Open banking in New Zealand, explained

For years, connecting a budgeting app to a New Zealand bank account meant handing over your internet banking login to a company that was not your bank, and hoping for the best. That is no longer how it has to work. New Zealand now has an open banking regime written into law, with named banks, dated obligations, and a public register of the businesses allowed to take part.

This guide sets out what changed, when, and what it means in practice. Every date, name and legal reference below comes from the legislation itself or from the organisations involved, and each source is named where it is used so you can check it.

What open banking means

Open banking is a way of letting a business you choose read certain information held about you by your bank, or carry out certain instructions on your account, without you giving that business your banking password. You authorise the access with your bank directly. Your bank then provides the data, or performs the action, to the business you named.

The important word is authorise. Under the New Zealand regime, access exists because you granted it, it has to be confirmed, you have to be able to control it, and you can end it.

What the Customer and Product Data Act 2025 does

The Customer and Product Data Act 2025 (2025 No 14) is the law that creates the regime. Section 2 says it came into force on 30 March 2025.

Section 3 states the purpose: to realise the value of certain data for the benefit of customers and society, to promote competition and innovation for the long-term benefit of customers, and to facilitate secure, standardised and efficient data services in certain sectors. It does that by improving your ability, and the ability of third parties you authorise, to access data held about you, and by requiring safeguards, controls, standards and functionality around that access.

The Act is a framework rather than a finished scheme. It does not apply to anyone until regulations designate them. Section 6 defines a data holder as a business named, or in a class named, in designation regulations. Section 7 defines an accredited requestor. Sections 15 and 19 then set the core obligations: where a customer's authorisation is confirmed, the data holder must provide that customer's designated data to the accredited requestor, and must perform designated actions on request.

Which banks are covered, and from when

Banking was brought in by the Customer and Product Data (Designations for Banking and Other Deposit Taking) Regulations 2025. Regulation 2 says they came into force on 1 December 2025, with one exception: regulation 6(1)(d), the provision relating to Kiwibank Limited, commenced on 1 June 2026.

Regulation 6 designates ANZ Bank New Zealand Limited, ASB Bank Limited, Bank of New Zealand, Kiwibank Limited and Westpac New Zealand Limited. It also lets any other deposit taker opt in by giving notice to the chief executive, so the list can grow without new regulations.

Everything outside that list sits outside the regulated system for now. Smaller banks and other deposit takers have no obligation unless they opt in. If you bank with one of them, an app can still connect, but it is doing so by another method, which is covered further down.

What accreditation actually means

Accreditation is a legal status granted by a person, not a badge a company awards itself. Under section 112 of the Act, the chief executive may accredit an applicant only if satisfied that the applicant has adequate security safeguards for the data it will receive, is capable of effectively complying with its obligations with no reason to believe it is likely to contravene them, and that its directors and senior managers are of good character. Where section 49 applies, the applicant must also be a member of a dispute resolution scheme.

Accreditation can be granted in part, with terms and conditions attached, and sections 116 to 118 provide for its duration, renewal, suspension and cancellation. Regulation 9 of the banking regulations sets four classes: making data requests, making payment requests, and doing either of those as an intermediary. So "accredited" is not a single thing. It comes with a scope.

Sections 121 to 127 establish a public Register of Participants, kept by the chief executive, listing each data holder and accredited requestor, their New Zealand Business Number, the classes of accreditation held, and how customers can complain or make contact. Section 61 makes it unlawful to hold out that you, or anyone else, are an accredited requestor when that is not the case.

What the regulated system replaced

Before designation, most account connections in New Zealand were unregulated. Akahu describes its non-regulated route, which it calls a classic connection, as being facilitated by Akahu logging in as the customer in order to fetch data or initiate a payment on the customer's instructions. That method still exists for banks and providers outside the regulated system.

Akahu sets out three differences it sees in the regulated system: the customer authenticates directly with their bank rather than entering login credentials into a third party service, accredited requestors have certainty over access to bank APIs rather than each bank deciding who is allowed in, and terms of access are governed by the regulation rather than by a custom contract with each bank. The first of those is the one most people care about, because it removes the moment where your password leaves your hands.

The migration is observable rather than theoretical. In its update of 28 May 2026, Akahu said that of 130 organisations and products accredited to use it for open banking connectivity in production, 94 had completed the transition to the regulated system and 32 were actively migrating, with the remaining four waiting on banks to resolve API issues.

What an open banking payment can and cannot be

Reading data is one half of the regime. The other half is designated actions, and in banking there is currently one. Regulation 8 designates making a payment from the customer's account to another account, where the payment is made over the Bulk Electronic Clearing System operated by Payments NZ Limited, is in New Zealand currency, does not exceed the relevant limit, and does not require the authorisation of two or more people.

The relevant limit can come from the bank's own limits, from a limit the bank publishes, from a limit you have instructed your bank to impose, or from one agreed between the bank and the accredited requestor. Regulation 8 also excludes section 18 of the Act from its scope, so the designation covers requests made by an accredited requestor on your authorisation rather than a direct customer-initiated action.

That narrowness is a feature. An app operating inside this designation is not moving money on card rails, not sending funds overseas, and not bypassing the payment limits that already apply to your account.

Who runs the regime

The Act is administered by the Ministry of Business, Innovation and Employment, which is recorded as the administering agency on the legislation itself and on the banking designation regulations. Throughout the Act the decisions sit with "the chief executive", defined in section 5 as the chief executive of that ministry. The chief executive decides accreditation, keeps the register, can require a data holder to test its electronic system, can require information or documents, and can issue infringement notices under section 63.

Beyond that, the Act provides civil liability remedies through the courts, including pecuniary penalty orders, declarations of contravention, compensatory orders and injunctions. Section 128 allows the chief executive to share information with agencies including the Commerce Commission, the Privacy Commissioner and the Department of Internal Affairs, which is an information-sharing provision rather than a transfer of enforcement.

Standards management is also moving. On 21 August 2026 Payments NZ announced that its API Centre, which had developed open banking API standards since 2019, will cease operating at the end of September 2026, with responsibility for open banking standards management transferring fully to MBIE from that date. In the same announcement, Payments NZ reported that in July 2026 more than 401,000 open banking payments were completed by its standards user ecosystem, with transaction values exceeding $130 million, and more than 221,000 customers authorising at least one payment or data-sharing consent during the month. Those figures describe that ecosystem's activity, not the whole market.

What this means for an app like PayDay

PayDay splits your pay across your accounts soon after it lands. To do that it needs two things: to see the transaction that tells it you have been paid, and to make the transfers you set out in a split rule. Both of those map onto the regime above. Reading transactions is a data request. Each transfer sits inside the designated payment action, a New Zealand dollar payment over the Bulk Electronic Clearing System, within your account's limits.

What PayDay cannot do follows from the same structure. It cannot send money to an account you have not nominated, it never sees or stores your internet banking password, and you can revoke access at any time. That is set out on our security feature page and in more depth on security.

What is not settled yet

Plenty is still open, and it is worth being clear about what has not been established rather than guessing. Coverage beyond the five designated banks depends on deposit takers opting in. The temporary definitions in Schedule 1 mean the scope of designated data is still narrower than it will be after the dates above. Akahu has published submissions during 2026 on business account coverage, delegation systems and trust accounts, and payment liability and risk allocation, which indicates those questions were still under consultation, not that any outcome has been decided.

It is also worth noting that we could not load MBIE's own web pages, including the Register of Participants, at the time of writing, because the site refused automated requests. The statements above about Akahu's accredited status come from Akahu. The register is the authoritative place to confirm any provider's accreditation, and it is the right place to check before you connect anything.

The bottom line

Open banking in New Zealand stopped being an industry arrangement and became a legal one. There is an Act, in force since 30 March 2025. There are regulations naming five banks, in force since 1 December 2025, with Kiwibank's provision from 1 June 2026. There is an accreditation test with real criteria, a public register, and a prohibition on pretending you are on it.

For you, the practical effect is simple. You can let an app do useful work with your accounts without handing over your banking password, and you can take that permission back whenever you want.