The Consumer Data Right (CDR) is Australian federal law that gives you control over your banking data. Meridian uses it to deliver read-only bank feeds without ever seeing your password or storing your financial records in the cloud.
Open Banking in Australia is not a proprietary startup feature. It is federal law under the Treasury Laws Amendment (Consumer Data Right) Act 2019, which amended the Competition and Consumer Act 2010. Australian banks must share customer data securely when you instruct them to.
The system is co-regulated by the ACCC (Australian Competition & Consumer Commission), which manages the CDR Register and compliance, and the OAIC (Office of the Australian Information Commissioner), which enforces 13 CDR Privacy Safeguards.
Access is consent-driven. You decide which bank accounts to share, what data can be read, and for how long (12 months at most). You can withdraw access at any time.
You choose your Australian bank inside Meridian. The app prepares a signed authorisation request to our ACCC-accredited data partner.
You are sent to your bank's own secure login. You sign in with your bank password and your bank's SMS or app code. Meridian never sees your credentials.
Your bank issues a scoped, read-only access token to Fiskil, our accredited CDR partner. Your transactions are retrieved through the standard Australian CDR APIs.
Transactions arrive in the local encrypted vault on your device. Meridian’s relay in Sydney passes data through in memory and never stores your financial records.
CDR safeguard. Meridian never stores bank passwords and never uses payment initiation APIs.
| Dimension | Screen Scraping (older apps) | Consumer Data Right (Meridian) |
|---|---|---|
| How you sign in | You give your banking username and password to a third-party company. Automated bots log in as you. | ✓ You sign in on your bank's own website using OAuth 2.0. No third party ever sees your password. |
| Bank terms and the ePayments Code | Sharing your password can breach your bank's terms and put your protections under ASIC's ePayments Code at risk. | ✓ Built on a framework the banks support, under Australian law. |
| What can be accessed | The bot can see everything visible when you log in, including loans, addresses and messages. | ✓ Scoped. You approve only specific accounts and specific read-only data. |
| Payments | Because credentials are shared, a compromised scraper could in theory start transfers. | ✓ Read-only APIs. No ability to move funds, start payments or change balances. |
| Stopping access | You usually have to change your internet banking password to stop scraper access. | ✓ Withdraw consent in Meridian or in your bank's own app. |
| Regulation | Not covered by the CDR’s Privacy Safeguards. | ✓ Enforced by the ACCC and OAIC under the CDR Privacy Safeguards. |
ASIC ePayments Code. Under ASIC's ePayments Code and Australian banking contracts, account holders must never disclose their passcodes, passwords or telephone banking PINs to third parties. Handing your credentials to a screen-scraping app puts your protections against unauthorised transactions at risk. Regulated Open Banking avoids this by using direct, tokenised OAuth sign-in.
Meridian requests read-only statement scopes (transaction dates, descriptions, balances and amounts). We never request or build payment initiation, so Meridian cannot move your money.
Incoming feeds are saved straight into the encrypted SQLite vault on your device, not on our servers.
Under Australian CDR rules, no consent can last longer than 12 months. Meridian alerts you before it expires so you can re-authorise in one step. Consents never renew without your permission.
Meridian connects to Australian banks under the CDR Representative model, in partnership with an ACCC-accredited data recipient.
Connecting to Australian banks under the Consumer Data Right is not something an individual can do. It takes a partnership with an accredited data recipient, ongoing compliance with the CDR rules and standards, secure infrastructure to carry the data, and continuing work as each bank updates its systems.
Meridian does that work for you, so your transactions arrive in your vault without bank logins to juggle, statements to download or scripts to maintain.
The Government’s consumer hub explaining how Open Banking works, your rights and the security standards.
Visit cdr.gov.auACCC public registerSearch the official register of accredited data recipients under Australian law.
Search the registerOAIC privacy guidelinesThe Information Commissioner's guide to the 13 privacy safeguards that govern consumer data.
View the safeguardsFederal legislationThe Act of Parliament that established the Consumer Data Right in Australia.
Read the ActUse read-only Open Banking feeds or offline CSV imports.