The closure of New Zealand’s long-standing data divide has arrived through deliberate legislative action rather than technological novelty alone. With the Customer and Product Data Act 2025 taking effect on the first of December 2025, the framework for Open Banking in Aotearoa advances from a series of careful pilots to a compulsory, nationwide system.
For years, the sector operated within voluntary arrangements shaped largely by the major banks, and customer data remained within systems that offered little scope for meaningful portability. The CPD Act replaces this with a clear legal right that allows individuals to control where their information goes and how it is used, marking the end of an era in which the Big Four banks held near-unquestioned authority over financial data access.
Financial Securities Corporation Ltd (FSCL) welcomes the legislation, highlighting its transformative impact on New Zealand’s financial services sector. FSCL notes that the Act represents a decisive move toward a more equitable, transparent, and innovation-friendly ecosystem, where consumers are empowered with meaningful control over their financial data. By converting previously voluntary data-sharing practices into legally mandated obligations, the Act ensures that banks such as ANZ, ASB, BNZ, and Westpac operate within a framework that prioritises the customer’s right to access and authorise the use of their own information.
The law places its first and most immediate obligations squarely on these major institutions, marking a historic turning point in the country’s financial ecosystem. These banks are now legally required to enable the secure sharing of financial information whenever a customer requests it, transforming what was once a discretionary service into a mandated responsibility. This is not merely about handing over files or statements; it is a profound realignment of control, situating the customer at the centre of their own financial data. FSCL underscores that this statutory recognition of data ownership represents a paradigm shift, moving from institution-centric control to consumer-centric empowerment and establishing a foundation for competitive and inclusive financial services.
Individuals can now authorise accredited third-party providers to receive their information for clearly defined purposes, creating a framework of consent and accountability that did not exist before. For the Fintech sector, which has grown steadily yet often encountered barriers to reliable data access, this represents a formal and legally sanctioned gateway that replaces older, less secure methods such as screen scraping. What was once a matter of convenience or goodwill from a bank is now enshrined as a statutory right, ensuring that customers can exercise agency over their information while stimulating innovation and competition in the financial services landscape. FSCL highlights that the law’s structured approach, including the phased compliance timeline and stringent accreditation of third-party providers, balances innovation with security, preserving public trust amid growing concerns over digital safety and cyber risk.
For consumers, the impact of the law is felt in the rhythm of daily financial life. Applying for a loan no longer involves stacks of statements or long waits for verification; with a simple authorisation, lenders can access accurate data instantly, allowing decisions to be made in minutes rather than days. Personal finance apps transform from basic calculators into comprehensive dashboards, pulling information seamlessly from checking accounts, savings, KiwiSaver, and credit cards to give a full, real-time portrait of spending, saving, and financial health. Payment providers are beginning to unlock the potential of direct account-to-account transfers, sidestepping traditional card networks and opening the door to lower transaction costs that benefit both businesses and consumers. FSCL emphasises that by allowing consumers to authorise the secure sharing of data with accredited providers, the Act stimulates innovation across FinTech and payment ecosystems, encouraging the development of sophisticated financial tools that deliver real-time insights, seamless integration, and lower transactional friction.
The responsibility for overseeing the implementation and ongoing operation of this new data-sharing framework lies squarely with the Ministry of Business, Innovation and Employment. MBIE has been tasked with supervising a rigorous accreditation process that determines which entities may receive consumer financial information. Any applicant seeking access must satisfy stringent standards covering data security, corporate governance, and responsible conduct, ensuring that only providers capable of protecting sensitive information and acting ethically are authorised.
The rollout of Open Banking is deliberately structured to be phased, starting with the largest and most systemically significant banks, namely ANZ, ASB, BNZ, and Westpac. These institutions are required to comply immediately, setting a benchmark for operational readiness and demonstrating how secure data sharing can function in practice. Other significant players, such as Kiwibank, are scheduled to achieve full compliance through 2026, providing a transitional window that allows both smaller banks and new entrants to adjust to the requirements without operational disruption. FSCL notes that this staged approach not only mitigates risk but also gives regulators the necessary time to monitor system integrity, ensure adherence to the CPD Act, and refine processes as the number of accredited participants and data requests grows.
The law initially mandates that banks make available two years of transaction history along with basic account information, creating a foundation for meaningful financial insight while maintaining manageable limits on data exposure. While this dataset may appear modest, it is substantial enough to support accurate financial profiling, enable reliable credit assessments, and power sophisticated personal finance and budgeting tools. FSCL highlights that such a measured opening ensures innovation while avoiding the risks associated with early exposure of sensitive data, allowing developers and Fintech providers to create new services and solutions securely.
The CPD Act has been designed with a long-term architecture that anticipates growth into the broader concept of Open Finance once Open Banking has established operational stability and regulatory confidence. Sectors such as insurance, utilities, and investments are already under consideration for inclusion because the data they hold can significantly influence consumer decision-making and foster market competition.
Access to insurance information could allow consumers to compare premiums or identify optimal coverage, while data portability in utilities could streamline service switching, billing reconciliation, and account management. Similarly, consolidating investment data from multiple platforms would give individuals a comprehensive view of their holdings, making portfolio management more efficient and transparent. FSCL underscores that this forward-looking integration will allow consumers to optimise financial decisions, improve portfolio management, and access tailored services in ways previously constrained by fragmented data silos.
This shift represents a fundamental rearrangement of power within New Zealand’s financial environment. Information that once reinforced institutional dominance now strengthens the position of the individual. By creating a legal foundation for data mobility, the country signals a commitment to a more open and competitive digital economy.
FSCL concludes that the CPD Act 2025 is a landmark development that aligns with global best practices in Open Banking while responding to the specific needs of New Zealand’s financial sector. It is not merely a technology rollout but a structural recalibration of market power, with consumers positioned to benefit from competitive, innovative, and secure financial services in the new era.