CBA has entered an Administrative Resolution (AR) with the Australian Competition and Consumer Commission (ACCC) and has paid $792,000 in penalties for alleged contraventions of the Consumer Data Right (CDR) Rules.
CBA identified and voluntarily reported this issue to the ACCC and has cooperated with the ACCC’s investigation.
The investigation related to a failure to enable a subset of CBA accounts for data sharing. When CBA enabled data sharing for business accounts via the CDR in November 2021, some account types were not enabled. As a result, some customers may have been unable to share certain data with accredited recipients, and their providers.
CBA accepts the findings of the ACCC’s investigation into CBA’s compliance with its CDR obligations, and we apologise to our customers affected by this issue.
CBA will be contacting customers who attempted to share their data but were unable to do so, to let those customers know that they may be eligible to participate in a remediation. We will contact these customers starting from the week commencing 19 January 2026 to provide more information about the remediation program and will also publish further details on our website.
CBA is continuing to review and strengthen its systems, processes and controls to support ongoing compliance with its CDR obligations.
