Customer and Product Data Act update – Open banking officially on the way

The Minister of Commerce and Consumer Affairs, Scott Simpson, has just announced that Cabinet has approved banking as the first sector to be designated under the new Customer and Product Data Act 2025 (the Act).

Cabinet has also now confirmed some key details about open banking under the designation. Most of these have already been clearly signposted by MBIE in its discussion documentation and consultation processes. However, there is some important new information to digest – particularly confirmation of fee caps for API access.

Designated persons

ASB, ANZ, BNZ and Westpac will be required to provide payment initiation and customer account data from 1 December 2025. Kiwibank must provide payment initiation from 1 June 2026 and customer account data from 1 December 2026. Other banks and deposit takers may opt in by giving notice to MBIE.

This timeline has been signposted by MBIE for some time.

Designated data

Cabinet has confirmed that designated customer data will include:

• Information identifying the customer by name, type (e.g., individual, trustee or company) and contact details; and

• Information about the customer’s use of transactional accounts, savings accounts, credit card accounts and lending accounts, including account balances and transaction information. This all aligns with API Centre standards for customer data.

As expected, the designation will only apply to customers who have digital access to designated accounts, such as through internet banking or mobile banking applications.

There is no mention of designated product data in Cabinet’s decision. As contemplated in MBIE’s August 2024 discussion paper, if product data is designated it won’t come into force until at least six months after the dates for customer data.

Designated actions

In line with MBIE’s proposals, Cabinet has now confirmed the designation will include domestic payments initiation.

Scope

Only accredited requestors will be able to request customer data and payments initiation from banks, on behalf of customers – not customers themselves. This was signposted in MBIE’s August 2024 discussion paper.

Accredited requestors

The Act sets out some accreditation criteria, but Cabinet has now agreed to additional criteria specifically for requestors in the banking sector:

• Adequate insurance to address the risk that accredited requestors are unable to meet liabilities incurred in connection with data or payments requested under the Act – unless this risk is adequately addressed through other means, such as related company guarantees. This flexible approach aligns with that taken in Australia and the UK and gives MBIE as the regulator some discretion to determine what insurance or comparable guarantees are “adequate”. Our experience of the current industry-led open banking regime in New Zealand is that specific insurance tailored to these services can be difficult to come by. It remains to be seen whether this regulatory requirement will change this position.

• Registration as a financial service provider, if required by the Financial Service Providers (Registration and Dispute Resolution) Act 2008. This ensures those accredited requestors are members of a dispute resolution scheme.

• Changes in circumstances affecting accreditation must be notified to MBIE, such as changes to directors or senior management.

• Accredited requestors that act as intermediaries must have “adequate processes to ensure that this does not pose undue risks to customers”. It will be interesting to see more detail from the Government about what is contemplated here. As we have discussed before, it will be important for regulations and standards to address the potential for intermediaries to be a “single point of failure” in the open banking system.

Enduring authorisations

Cabinet has now confirmed the proposal by MBIE that accredited requestors with active customer authorisations will be required to remind customers at least every 12 months of the scope and purpose of those authorisations and inform customers how to withdraw them. The 12-month period is long by international standards and is clearly designed to enhance the workability of the regime by preventing the need for constant re-authorisation following expiry of consents.

Fees

A key issue for open banking – left open for consultation in MBIE’s August discussion paper – is what fees can be charged by banks to accredited requestors.

Cabinet has now confirmed the following policy settings:

• The regulations will set out requirements that restrict the fees that banks can impose on accredited requestors.

• The regulations will require banks to publish their pricing for regulated data services.

• Banks will be prohibited from charging end customers for requests made by accredited requestors.

• Bank charges to accredited requestors for action initiation requests must not exceed 5 cents per payment request.

• For customer data requests, bank charges must not exceed 1 cent per successful API call, or a maximum of $5 per month per customer for near-real-time access to transaction records.

Payment and time limits

To facilitate the uptake of open banking, Cabinet has also now confirmed that:

• The regulations will prevent banks from imposing new, lower transaction limits for payments initiation requests – payment limits will need to match the limits imposed on transactions the customer can initiate through internet or mobile banking, unless the customer requests a lower limit; and

• Banking data holders will be required to provide the information necessary for an accredited requestor to establish connections with the bank’s electronic system within five working days of receiving a notification in writing from an accredited requestor.

Next steps

As open banking continues its steady progress to being operational in New Zealand, MBIE has published the timeline for next steps:

1. Regulations implementing Cabinet’s decisions to be made in mid-2025.

2. Decisions on fees and levies to fund regulatory costs to be made by August 2025.

3. Approval of standards for the banking sector under the Act – proposed to be full implementation of version 2.3 of the Payments NZ API Centre's API standards for Account Information and Payment Initiation, and the related security profile and non-functional standards. No specific timing has been given.

4. Accreditation opens late 2025.

5. Commencement of the designation from 1 December 2025.

We will continue to keep you updated. You can read more about open banking under the Act in our comprehensive report here.

‍