Open Banking for Home Loan Applications 2026

Open banking lets a borrower share selected bank data for a home-loan application through the Australian Consumer Data Right (CDR). The borrower gives permission, the collection service retrieves the data and the broker checks it before using it in the file. A connection confirms access to data, not approval for a loan.

For brokers, the benefit is less manual collection and a clearer view of accounts held at different institutions. That benefit depends on the accounts and history actually returned. Automated income and expense categories still need reconciliation against the borrower’s circumstances.

How Open Banking Supports a Home Loan

Open banking supplies consented account and transaction data that a broker can use to examine income, spending and existing debts. The bank holding the account is the data holder. An accredited data recipient receives the data, sometimes through a service that operates under a representative arrangement.

The collection process follows this order.

1. The broker sends the borrower the brokerage’s approved collection-service invitation. The service explains the application purpose and requests permission for the data it needs.
2. The borrower selects the institution and reviews the requested data and access period. The bank authenticates the borrower and presents eligible accounts for authorisation.
3. The bank shares the authorised data through an application programming interface (API). An API is the defined way two systems request and exchange information.
4. The collection software puts the returned data into a consistent format. It can add merchant information or proposed transaction categories and combine selected accounts in one report.
5. The broker checks the report against the borrower interview and supporting documents. Only the reconciled amounts and relevant evidence enter the application file.

Open banking account aggregation means bringing data from several selected accounts together. A bank account aggregator can sit between the bank and the broker’s collection software. The intermediary’s name can therefore differ from the name on the broker’s invitation.

Basiq is one Australian example. Its API documentation describes consented account access and transaction categorisation, with income and expense insights. Those functions explain the collection chain, without making Basiq a lender or turning an automated category into verified income.

An open banking API integration is configured by the software provider or its implementation team. Brokers use the resulting consent and review workflow. Public product APIs publish information about banking products, while access to a borrower’s account data requires the relevant consent and authorisation.

Evidence route	What arrives	What the broker still needs to establish
Open banking	Machine-readable data from authorised accounts	Ownership, completeness and how the figures apply to the borrower
Uploaded statements	Bank-issued documents for the periods supplied	Authenticity, coverage and the meaning of transactions
Screen scraping	Data collected using access to an online banking interface	The collection method and its security and permission implications
A lender’s own account records	Information the lender already holds about its customer	Whether other accounts or evidence are needed for this application

CDR sharing doesn’t require the borrower to give an internet banking password to the broker or collection service. Screen scraping is a different method. Commonwealth Bank of Australia (CBA), as at October 2026, explains that distinction in its open banking guidance.

The lender makes the final credit decision using its lending criteria and the whole application. Neither a successful connection nor an affordability report settles that decision.

Consent, Accounts and Data Coverage

The collection service requests consent for a stated purpose, and the bank separately asks the borrower to authorise sharing. The request must identify the data sought and the period of access. It must also explain who receives the data and how the borrower can stop sharing.

The CDR consent requirements make sharing an active choice. Use the access period shown in the actual consent request, including whether collection is one-off or ongoing. The access period is separate from the historical transaction period requested for the application.

Before authorising access, match the legal entity and any representative principal to the current CDR provider register. Check the status and relationship shown for the service, rather than relying on a logo or a similar trading name. A broker receiving data as a nominated trusted adviser has a different role from an accredited data recipient.

Institution support is only the first coverage check. The borrower also needs an eligible account, the required authority to share it and enough available transaction history. A credit union appearing in the directory doesn’t establish that every collection platform supports its accounts.

These bank examples show why coverage needs account-level checks. The statements describe each bank’s public guidance as at October 2026, not a market-wide rule.

Institution	Documented coverage or access condition	Consequence for the application
ANZ	Its account-eligibility section requires an open, accessible account. Non-individual businesses use Internet Banking for Business and nominated representatives	An ordinary personal login doesn’t establish authority to share a company’s accounts
NAB	Data sharing uses NAB Internet Banking. NAB Connect customers need to register for Internet Banking	An existing NAB Connect login alone doesn’t complete the sharing prerequisites
Westpac	Its business guidance includes eligible accounts closed within the last two years under the business-network sharing arrangement	A closed account isn’t automatically unavailable, but this example doesn’t establish every other bank’s treatment
CBA	Business customers need a data-sharing delegate. Joint-account sharing can be disabled by another holder	Missing accounts can reflect authority or sharing preferences, even when the bank is supported
Virgin Money	Its closed-account FAQ permits sharing for accounts closed less than two years ago when the customer also holds a current open account	A former customer with only closed accounts cannot rely on that route

Joint accounts require the bank’s applicable eligibility and sharing settings. Company or trust accounts need authority for the entity, which can differ from ordinary transaction access. Don’t treat one borrower connecting successfully as proof that all household or business accounts are included.

Compare open banking solutions on the evidence they produce for your files. Ask the provider to show how its software handles these requirements.

• The consent screen identifies the recipient, purpose, requested data and withdrawal method.
• Its Australian institution list includes the banks and credit unions your clients use. The account list identifies supported personal and business accounts.
• Reports identify the selected accounts and returned date range, with missing periods visible.
• Evidence exports preserve transaction details and the broker’s corrections for the intended lender’s document requirements.
• Failed or revoked connections have a clear status and an alternative evidence route.
• The actual participant and representative arrangement matches the current register.

Fiskil’s consumer guidance is another example of an intermediary explaining its role and consent dashboard. A familiar provider name alone doesn’t establish your software’s account coverage. Keep provider procurement separate from reviewing a borrower’s file, including the detailed Basiq assessment.

Broker Review of Income and Expenses

A broker reviews returned open banking data by matching the accounts to the borrower and reconciling the transactions before using totals. Serviceability is the lender’s assessment of whether the borrower can afford repayments. An automated spending total is one input to that assessment.

Start with the account holder’s name and ownership. Resolve a maiden-name difference or a company account before attributing its income to an individual. Record which accounts belong jointly to the applicants and which belong to someone else.

Check the first and last transaction dates against the evidence period required for the file. Review each account separately so an empty period or omitted credit card doesn’t disappear inside a combined household total.

For income, distinguish salary from refunds, gifts and transfers between the borrower’s accounts. Match recurring salary credits to payslips and explain bonuses or irregular payments separately. Business receipts need assessment under the applicable self-employed income rules.

For expenses and debts, reconcile the returned categories with the interview. Identify rent, loan repayments and recurring commitments. Credit-card repayments and the purchases on that card need consistent treatment so the same spending isn’t counted twice.

Hypothetical Transfer and Expense Review

Assume a fictional borrower provides one month of transaction-account data and the matching savings-account data. Their payslip also records $5,000 net salary paid into the transaction account. This simplified example demonstrates reconciliation, not a complete serviceability calculation.

Transaction	Automated category	Broker’s review	Treatment in the reviewed file
$5,000 credit from the employer	Income	Employer and payslip match	Record salary evidence, subject to the lender’s income treatment
$1,000 credit from the borrower’s savings account	Other income	The savings account shows the matching $1,000 debit	Mark as an internal transfer and exclude it from new income
$250 supermarket debit	Groceries	Borrower identifies $50 cash withdrawn at checkout	Record $200 groceries and investigate the $50 cash use separately
$600 credit-card repayment	Debt repayment	Card purchases are being reviewed from separate card data	Reconcile the card commitment and avoid counting the repayment again as the same living expenses

The automated credits total $6,000, but the evidenced new salary credit is $5,000. The transfer changes where the borrower holds money, without creating another $1,000 of income. The $50 cash component remains unresolved spending until the broker establishes its use.

Keep the original transaction description beside each correction and the explanation supporting it. A disputed category needs an evidence-based correction, not a change made to improve the borrowing figure. The bank statement analysis guide covers the wider review.

Once the amounts are reconciled, assess them under the chosen lender’s rules. Bulma’s Policy Advisor quotes lender policy wording that a broker can retain beside the file notes. That policy evidence supports the income-treatment decision, while the transaction review establishes what actually happened.

Privacy, Revocation and Evidence

Borrowers can review their sharing arrangements and withdraw permission through the relevant dashboards. The bank’s dashboard controls authorisation to share data. The recipient’s dashboard manages consent for collecting and using the data.

The Office of the Australian Information Commissioner (OAIC) explains those roles in its consent and dashboard guidance. To reduce the accounts or data being shared, use the service’s consent-management process and approve any corresponding bank authorisation change.

CBA’s dashboard, as at October 2026, shows current and previous shares in its app, NetBank or CommBiz. Customers can select Stop sharing for an arrangement.

Under ANZ’s guidance as at October 2026, borrowers can stop through its digital banking channels or the recipient. ANZ also directs borrowers to make their deletion choice before stopping the arrangement.

Stopping new collection doesn’t itself establish that every retained copy has been deleted. Review the recipient’s use consent and its deletion or de-identification options separately. The CDR privacy rights require destruction or de-identification when data is no longer needed or on request, subject to exceptions.

Fiskil says its consent dashboard lets consumers view linked accounts, identify the requesting company and manage or revoke consent. Its consumer guidance describes that control, without establishing the retention rules for every application using Fiskil.

A mortgage broker can receive data through the trusted-adviser route when the borrower nominates the broker and consents to disclosure. The OAIC’s trusted-adviser guidance explains that this doesn’t make the broker a CDR participant. CDR safeguards cease to apply to data disclosed to a trusted adviser who isn’t also accredited.

The brokerage’s applicable privacy and professional obligations still matter. For entities covered by the Australian Privacy Principles (APPs), APP 11 requires protection of held information and destruction or de-identification when it’s no longer needed. Exceptions include retention required by Australian law or a court or tribunal order, as the OAIC’s APP 11 guidance explains.

Keep the records needed to show how the application evidence was obtained and reviewed.

• Record the consent or disclosure reference, purpose, parties involved and access dates.
• Identify selected accounts, returned periods and the collection date.
• Retain the evidence used in the assessment, including corrections and supporting explanations.
• Record missing evidence, the alternative collection method and any subsequent withdrawal or correction request.

Restrict access to staff handling the file. Apply the brokerage’s documented retention schedule to each record under its applicable obligations. Don’t promise that withdrawing a bank connection erases the application file or impose one retention period on every kind of record.

When Open Banking Does Not Work

When a connection fails or returns incomplete data, collect the specific missing evidence through another accepted route. Keep an account-and-period checklist so a connection retry doesn’t trigger another request for documents already held.

1. Identify the missing account and date range. For an unsupported account, obtain bank-issued statements or an accepted transaction export.
2. For authentication or connection errors, check the borrower’s registered contact details and sharing authority. Record the error and follow the bank’s or collection service’s support process before retrying.
3. For incomplete history, identify the exact date gap. Obtain statements or exports covering that gap, with account identity visible and enough overlap to reconcile continuity.
4. Resolve mismatched names or ownership before using the data. Obtain the relevant account or entity evidence and keep the explanation with the file.
5. If consent has expired or been withdrawn, stop attempts to collect under that permission. Offer statement collection, or a fresh voluntary consent if the borrower wants to reconnect.
6. For disputed categorisation, retain the source transaction and establish its purpose. Correct the report with a reason, then recalculate affected totals.

A PDF statement can still be required where the lender needs bank-issued evidence or a particular statement period. A transaction export can fill a gap when its identity, contents and format meet the lender’s requirements. Open banking doesn’t make an account’s missing ownership evidence or an unexplained credit disappear.

Before sending a new request, compare the evidence already held with the lender’s requirement. Ask only for the missing account, period or supporting explanation. Use the document collection workflow to track the request and close it when the file has complete, reconciled evidence.