Customer and Product Data (Designations for Banking and Other Deposit Taking) Regulations 2025
Checking for alerts... Loading...
2025/228
Customer and Product Data (Designations for Banking and Other Deposit Taking) Regulations 2025
Cindy Kiro, Governor-General
Order in Council
At Wellington this 13th day of October 2025
Present:
Her Excellency the Governor-General in Council
These regulations are made under section 104 of the Customer and Product Data Act 2025—
(a)
on the advice and with the consent of the Executive Council; and
(b)
on the recommendation of the Minister of Commerce and Consumer Affairs made in accordance with sections 105 and 106 of that Act.
Regulations
1 Title
These regulations are the Customer and Product Data (Designations for Banking and Other Deposit Taking) Regulations 2025.
2 Commencement
(1)
These regulations come into force on 1 December 2025.
(2)
However, regulation 6(1)(d) (which relates to Kiwibank Limited) comes into force on 1 June 2026.
3 Overview
(1)
These regulations—
(a)
designate certain banks and other deposit takers for the purposes of section 6 of the Act (which relates to data holders); and
(b)
designate certain customer data about bank accounts and other accounts as designated customer data; and
(c)
designate making certain payments as designated actions; and
(d)
set the classes of accreditation that may be granted in relation to these regulations.
(2)
See also the Customer and Product Data (General Requirements) Regulations 2025, which prescribe general requirements relating to regulated data services provided under the Act.
(3)
This regulation is only a guide to the general scheme and effect of these regulations and the Customer and Product Data (General Requirements) Regulations 2025.
4 Interpretation
(1)
In these regulations, unless the context otherwise requires,—
Act means the Customer and Product Data Act 2025
acting as an intermediary has the meaning set out in subclauses (2) and (3)
deposit taker means any of the following:
(a)
a registered bank (as defined in section 2(1) of the Banking (Prudential Supervision) Act 1989):
(b)
a licensed NBDT (as defined in section 4(1) of the Non-bank Deposit Takers Act 2013):
(c)
a licensed deposit taker (as defined in section 6 of the Deposit Takers Act 2023)
electronic facility means an internet site or a software application provided by or on behalf of a data holder that gives a customer access, by way of the internet, to data in visual form about the customer’s account on a substantially continuous basis
joint customer has the meaning set out in section 21(5) of the Act
relevant account has the meaning set out in regulation 7(4)
statement, in relation to a relevant account,—
(a)
means a statement that—
(i)
the data holder sends or makes available to the customer; and
(ii)
contains data about the account in relation to a specified period or a specified time; but
(b)
does not include a statement that is generated on the customer’s request.
(2)
An accredited requestor (A) is acting as an intermediary in relation to a request if, under a contract with a person that is not an accredited requestor (B), A provides a service to B under which—
(a)
all of the following apply:
(i)
data provided to A under section 15 of the Act in respect of a customer (C) is provided to B (where C continues to be identifiable in relation to the data); and
(ii)
B and C have a contract under which B provides goods or services to C; and
(iii)
A providing the data to B is reasonably necessary to enable B to provide those goods or services; or
(b)
A facilitates (by way of A making a request under section 19 of the Act) a payment from an account of a customer to—
(i)
B or another person; or
(ii)
A (where A subsequently pays all or part of the amount of the payment to B or another person).
(3)
However, A is not acting as an intermediary under subclause (2)(a) in relation to a request if—
(a)
A makes the request mainly for the purpose of A providing goods or services to C; and
(b)
A’s provision of those goods or services to C is separate from the goods or services that B provides to C.
Example
A makes a request for data to enable A to provide its own service to a customer. Separately from that service, A provides, with the customer’s consent, the data to another business (B) to enable B to also provide a service to the customer. The main reason for the request is A’s own service.
A is not acting as an intermediary in relation to that request.
5 Transitional, savings, and related provisions
The transitional, savings, and related provisions set out in Schedule 1 have effect according to their terms.
Designation of data holders
6 Designated persons: data holders
(1)
The following are designated for the purposes of section 6 of the Act:
(a)
ANZ Bank New Zealand Limited:
(b)
ASB Bank Limited:
(c)
Bank of New Zealand:
(d)
Kiwibank Limited:
(e)
Westpac New Zealand Limited:
(f)
a deposit taker that opts in to being designated for the purposes of section 6 of the Act under subclause (2).
(2)
A deposit taker may opt in by giving the chief executive a notice that it opts in to being designated for the purposes of section 6 of the Act with effect on and after a date specified in the notice.
Designation of data
7 Designated data
(1)
The following classes of customer data are designated as designated customer data for the purposes of all of the provisions of the Act except section 14:
(a)
the following data about the customer for a relevant account:
(i)
the customer’s name:
(ii)
data about whether the customer is a joint customer:
(iii)
the customer’s contact details (for example, the customer’s email address, phone number, and postal address):
(b)
data that identifies a relevant account, including any of the following that are applicable:
(i)
the account’s identification codes (for example, an account number):
(ii)
the name of the account assigned by the data holder:
(iii)
the name of the account assigned by the customer through an electronic facility:
(iv)
the currency in which the account is denominated:
(v)
the type of account (for example, a personal savings account or business transaction account):
(c)
the following data about the balance of a relevant account:
(i)
the amount of the balance:
(ii)
whether the balance is in credit or debit:
(iii)
the type of balance:
Examples
Available balance.
End of day balance.
(iv)
the date and time of the balance:
(v)
if the account relates to a revolving credit contract (as defined in section 5 of the Credit Contracts and Consumer Finance Act 2003), the remaining amount of credit available to the customer under the contract:
(d)
particulars of each transaction for a relevant account that occurred during the 2-year period before the time of the request under section 15 of the Act:
Examples
Data about the time, amount, status, and currency of the transaction.
Data about the parties to the transaction.
Data about the accounts involved.
Unique identifiers and codes.
(e)
the following data contained in any statement for a relevant account that the data holder has sent or made available to the customer during the 12-month period before the time of the request under section 15 of the Act:
(i)
the statement’s type (for example, an account opening statement or an annual statement):
(ii)
the opening and closing dates and times of the period covered by the statement:
(iii)
the date and time at which the statement is first sent or otherwise made available to the customer:
(f)
a copy of a statement referred to in paragraph (e).
(2)
If the relevant account relates to 2 or more joint customers, the data under subclause (1)(a) is only for the customer who gave the authorisation (or on whose behalf the authorisation was given).
(3)
The particulars under subclause (1)(d) do not include any data that the data holder reasonably believes—
(a)
is commercially sensitive to the data holder; and
(b)
would not ordinarily be available to the customer on request in the course of the data holder’s business.
(4)
An account is a relevant account if—
(a)
it is any of the following:
(i)
the account for a call debt security:
Examples
A transactional account or an on-call savings account.
(ii)
the account for a call building society share:
(iii)
the account for a call credit union share:
(iv)
the account for a credit union savings account product:
(v)
the account for a credit contract (as defined in section 7 of the Credit Contracts and Consumer Finance Act 2003); and
(b)
the account is denominated in New Zealand currency; and
(c)
the customer for the account has access to certain data about the account through an electronic facility; and
(d)
the account is not closed.
(5)
In this regulation, call debt security, call building society share, call credit union share, and credit union savings account product have the same meanings as in regulation 5(1) of the Financial Markets Conduct Regulations 2014.
Designation of actions
8 Designated actions
(1)
The class of action specified in subclause (2) is designated as a designated action for the purposes of all of the provisions of the Act except section 18.
(2)
The class of action is making a payment from the customer’s account to another account if—
(a)
the payment is made by means of the Bulk Electronic Clearing System operated by Payments NZ Limited; and
(b)
the payment is made in New Zealand currency; and
(c)
the amount of the payment does not exceed the relevant limit; and
(d)
the payment does not require the authorisation of 2 or more persons; and
(e)
a payment may be made from the customer’s account through an electronic facility otherwise than under the Act.
(3)
In this regulation, relevant limit means,—
(a)
unless a lower limit applies under paragraph (b), the greater of the following:
(i)
a limit (if any) that the data holder imposes in relation to a payment where the payment is made through an electronic facility otherwise than under the Act:
(ii)
a limit (if any) set by the data holder by a notice published on an internet site maintained by or on behalf of the data holder; or
(b)
the lesser of the following:
(i)
a limit (if any) for payments made under section 19 of the Act that the customer has instructed the data holder to impose:
(ii)
a limit (if any) agreed between the data holder and the accredited requestor.
Classes of accreditation
9 Classes of accreditation
Each of the following is a class of accreditation that may be granted in relation to these regulations:
(a)
making requests under section 15 of the Act (other than when acting as an intermediary):
(b)
making requests under section 19 of the Act (other than when acting as an intermediary):
(c)
acting as an intermediary to make requests under section 15 of the Act:
(d)
acting as an intermediary to make requests under section 19 of the Act.
Schedule 1 Transitional, savings, and related provisions
Part 1 Provisions relating to these regulations as made
1 Designated customer data does not include Kiwibank Limited data until 1 December 2026
(1)
The classes of customer data that are designated under regulation 7 do not include any data held by or on behalf of Kiwibank Limited.
(2)
This clause ceases to apply on 1 December 2026.
2 Temporary modified definition of electronic facility in relation to certain banks
(1)
This clause applies to ANZ Bank New Zealand Limited, ASB Bank Limited, Bank of New Zealand, and Westpac New Zealand Limited.
(2)
For the purposes of these regulations and the Customer and Product Data (General Requirements) Regulations 2025, electronic facility, in the case of—
(a)
ANZ Bank New Zealand Limited, means the electronic banking facility for that bank known as goMoney:
(b)
ASB Bank Limited, means the electronic banking facility for that bank known as ASB Mobile Banking:
(c)
Bank of New Zealand, means the electronic banking facility for that bank known as Internet Banking – Personal:
(d)
Westpac New Zealand Limited, means the electronic banking facility for that bank known as Westpac One, but does not include—
(i)
that facility to the extent that it relates to a user login in the name of a person other than an individual; or
(ii)
Westpac One Business.
(3)
This clause applies despite regulation 4(1).
(4)
This clause ceases to apply on 1 June 2026.
3 Designated customer data for ANZ Bank New Zealand Limited does not include certain data until 1 April 2026
(1)
This clause applies to ANZ Bank New Zealand Limited.
(2)
The classes of customer data that are designated under regulation 7 do not include the data under regulation 7(1)(e) and (f).
(3)
This clause ceases to apply on 1 April 2026.
4 Designated customer data for ASB Bank Limited does not include certain data until 1 June 2026
(1)
This clause applies to ASB Bank Limited.
(2)
The classes of customer data that are designated under regulation 7 do not include the data under regulation 7(1)(d) if—
(a)
the relevant account is for a credit contract (as defined in section 7 of the Credit Contracts and Consumer Finance Act 2003); and
(b)
under a schedule of payments, payments are made into the relevant account from another account held with ASB Bank Limited.
(3)
This clause ceases to apply on 1 June 2026.
5 Designated customer data for Westpac New Zealand Limited does not include data in statements sent or made available before 1 December 2025
(1)
This clause applies to Westpac New Zealand Limited.
(2)
The classes of customer data that are designated under regulation 7 do not include the data under regulation 7(1)(e) and (f) if the statement referred to in those paragraphs was sent or made available to the customer before 1 December 2025.
(3)
This clause ceases to apply on 1 January 2027.
Rachel Hayward,
Clerk of the Executive Council.
Explanatory note
This note is not part of the regulations but is intended to indicate their general effect.
These regulations designate certain matters for the purposes of the Customer and Product Data Act 2025 (the Act). The regulations mainly come into force on 1 December 2025. However, the designation of Kiwibank Limited comes into force on 1 June 2026.
The Act regulates certain data services provided by persons that are designated as data holders. Section 4 of that Act sets out an overview of the regime.
These regulations—
designate certain banks and other deposit takers as data holders; and
designate certain data about transactional accounts, basic savings accounts, and credit contract accounts as designated customer data. The data is designated for the purposes of requests made by accredited requestors (but not for the purposes of requests made by customers). The designated data includes—
the customer’s name and contact details; and
data that identifies the account; and
data about the balance of the account; and
particulars of each transaction for the account that occurred during the previous 2 years; and
data contained in any statement for the account that the data holder has sent or made available to the customer during the previous 12 months; and
a copy of the statement; and
designate as designated actions the making of certain payments by means of the Bulk Electronic Clearing System operated by Payments NZ Limited. The actions are designated for the purposes of requests made by accredited requestors (but not for the purposes of requests made by customers); and
set the classes of accreditation that may be granted in relation to these regulations.
The Customer and Product Data (General Requirements) Regulations 2025 also come into force on 1 December 2025. Those regulations—
require a data holder to give an accredited requestor access to its system operated under section 27 of the Act; and
require an accredited requestor to—
report certain information to the chief executive of the Ministry of Business, Innovation, and Employment (the chief executive); and
periodically notify customers about authorisations; and
provide matters relating to the accreditation of requestors. This includes additional criteria that an applicant for accreditation must meet; and
allow the chief executive to share information with the Financial Markets Authority and the Registrar of Financial Service Providers under section 128 of the Act.
Regulatory impact statement
The Ministry of Business, Innovation, and Employment produced a regulatory impact statement on 25 March 2025 to help inform the decisions taken by the Government relating to the contents of this instrument.
A copy of this regulatory impact statement can be found at—
Date of notification in Gazette: 16 October 2025.
These regulations are administered by the Ministry of Business, Innovation, and Employment.
Versions
Customer and Product Data (Designations for Banking and Other Deposit Taking) Regulations 2025
RSS feed link copied, you can now paste this link into your feed reader.