The Government has now set the final regulations for open banking under the Customer and Product Data Act 2025 (the Act).

As we have written about before, these regulations relate to what data and payments banks need to provide under the Act. The Ministry of Business, Innovation and Employment (MBIE) has now also released for consultation draft standards to cover how designated data and payment initiation is provided.

The open banking regime is set to commence on 1 December 2025 for personal internet banking customers of ANZ, ASB, BNZ and Westpac – although with some partial exceptions just announced by MBIE.

So, there’s a lot of new information to digest as open banking approaches its go live date. We’ve summarised the key points below:

New regulations

Two different sets of regulations have now been approved and will take effect on 1 December 2025:

• The Customer and Product Data (Banking and Other Deposit Taking) Regulations 2025 specify which data and data holders are designated under the Act.

• The Customer and Product Data (General Requirements) Regulations 2025 prescribe general requirements relating to regulated data services provided under the Act, such as accreditation processes and information-sharing requirements.

Personal internet banking only

Only specific personal internet banking platforms offered by ANZ, ASB, BNZ and Westpac must be ready to meet the new requirements for their customers by 1 December 2025.

Open banking for all business internet banking platforms has been pushed out to 1 June 2026. MBIE has flagged that the Government will make “further decisions” on open banking for business banking customers in early 2026.

Some customer data will not be immediately available

Other time-limited partial exceptions to the 1 December 2025 deadline have been made to address technical challenges that some banks have said require more time to address e.g., providing bank statements as well as transaction data.

Kiwibank always had an extended timeframe of 1 June 2026 for payments and 1 December 2026 for other open banking services.

Prohibition of charges for requests

An important section in the draft regulations that was left “under consideration” related to the charges that banks could impose on accredited requestors for data services. This has now been resolved – the regulations prohibit banks from charging accredited requestors for requests made under the Act.

Cabinet had previously announced that banks could impose fees on accredited requestors, but they would be capped, so this is a shift. MBIE says this change has been made “to ensure New Zealanders have access to valuable technology that makes use of small and frequent payments or data requests”, and that it aligns New Zealand with the approach in Australia and the United Kingdom.

There is still scope in the regulations for banks to pass on “ordinary charges” for making payments or to agree exceptional charges with accredited requestors for making services available in a specific way or to a higher level of performance than required by the Act. In practice we expect banks to continue to invest in these “proprietary” solutions, to provide premium or extended functionality over and above the regulated minimum.

Requesting bank statements

The specifics of bank statements as customer data under the regulations were also a matter still expressly subject to public consultation. Early discussions referenced a two-year window for requesting bank statements, but the draft regulations proposed shortening this to six months. The final regulations have settled on a 12-month lookback period for bank statements.

Fees and levies

Banks and accredited requestors will be required to pay fees and levies to fund the operation of the system. Businesses applying to be accredited requestors will be required to pay an application fee of NZ$2,000 (intermediary) or NZ$1,500 (non-intermediary). There will also be an annual levy to pay, calculated by reference to revenue and ranging from NZ$1,300 to NZ$85,000.

Designated banks must pay an annual levy linked to the value of their assets, ranging from NZ$578,000 to NZ$1,248,700. When a person is both a data holder and an accredited requestor, they are only required to pay a single levy at the highest applicable rate. More detail about the fee and levy amounts is published on the MBIE website. The Government will need to issue regulations before 1 December to give effect to these fees and levies.

Standards

The draft standards released by MBIE earlier this month flesh out the open banking process, and cover API structure, identity verification, authorisation, system reliability and auditability. They are based heavily on Payments NZ API Standard v2.3.3, incorporating its structure, security protocols and consent processes – which MBIE says is to “ensure continuity”. This is essentially lifting and shifting the standards that industry is currently working with under the API Centre programme – which is good news for existing API Centre participants, who will not be required to make substantial technical changes to their existing systems.

A good understanding of those existing processes will be essential to giving meaningful feedback on the draft standards, as the consultation period is only two weeks, until 5pm, 27 October 2025.

Accreditation framework

MBIE will be the accreditation body for data requestors and is currently finalising a “full accreditation criteria and approach”, which it will need to publish shortly, as it intends to start accepting accreditation applications by 1 December 2025. MBIE has said that in designing the framework it has accessed working group findings from the API Centre on the subject and has been studying international examples. As we have previously discussed, Cabinet has already signposted accreditation criteria (including adequate insurance, registration as a financial service provider, and adequate processes to ensure that accredited requestors that act as intermediaries don’t pose undue risks to customers) but it will be important to see the specific detail adopted by MBIE.

Approved standards body

Industry speculation that Payments NZ’s API Centre will be designated as an approved third party standards body to manage and support the technical standards under the Act is yet to be confirmed in the material released.

Next steps

MBIE is largely tracking to its own published timeframes, but there is still a lot of detail to be finalised before the open banking designation commences on 1 December. Interested parties will need to move quickly to stay involved in shaping the regime.

If you’d like any help understanding how the regulations might impact your business, get in touch.