping works by logging in as the customer with their own credentials. Any process in your business depending on it now has a deadline.
What data does an open banking connection release?
The designated data covers the customer’s name and contact details and whether the account is sole or joint. It also covers the account’s number, name, currency, type, balance, transactions and statements. The rules apply to transaction, savings and loan accounts held in New Zealand dollars that a customer can already reach electronically. Nothing outside the consent leaves the bank.
When does open banking cover business bank accounts?
From 1 June 2027 for most of them. Before that date a data holder only has to cover the accounts available on its main personal banking app, so a company using a separate business portal may find its account out of scope.
Can a customer cancel an open banking consent?
Yes, at any time. A customer can withdraw the authorisation in their banking app or by telling the business that asked for the data, and the information stops arriving. Any process you build should handle a consent that disappears partway through.
Can Exodesk connect open banking to our systems?
Yes. Exodesk works with businesses across Canterbury, Otago and Southland from offices in Christchurch and Dunedin, and our business software team wires bank data and payments into the systems a client already runs. We also supply finPOWER Connect to New Zealand lenders, where affordability data from an open banking feed lands straight in the credit assessment.
NEXT STEP
Which of your systems could take a bank feed today?
The Christchurch example spent $14,496 a year keying in numbers its applicants’ banks already held. An IT assessment maps which of your processes wait on a customer to send a document, and what it would take to connect them to the bank instead.
Or read more about our IT services.
