Customer and Product Data Act 2025: Banking designation and general requirements regulations released

New regulations ("CDR Regulations") have now been released under the Customer and Product Data Act 2025 ("Act"), providing clarity on the scope of the Consumer Data Right ("CDR") framework in New Zealand, as well as other important aspects such as phasing of implementation in the banking sector and fees and charges.  

The CDR Regulations have been released as four separate sets, including three of general application to all sectors designated in-scope of the CDR; and one which is specific to the banking sector.  

Most of the provisions of the CDR Regulations are to commence on 1 December 2025, with some aspects being phased in later (as further described below). 

For more background on the CDR, please see our previous insights available here.

Banking Regulations

The Customer and Product Data (Designations for Banking and Other Deposit Taking) Regulations 2025 ("Banking Regulations") outline key provisions relating to the designation of the banking sector within scope of the CDR regime. Key points to note in the Banking Regulations include:

• Designated banks: ANZ, ASB, BNZ and Westpac are designated from 1 December 2025. Kiwibank is designated from 1 June 2026, and other licensed deposit takers may opt in from 1 December 2025 by giving notice that it opts in. 
• Staged implementation: A staged approach to implementation will apply. Although Kiwibank is designated from 1 June 2026, this is only for payments. Kiwibank customer data is out of scope until 1 December 2026. There are some other areas which are being phased in over time for the other banks also.¹    
• Fees and levies: The Banking Regulations do not allow the banks to charge customers or accredited requestors any fees or levies to use the CDR scheme. However, an application fee and levies are payable for businesses applying to become an accredited requestor (and upon renewing their accreditation) – further details are set out under the Fees Regulations and the Levies Regulations below.
• Limited to accredited requestor requests: Initially, banks are not required to provide designated data to, or to perform designated actions for, customers directly. The Banking Regulations only bring into force the Act's provisions requiring these activities for third party accredited requestors on the relevant customer's behalf.  
• Scope of designated data: Banks are required to provide "designated data" held in a "relevant account" to an accredited requestor. 

"Designated data" includes various customer information, account identification information, account balance details, transaction data for the last two years and statement data for the last 12 months, plus copies of statements. 

A "relevant account" is an active NZD-denominated account which is accessible via an electronic facility and one of the in-scope account types.

• Scope of designated actions: The Banking Regulations also designate the action of making a payment from a customer’s account on an accredited requestor's request to another account.  Payments must be electronic NZD-denominated payments made using the Payments NZ BECS system, be below the relevant limit and not require multiple authorisations.²  

General Regulations

The Customer and Product Data (General Requirements) Regulations 2025 ("General Regulations") set out various requirements under the Act which apply generally to all in-scope sectors. Key points to note include: 

• Consent requirements: Data holders (such as the in-scope banks in the banking sector) must have a system in place to enable a customer to provide and revoke consent, notify the data holder of those consents and revocations, instruct the data holder to perform an action relating to authorising payments or opening / closing an account and agree to changes to account access or account terms and conditions. Accredited requestors must also provide written reminders to customers at least every 12 months about the scope of active authorisations and how to end them.
• Prohibition on charges: Data holders may not charge for providing regulated data services, subject to limited exceptions including for contracted higher performance levels, alternative response methods outside of the data holder's default method, and ordinary account charges for the designated action.
• Ongoing disclosure: Accredited requestors must report details of certain matters to the chief executive of MBIE, including where the accredited requestor is the subject of actual or likely insolvency, certain board or senior management changes, restructuring, major transactions, changes of control, or changes to any contract of insurance or other liability cover.
• Liability cover: Applicants must have either a contract of insurance, a contract of guarantee or an arrangement to self-insure in place which provides a reasonable level of cover for the liability of the applicant to pay compensation, damages, costs or other amounts to a customer or data holder under a compensatory order under the Act or an award of damages under the Privacy Act.  
• Accreditation process: In addition to the requirements for accredited requestors set out in the Act (including that applicants have adequate security safeguards in place to protect data provided to them and that the senior management are of good character), MBIE is required to assess whether the applicant's liability cover is adequate given the nature and extent of the services provided.
• Intermediaries: In addition to the general accreditation requirements for accredited requestors, applicants seeking accreditation to act as an intermediary (i.e. to make requests relating to a customer on behalf of a third party who is not accredited) must have adequate processes to, among other things, verify the third party's identity and ensure that the third party has adequate processes to safeguard data and transactions, support the intermediary's compliance with the Act, address deception risks, and ensure compliance with the Privacy Act 2020.
• Access timeframes: Within three working days of written request, a data holder must make available to an accredited requestor the technical information required to receive access to the data holder's system. Data holders must give accredited requestors access to data holder systems, and provide all other information reasonably necessary to enable CDR requests to be made, within twenty working days of receiving that technical information.

Fees Regulations

The Customer and Product Data (Fees) Regulations 2025 ("Fees Regulations") set out the fees payable under the Act to apply for accreditation as an accredited requestor and to renew that accreditation. The fees are as follows:

• $2,000 (excluding GST) for a new application, and $1,700 (excluding GST) for a renewal, in respect of a class of accreditation involving acting as an intermediary; and
• $1,500 (excluding GST) for a new application, and $1,000 (excluding GST) for a renewal, in respect of a class of accreditation that does not involve acting as an intermediary.

If an accredited requestor applies or renews (as applicable) in two or more classes, only one amount (at the greater value) is payable. 

Levies Regulations 

The Customer and Product Data (Levies) Regulations 2025 ("Levies Regulations") set out the levies payable by accredited requestors and data holders to fund the cost of the chief executive of MBIE exercising their functions and powers under the Act.

For accredited requestors, the levy is payable annually at the time of accreditation renewal (or for accreditations that are longer than a year, on 20 June in each financial year). The levy is based on the total gross annual revenue of the accredited requestor and its related companies within New Zealand, as follows: 

For data holders the levy is payable on 20 March in each financial year and is based on the data holder's total assets (for in-scope registered banks, as published in their most recent disclosure statement), as follows:  

If a person is an accredited requestor and a data holder, only one amount (the greater value) is payable.

Next steps

Russell McVeagh will continue to monitor for developments and provide further updates in the CDR space. You can join our mailing list to receive updates as they are released. If you would like any advice regarding how the CDR might affect you and organisations in your industry, please do not hesitate to contact us.  

This content is intended only to provide a summary of the subject covered. It does not purport to be comprehensive or to provide legal advice. No person should act in reliance on any statement contained in this publication without first obtaining specific professional advice. If you require any advice or further information on the subject matter, please contact a Russell McVeagh partner/solicitor.