Which Bank just got smacked with a record $792,000 penalty for open banking breaches

The Commonwealth Bank (CBA) has paid $792,000 in penalties following action by he ACCC over breaches of the Consumer Data Right (CDR).

It’s the second time in six months that a major bank has been busted for dragging its feet over CDR, also known as open banking, which launched in Australia 5.5 years ago.

NAB was fined $751,200 in June over sloppy CDR responses to fintechs. In 2022, the Bank of Queensland copped a $133,200 fine for failing to share customer details under the CDR

Both the NAB and CBA actions say the ACCC issue four infringement notices against each bank.

In the later case, ACCC alleged that CBA did not comply with the rules by failing to enable data sharing for certain accounts for business consumers and partnerships. That meant people were unable to share their data to access CDR-enabled products and services for things such as business accounting.

The ACCC acted after complaints from consumers reporting difficulties accessing CDR, forcing them to find manual workarounds or revert to less secure methods of data sharing.

ACCC Deputy Chair Catriona Lowe said it is the highest total penalty to date for an alleged breach of the CDR Rules.

“In the first half of 2025, the number of CDR participants increased by 55% from the previous six months, and we expect this number to continue to grow as the CDR expands to the non-bank lending sector from mid-2026,” she said.

“Banks have now had a few years to understand and implement their CDR obligations. This penalty against CBA should serve as a reminder to all CDR participants that failing to comply with the Rules may result in the ACCC taking enforcement action.”

Lowe said CBA cooperated with the investigation and made several commitments as part of an administrative resolution with the ACCC, including enabling consumer data sharing for remaining Trading Entity Business Name (TEBN) accounts by December 19 and providing remediation to customers and accredited data recipients affected by the conduct.

That includes a goodwill payment to affected business customers who meet the relevant eligibility criteria, and additional payments to business customers who can substantiate further financial and non-financial loss.