Analysis of Australia's Consumer Data Right (CDR) banking API mandate finds that fifty accredited banks all re-host the identical Consumer Data Standards Banking API v1.36.0 contract, making the API itself a commodity rather than a differentiator. Every resource is read-only (GET only, no payment initiation, unlike UK/EU open banking), gated behind OAuth2/OIDC with FAPI over mTLS aside from the public Product Reference Data endpoint. Only two banks, Up (Bendigo & Adelaide Bank) and partially Commonwealth Bank, ship anything beyond the mandated baseline, such as webhooks, event contracts, or a branded developer portal. The argument is that mandated compliance produced existence but not quality, and that real value will accrue in developer experience, documentation, rate limits, and trust posture built around the commodity contract rather than the API resource itself.
Table of contents
One regulator’s contract, fifty base pathsCommodity is the point — and the trapThe frontier is two companies wideQuestions this post answers
Does Australia's Consumer Data Right (CDR) support payment initiation like UK Open Banking?
No, Australian CDR banking APIs are a data-sharing regime, not a payment-initiation regime. Every resource in the baseline Consumer Data Standards Banking API v1.36.0 is a read-only GET endpoint covering products, accounts, balances, transactions, direct-debits, scheduled-payments, payees, and customer data, with no POST /payments or action endpoint, unlike the UK and EU where payment initiation is included. Teams comparing open banking regimes across regions can track these API design differences on daily.dev.
Which Australian banks offer more than the mandated CDR banking API?
Out of fifty accredited data holders, only two go beyond the mandated Consumer Data Standards baseline. Up, a brand of Bendigo & Adelaide Bank, built its own developer API with attachments, categories, tags, webhooks, an AsyncAPI event contract, published rate limits, and self-serve personal-access tokens. Commonwealth Bank partially differentiates by wrapping CDR endpoints in a first-party developer portal and business-banking variant. Fintech developers scoping bank integrations can follow which providers actually differentiate their APIs via daily.dev.
Why is every Australian bank's CDR API considered identical?
Under the Consumer Data Right, the Data Standards Body publishes a single OpenAPI contract, the Consumer Data Standards Banking API v1.36.0, and every accredited data holder re-hosts that identical contract under its own host. NAB's own provenance notes describe the surface as not NAB-proprietary but the shared CDS Banking API, and Suncorp, Teachers Mutual, Newcastle Permanent, IMB, Macquarie, and ANZ carry the same note, making forty-eight of fifty banks byte-identical at the API layer. Developers evaluating open banking ecosystems can compare API commodification trends like this on daily.dev.