Consultation on exposure draft amendment Open Banking regulations relating to business banking digital channels

Background

The Customer and Product Data (Designations for Banking and Other Deposit Taking) Regulations 2025(external link) — New Zealand Legislation

The Customer and Product Data (General Requirements) Regulations 2025(external link) — New Zealand Legislation

The Customer and Product Data Act 2025(external link) — New Zealand Legislation

Together, this legislation enables regulated open banking.

The banking designation regulations currently require designated banks (‘data holders’ in the regulations) to provide regulated data services only for accounts that customers can access for online banking via banks’ main mobile or website digital channels (‘electronic facilities’ in the regulations). Designated banks also operate additional digital channels such as those used primarily by their business customers. When the regulations were created in 2025, the Government noted that it would work with industry to develop a policy position on the timing and scope for including the remaining digital channels in the regime, and provided six months for this work to take place.

In March 2026 Cabinet agreed to a pathway for including these additional digital channels in the open banking regime, as set out in this Cabinet paper, Cabinet minute, press release and factsheet.

Open Banking to power business growth(external link) — Beehive.govt.nz

Next phase of regulated open banking: Factsheet [43.7KB](external link) — Beehive.govt.nz

Cabinet decided that from 1 June 2027, designated banks will be required to provide open banking for the relevant accounts of all customers, regardless of the digital channel those accounts are accessed by, unless:

• The accounts can only be accessed through a channel that is scheduled to be decommissioned by 1 June 2028, or
• The customer is a large entity.

Overview of draft amendment regulations

The draft amendment regulations give effect to these decisions by:

• Changing the expiry date for the transitional provisions regarding the definition of ‘electronic facility’ from 1 June 2026 to 1 June 2027. The original date was set to allow time for development of a policy position.
• Excluding Westpac’s Business Online digital channel from the definition of electronic facility for the period 1 June 2027 to 1 June 2028, as it is being decommissioned.
• Excluding ‘accounts held by large entities’ from the definition of relevant accounts, and excluding ‘payments from large entities’ from the definition of designated payments.

What we are seeking feedback on

We are particularly interested in feedback on the following components:

1. Our approach to determining whether a digital channel is being decommissioned.
2. Our definition of large entity.
3. Our approach towards Regulation 6 of the General Requirements regulations.
4. The impact on Māori customers and alignment with te ao Māori approaches to data.

Approach to determining whether a digital channel is being decommissioned

We consider a digital channel to be ‘decommissioned’ if it is no longer technically operational for relevant accounts and designated payments by 1 June 2028 at the latest.

Factors we have taken into consideration when assessing whether a digital channel should be excluded on this basis include:

• Whether migration and decommission has already been publicly communicated and/or is already underway.
• Level of certainty expressed by the bank that decommissioning would be completed by 1 June 2028.

We want to hear from you:

• Are there any additional or different factors that should be considered?

Definition of large entity

The exposure draft amendment regulations include a definition of ‘large entity’ that generally aligns with the definition in the Financial Reporting Act 2013, but with some modifications to ensure the policy can be implemented with respect to a) entities that fluctuate between meeting the ‘large entity’ definition between years, and b) new entities.

We want to hear from you:

• Are the provisions for recognition of new organisations likely to work in practice?
• To what extent does the proposed ‘large entity’ threshold capture customer segments that are likely to benefit from regulated open banking, while excluding those that are unlikely to benefit?

Regulation 6 of the General Requirements regulations

The general requirements regulations include a provision at Regulation 6 that requires data holders to have a system in place that enables customers to approve an individual to act on the customer’s behalf to authorise data sharing and payments through regulated open banking. This regulation will commence on 1 June 2026.

Some stakeholders have suggested the commencement date for this regulation should be extended to 1 June 2027, to match the new date that the transitional provisions relating to the definition of ‘electronic facility’ expire.

We want to hear from you:

• How likely is it that customers on banks’ main digital channels (including household and/or entity customers) will use a system as set out in Regulation 6 between 1 June 2026 and 1 June 2027?
• For what purposes would they use this system?
• What would be the impact on these customers of changing the commencement date?

Impact on Māori customers and alignment with te ao Māori approaches to data

We want to hear from you:

• Will any aspect of the draft amendment regulations particularly affect Māori customers, including Māori organisations?
• How could the draft amendment regulations reflect, support, or better incorporate te ao Māori approaches to data?