On Wednesday, 19 November 2025, the Ministry of Business, Innovation and Employment (MBIE) released further details on the next steps for New Zealand’s Consumer Data Right (CDR), including how accreditation will work for requestors under the new regime.
We summarise the key implications below.
New details on the CDR accreditation process
The CDR is explained in more detail in our previous article (here). By way of reminder, it will enable consumers and certain business customers to direct designated “data holders” (initially banks) to share their data securely with third party “accredited requestors”, under standardised requirements set out in the governing legislation (the Customer and Product Data Act 2025 and related regulations).
MBIE’s announcement provides further detail in relation to how third parties will achieve accreditation:
- Applications to become an “Accredited Requestor” open on 1 December 2025. From that date, MBIE will launch a dedicated CDR section on its website, including an application form and accreditation information, a register of CDR participants, and further guidance for participants. Consumer facing guidance is expected to follow during 2026, once the framework is more established.
- At this stage, the published detail on the application process has been relatively light although MBIE has now confirmed it will consider various factors including consent processes, whether directors and senior managers are “fit and proper” persons, product security safeguards, liability cover, and dispute resolution processes. For liability cover, MBIE must be satisfied there is reasonable cover in place – either via insurance, a guarantee, or other financial resources set aside for the purpose of the regime (i.e. self-insurance).
- In these respects, the announcement confirms several of the possible considerations noted in the legislation. In addition, the announcement refers to imposing “additional requirements” for accredited requestors who act as intermediaries “relating to due diligence and ongoing monitoring of fourth parties, security and privacy provisions in contracts for fourth parties, AML/KYC and data handling practices.” We expect that signal will be positively received by data holders, given the limited detail in the legislation in relation to intermediary arrangements and the protections and obligations that would apply.
In terms of next steps, MBIE’s announcement also notes that:
- It will sequence the early waves of applications by reference to the applicants’ existing activities, and whether they are already party to bilateral open banking agreements with banks. The first tranche will be those with bilateral agreements with four banks, then those with two or three, then one, and finally those with none.
- The technical standards (issued recently in draft for consultation and based largely on aspects of Payments NZ’s API Centre standards) will be finalised “soon” and published via the New Zealand Gazette.
- MBIE is working with industry on how the roll-out over 2026 should be managed. Currently the scope of the banking designation regulations is limited to certain core retail banking platforms, but the relevant exceptions are scheduled to fall away in June 2026. The Ministry intends to hold workshops with banks and fintech providers to support management of the expiry of these exceptions.
With commencement fast approaching, we expect growing interest in the CDR and accelerated preparation across the market. In response to MBIE’s announcement, we expect that many prospective accredited requestors will look to take active steps to gather the evidence MBIE may require (including security artefacts, consent design details, and liability cover arrangements). For entities intending to operate as intermediaries, that will also involve documenting “fourth party” due diligence and ongoing monitoring processes. For all participants in the CDR, we anticipate a busy period ahead.
Bell Gully’s Consumer, Regulatory and Compliance (CRC) Team has been closely monitoring the development of the Consumer Data Right since the first proposals in 2021 and is well placed to advise on how the new regime will impact your business in practice. Please get in touch with the authors or your usual Bell Gully adviser if you would like to discuss further.
Disclaimer: This publication is necessarily brief and general in nature. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.
