Illion Bank Statements: A Broker Workflow Guide

Illion Bank Statements collects a client’s bank transaction evidence with their authorisation and sends it to the requesting broker or lender. A completed request still needs a broker’s review of the accounts and statement period before the evidence supports an application.

Confirm the Current Service

The Australian BankStatements service still uses illion branding, while Experian now owns illion. Experian announced the completed acquisition on 1 October 2024, and its current website links to BankStatements. The May 2025 end-user terms identify illion Open Data Solutions Pty Ltd as the entity accessing the client’s account information.

The wider illion brand covers services beyond statement collection. A bankstatements.com.au request is specifically about collecting account information for the business that sent the link. It isn’t a consumer credit report or a lender approval.

Experian’s Open Data Solutions page describes digital data capture, PDF statement conversion and open banking access. PDF conversion uses optical character recognition (OCR) to read the statement’s text. These are different collection methods, and the request your brokerage configures determines which the client uses.

The BankStatements integration guide documents a hosted referral link, an embedded form and an application programming interface (API) integration. A connection through an API doesn’t by itself establish that the collection uses open banking.

For BankStatements enquiries, use the official contact page or call 13 23 33 and select 2, then 2. Clients obtain their submission link from the broker or lender requesting the statements. Use that request to identify the intended recipient before the client authorises access.

Explain the Client Request

Explain which accounts and statement period you need before sending the client your brokerage’s referral link. Tell them who receives the information and whether the request is a single retrieval or ongoing access.

A credential-based collection requires the client to supply their online banking login details through the collection flow. The client authorises illion to access and share account information under the end-user terms. Account information can include account ownership details, balances and transaction records.

Open banking uses a separate Consumer Data Right (CDR) consent process. Experian’s CDR policy describes nominated recipients and a dashboard for managing consent. Don’t describe a credential-based request as CDR data sharing merely because the same provider supports both methods.

Before sending a request, complete these steps:

1. List the accounts required for the file, including any joint accounts and accounts used for loan repayments.
2. Set the required statement period from the receiving lender’s evidence requirements. Give the client actual start and end dates.
3. Explain the collection method and intended use. For joint accounts, the end-user terms require authority from the other account holders.
4. Send the brokerage’s correct referral link. Ask the client to complete the authorisation themselves and keep their banking password out of your email and file notes.

If the client declines, arrange bank-issued PDF statements through your brokerage’s approved secure document channel. Use the receiving lender’s accepted evidence format and obtain the same required accounts and period. A refusal to share banking credentials doesn’t remove the need to provide evidence for the application.

Review the Returned Report

Review illion Bank Statements against the evidence your file requires, even when the client sees a successful connection message. Successful access proves that a connection worked for the submitted accounts. It doesn’t prove that every required account or transaction period arrived.

The provider’s integration documentation has a current institution-list function and examples for Commonwealth Bank. For a Commonwealth Bank request, use the bank selection available in the actual collection flow. A bank name in an example isn’t a guarantee that every account type or historical period is available.

Use the report to complete four checks:

• Match the account holder and account identifiers to the client and the accounts requested.
• Compare each account’s returned period with the dates needed for the file. Record any gap at the beginning or end.
• Reconcile the returned accounts with the client’s declared assets, debts and payment accounts.
• Read the transactions behind the categories. Investigate transfers, refunds and unclear descriptions before treating them as income or spending.

A Successful Connection With a Missing Account

In this fictional file, a broker requests January to March statements for a salary account and a credit card. The client completes the connection, but the return contains only the salary account. Its transactions include payments to the missing card.

The salary account covers the requested period. The credit card remains missing, so the broker can’t review the purchases behind those repayments. Counting the repayment as spending and later counting the card purchases again would also overstate expenses.

Record the missing card as an outstanding document and obtain its January to March statements through the approved collection or manual route. Then reconcile payments between the accounts before completing the expense review. The integration guide expressly allows a submission to proceed with a warning when a specified required account isn’t found.

BankStatements advertises a living-expense report with its Responsible Lending Plus plan. Treat categories as a starting point for your assessment, because an account record can’t explain every transaction’s purpose. Use bank statement analysis for interpretation and reconciliation.

When a connection fails or the expected report doesn’t arrive, follow the illion Bank Statements troubleshooting guide.

Assess Data Handling

Whether illion Bank Statements is safe depends on the collection method and how the recipient handles the returned data. The genuine bankstatements.com.au service has published security controls and terms. A familiar brand name on a message doesn’t establish that the message or link is genuine.

The BankStatements security page states that transmitted data is encrypted and its servers are in Australian data centres. It describes discarding banking credentials after a one-time retrieval. These are provider statements about controls, not a guarantee against every security incident.

The May 2025 end-user terms distinguish single-use and ongoing authorisation. Single-use credentials are destroyed after use. For ongoing access, the terms allow encrypted credential storage and repeated retrieval until the authorisation is suspended or terminated.

Explain the actual authorisation instead of promising every service never stores credentials.

The terms also make the client responsible for complying with their bank account terms. Provider encryption doesn’t settle the bank’s rules about giving a third party access. The broker has separate responsibilities for the statements after receipt, including access restrictions and secure storage.

Digital Collection and Manual Statements

Digital collection sends information through the configured service with the client’s authorisation. Its useful checks are the recipient, access scope and returned accounts. CDR consent has its own management process, while credential-based collection follows the applicable end-user authorisation.

Manual collection lets the client download bank-issued statements without supplying credentials to the collection service. Send those files through the approved secure channel and restrict access in the brokerage. The documents still contain personal financial information, and forwarding them by ordinary email can create extra copies.

Neither route guarantees an authentic, complete file or correct expense classifications. Review account ownership and the statement period, then investigate inconsistencies in the transactions. Keep the consent record and the reconciled evidence with the application before relying on the report.