Contents
The Customer and Product Data Act 2025 (Act) received Royal Assent on 29 March 2025, bringing open banking in New Zealand much closer to reality.
The Act introduces a legislated consumer data right (CDR) on a sectoral basis, beginning with the banking sector. It requires designated data-holding businesses, with the consent of the consumer, to share certain personal data with accredited third parties.
Designation of the banking sector, including regulations and standards for the four largest banks, will take effect in December 2025 (1 June 2026 for Kiwibank).
There are a number of changes in the Act from the Bill
The final Act reflects a number of amendments unanimously recommended by the Select Committee in December 2024. They include:
- addition of a broad “good faith” defence to data holder liability under the Privacy Act and across contractual or other obligations where the data is disclosed in compliance with the Act (and after reasonable precautions have been taken and due diligence has been exercised),
- new accreditation criteria, including that the Chief Executive of the Ministry of Business, Innovation and Employment (MBIE) must be satisfied that the applicant’s directors and senior managers are of good character, have adequate security safeguards in place and can effectively comply with their obligations under the Act,
- removing certain privacy protections in the Act where the provisions of the Privacy Act are considered sufficient,
- extending the Act’s territorial scope to any regulated conduct that occurs, in whole or in part, in New Zealand, even if the designated data is held elsewhere
- scrapping the requirements for data holders and accredited requestors to develop, publish, implement, and maintain CDR policies, and
- allowing data disclosure requests to be refused where there is reasonable belief that the action would cause serious financial harm or the request was deceptively made.
Various minor and technical changes were also made in March 2025 during the Select Committee stage, including:
- clarifying that certain persons (such as banks or non-bank deposit takers) may opt in to be data holders,
- specifically allowing the CEO of MBIE to vary the terms and conditions of accreditation, and
- amending the definition of “customer” to expressly include those who have acquired goods or services from data holders in the past.
Next steps
Following consultation last year, MBIE is developing proposals on:
- the scope of open banking designation regulations,
- requisite accreditation criteria for third party requestors to access data,
- appropriate fees and relevant standards for a well-functioning CDR regime, and
- associated costs, benefits and risks.
Ongoing work to support the rollout of open banking
The Act is an important springboard but there are a number of other workstreams in progress, both within the banking sector and the Government.
- The four largest banks put standardised Application Programming Interfaces (APIs) in place last year for payments initiation and accessing account information and have agreed under the Payments NZ implementation plan to deliver new versions of these APIs over time. Kiwibank has agreed to have its first APIs in place in 2026.
- Payments NZ has been authorised by the Commerce Commission to work with industry to develop the accreditation criteria for third parties and default contractual terms and conditions for the underlying open banking API interactions between banks and accredited third parties.
- The Minister of Commerce and Consumer Affairs has yet to issue a decision on an August 2024 recommendation by the Commerce Commission to be granted enforcement powers and the ability to regulate fees and standards within the retail payment network (by designating the interbank payment network under the Retail Payment System Act 2022). In the meantime, the Commission has updated its expectations of the industry to emphasise:
- a coordinated, orderly transition to accessible open banking APIs, and
- an expectation that the banks begin contracting with third parties now to ensure standardised APIs are live and available for consumers at the time, or ahead, of regulatory deadlines.
- The Government has committed to act on all of the recommendations of the Commerce Commission’s market study into personal banking services, including the recommendation that efforts be taken to ensure that open banking be fully operational by June 2026 (and that the Government supports this by becoming an early adopter).
- The Finance Minister’s exhortations to the Reserve Bank, including in her November 2024 Letter of Expectations, that it facilitate a more competitive banking sector and the recent comment by the Minister of Commerce and Consumer Affairs that New Zealand is currently placed at a “competitive disadvantage by not keeping pace with transformative technologies, including crypto, blockchain and open banking”. (FinTechNZ Hui Taumata 2025).
- The Finance and Expenditure Committee’s Inquiry into banking competition continues under an extended timeframe.
Chapman Tripp comments
The Royal Assent to the legislation came amidst a flurry of activity in the banking and financial services sector – including the Reserve Bank’s announcements of a new capital review and broadening payment system access, the commencement of the Conduct of Financial Institutions (CoFI) requirements, a trio of financial services reform Bills, and the anticipated appointment of a temporary Reserve Bank Governor for the next six months.
Chapman Tripp will continue to monitor developments in this area. Should you wish to discuss the impact of these changes on your business, please contact one of our experts.
