Change log

Updated page content and example prototype to reflect v1.35.0 changes. For details relating to the example prototype, see Change logs: 1CO0. Pre-consent v1.35.0.2025.09.16 1CO. Collection and use consents v1.35.0.2025.09.17 2AU1. Redirect to App v1.35.0.2025.09.22 3AU. Authorisation to disclose v1.35.0.2025.09.24 4CM1. Collection and use consent v1.35.0.2025.09.17 4CM2. DR Withdrawal v1.35.0.2025.09.17

Overview: The Consent Flow

Updated CX checklist (web version and files) to reflect requirement changes relating to: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 693: CX Guidelines | Historical date ranges for Authorisations; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367; • Change Request 702: CX Guidelines | Required and voluntary data - Authorisation; and • Change Request 703: CX Guidelines | Pre-consent. Download files CX Checklist v1.35.0.2025.09.26 For details, see Change logs: Consent: Pre-consent v1.35.0.2025.09.16 Consent: Collection and use consents v1.35.0.2025.09.17 Consent: Disclosure consents, Accredited person disclosure consents v1.35.0.2025.09.15 Consent: Disclosure consents, Trusted Adviser disclosure consents v1.35.0.2025.09.15 Consent: Disclosure consents, Insights disclosure consents v1.35.0.2025.09.12 Consent: Disclosure consents, Business Consumer disclosure consents v1.35.0.2025.09.12 Consent: Amending consent v1.35.0.2025.09.22 Authenticate: Redirect to App v1.35.0.2025.09.22 Authenticate: Fallback Authentication Framework v1.35.0.2025.09.22 Authenticate: Redirect to Web with One Time Password v1.35.0.2025.09.22 Authorise: Authorisation to disclose v1.35.0.2025.09.24 Authorise: Amending authorisations v1.35.0.2025.09.24 Consent management (Data recipient): Collection and use consents v1.35.0.2025.09.17 Consent management (Data recipient): Withdrawal v1.35.0.2025.09.17 Overview: Open source assets v1.35.0.2025.09.26

Overview: CX Checklist

As part of general maintenance, updates to CX artefacts to reflect: • UI uplift; and • Minor changes to guidelines stemming from Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines, relating to: ◦ CDR receipts delivery channel (updated checklist item: 4CM3.00.08) ◦ CDR data sharing education (updated checklist item: 5CM5.01.19) For more details, see Change log: 3AU2. Authorisation to disclose joint account data v1.35.0.2025.09.12 4CM1. Disclosure consents v1.35.0.2025.09.23 4CM3. Notifications: CDR Receipt v1.35.0.2025.09.23 5CM1. Authorisations v1.35.0.2025.09.23 5CM2. DH Withdrawal v1.35.0.2025.09.23 5CM3. Joint account disclosure option management service v1.35.0.2025.09.26 5CM5. Joint account notification settings v1.35.0.2025.09.25

Overview: Open Source Assets

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 693: CX Guidelines | Historical date ranges for Authorisations; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367; and • Change Request 702: CX Guidelines | Required and voluntary data - Authorisation. This includes: • Visual, UI and Experiential updates to reflect the new standard requirements and guidance. Default example Standards changes • New standards relating to passwords (new checklist item: 3AU1.00.27) • Updates to standards relating to: ◦ language to be used (updated checklist item: 3AU1.02.14) ◦ detailed scope requests (updated checklist item: 3AU1.02.25) Guidelines changes • New CX guideline relating to authorisation period (new checklist item: 3AU1.02.28) • Updates to guideline relating to historical data ranges (updated checklist item: 3AU1.02.18) Unavailable accounts New CX artefacts and requirements relating to unavailable accounts in the amending authorisation flow. These artefacts provide implementation examples that reflect standards for Unavailable Accounts and related guidelines. CX Guideline website page • Updates to page hierarchy to add new section for ‘Unavailable accounts’ • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 3AU1. Amending authorisations v1.35.0.2025.09.24

Authorise: Amending authorisations

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 693: CX Guidelines | Historical date ranges for Authorisations; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367; and • Change Request 702: CX Guidelines | Required and voluntary data - Authorisation. This includes: Authorise - Default example Standards changes • New standards relating to passwords (new checklist item: 3AU.00.28) • Updates to standards relating to: ◦ language to be used (updated checklist item: 3AU.02.14) ◦ detailed scope requests (updated checklist item: 3AU.02.24) Guidelines changes • New CX guideline relating to authorisation period (new checklist item: 3AU.02.29) • Updates to guideline relating to historical data ranges (updated checklist item: 3AU.02.17) Unavailable accounts Standards changes Retirement of standard reference due to not being applicable to the flow. The standard remains in force (updated checklist item: 3AU.03.05) Guidelines changes • New guideline providing information on how data holders can meet the unavailable accounts standards, including ways to mitigate cognitive overload, facilitate comprehension and provide transparency and control (new checklist item: 3AU.03.09) • Updates to guideline relating to: ◦ types of accounts that may be unavailable (updated checklist items: 3AU.03.03 and 3AU.03a.03) ◦ requesting sharing rights (updated checklist items: 3AU.03.08 and 3AU.03b.08) Selection functionality Standards changes New standards relating to adding or switching profiles (new checklist item: 3AU.05.07) Guidelines changes New CX guidelines relating to: • adding or switching profiles (new checklist item: 3AU.05.08) • profile selection (new checklist item: 3AU.05.09) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 3AU. Authorisation to disclose v1.35.0.2025.09.24

Authorise: Authorisation to disclose

New CX artefacts and requirements to reflect: • Consultation Draft 369: Redirect to App - Draft Standards; and • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes. This includes: • New CX artefacts and requirements relating to Redirect to App. These artefacts provide implementation examples that reflect standards for Authentication Schedule, Consumer Experience and Security Profile, and related guidelines. • New open source design asset 2AU1. Redirect to App v1.35.0.2025.09.22

Authenticate: Redirect to App

New CX artefacts and requirements to reflect: • Consultation Draft 369: Redirect to App - Draft Standards; and • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes. This includes: • New CX artefacts and requirements relating to the Fallback Authentication Framework. These artefacts include an example flow that reflects standards for Authentication Schedule, Consumer Experience, Security Profile, and related guidelines. • New open source design asset 2AU0. Fallback Authentication Framework v1.35.0.2025.09.22

Authenticate: Fallback Authentication Framework

Updated CX artefacts and requirements to reflect: • Consultation Draft 369: Redirect to App - Draft Standards; and • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes. This includes: • Visual, UI and Experiential updates to reflect the new standard requirements Standards changes • New standards relating to: ◦ fallback authentication flows (new checklist item: 2AU.00.26) ◦ friction (new checklist item: 2AU.00.27) ◦ levels of assurance (new checklist item: 2AU.00.28) ◦ app install (new checklist item: 2AU.00.29) ◦ one time password credential requirements (new checklist item: 2AU.00.30) ◦ passwords (new checklist item: 2AU.00.31) ◦ memorised secrets (new checklist item: 2AU.00.32) ◦ profile selection (new checklist item: 2AU.00.33) • Updates to standard relating to: ◦ password link (updated checklist item: 2AU.00.02) ◦ one time password expiry (updated checklist item: 2AU.03.05) ◦ one time password credential requirements (updated checklist item: 2AU.00.06, 2AU.03.08, 2AU.03.10–15) ◦ user identifiers (updated checklist item: 2AU.01.07) • Retirement of existing standard requirements due to their removal from the standards (retired checklist items: 2AU.00.03–4, 2AU.00.09) Guidelines changes • New CX guidelines relating to: ◦ authentication methods (new checklist item: 2AU.00.34) ◦ authentication credentials (new checklist item: 2AU.00.35) ◦ app download link (new checklist item: 2AU.00.36) • Updates to guidelines relating to CDS guidelines and conventions (updated checklist item: 2AU.01.20–21) CX Guideline website page • Updates to page title and content from ‘Redirect with One Time Password’ to ‘Redirect to Web with One Time Password’ • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 2AU. Redirect to Web with One Time Password v1.35.0.2025.09.22

Authenticate: Redirect to Web with One Time Password

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Amending collection and use consent Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO2.01.66) ◦ redirect to app (new checklist item: 1CO2.01.67) ◦ decoupled authentication (new checklist item: 1CO2.01.68) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO2.01.33) ◦ detailed scope requests (updated checklist item: 1CO2.01.34) Amending business consumer disclosure consent - Detached flow Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO2.02.23) • detailed scope requests (updated checklist item: 1CO2.02.24) Amending business consumer disclosure consent - Bundled CDR consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO2.03.57) ◦ redirect to app (new checklist item: 1CO2.03.58) ◦ decoupled authentication (new checklist item: 1CO2.03.59) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO2.03.31) ◦ detailed scope requests (updated checklist item: 1CO2.03.32) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO2. Amending consent v1.35.0.2025.09.22

Consent: Amending consents

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Collection and use consents - Default example Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO.00.56) ◦ redirect to app (new checklist item: 1CO.00.57) ◦ decoupled authentication (new checklist item: 1CO.00.58) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO.02.26) ◦ detailed scope requests (updated checklist item: 1CO.02.27) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO.01.30) ◦ CDR data sharing education (updated checklist item: 1CO.02.50) ◦ CDR receipts delivery channel (updated checklist item: 1CO.00.54) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO.01.32) CDR representative arrangement Guidelines changes Updates to guideline relating to CDR receipts delivery channel (updated checklist item: 1CO.03c.38) Business consumer statement Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO.04.17) • detailed scope requests (updated checklist item: 1CO.04.18) Notification to hold data as a data holder New CX artefacts and requirements for clause 7.2 of Schedule 3, Conditions for accredited person to be data holder. These artefacts provide implementation examples to reflect requirements for collection consent and subclause 7.2(2) of Schedule 3, Conditions involving notification prior to first collection. Permission to hold collected data as a data holder New CX artefacts and requirements relating to clause 7.2 of Schedule 3, Conditions for an accredited person to be a data holder. These artefacts demonstrate how data recipients can obtain consumer consent to become a data holder of collected CDR data (subclause 7.2(2A) of Schedule 3). CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO. Collection and use consents v1.35.0.2025.09.17

Consent: Collection and use consents

Updated CX artefacts and requirements to reflect Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH. This includes: AP holding collected data as a data holder New CX artefacts and requirements relating to consent management for clause 7.2 of Schedule 3 — conditions for an accredited person to be a data holder. These artefacts provide implementation examples for data recipient dashboards regarding collection consents where subclause 7.2(2) of Schedule 3 applies. Permission to hold collected data as a data holder New CX artefacts and requirements relating to consent management when clause 7.2 of Schedule 3 is in effect — conditions for an accredited person to be a data holder. These artefacts provide implementation examples for data recipient dashboards where consumers have granted permission for the recipient to become a data holder of collected CDR data (subclause 7.2(2A) of Schedule 3). CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 4CM1. Collection and use consent v1.35.0.2025.09.17

Consent Management (Data recipient): Collection and use consents

Updated CX artefacts and requirements to reflect Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH. This includes: Collection consent withdrawal — AP holding collected data as a data holder New CX artefacts and requirements relating to consent withdrawal for clause 7.2 of Schedule 3 — conditions for accredited person to be data holder. These artefacts provide implementation examples to reflect requirements for collection consent withdrawal where subclause 7.2(2) of Schedule 3 applies. Consent withdrawal – Permission to hold collected data as a data holder New CX artefacts and requirements relating to consent withdrawal when clause 7.2 of Schedule 3 is in effect — conditions for an accredited person to be a data holder. These artefacts provide implementation examples for consent withdrawal where consumers have granted permission for the recipient to become a data holder of collected CDR data (subclause 7.2(2A) of Schedule 3). CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 4CM2. DR Withdrawal v1.35.0.2025.09.17

Consent Management (Data recipient): Withdrawal

New CX artefacts and optional guidance to reflect Change Request 703: CX Guidelines | Pre-consent. This includes: • New CX artefacts and guidance relating to Pre-consent. This is the screens after the consumer has commenced CDR onboarding, but before the step where their CDR consent is sought. This guidance is optional and does not include any mandatory requirements. These artefacts provide implementation examples to reflect CX research and new guidelines that may facilitate a consumer's propensity to consent and aid their understanding of the process. • New open source design asset 1CO0. Pre-consent v1.35.0.2025.09.16

Consent: Pre-consent

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow - Disclosing unmodified data Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO1.01.24) • detailed scope requests (updated checklist item: 1CO1.01.25) Detached flow - Disclosing modified data Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO1.02.06) • detailed scope requests (updated checklist item: 1CO1.02.07) Bundled CDR consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO1.03.47) ◦ redirect to app (new checklist item: 1CO1.03.48) ◦ decoupled authentication (new checklist item: 1CO1.03.49) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO1.03.21) ◦ detailed scope requests (updated checklist item: 1CO1.03.22) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO1.03.28) ◦ CDR data sharing education (updated checklist item: 1CO1.03.41) ◦ CDR receipts delivery channel (updated checklist item: 1CO1.03.44) • Retirement of guideline relating to data holder selection (retired checklist item: 1CO1.03.30) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO1. AP disclosure consent v1.35.0.2025.09.15

Consent: Disclosure consents, Accredited person disclosure consents

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO3.00.09) • detailed scope requests (updated checklist item: 1CO3.00.10) Guidelines changes Updates to guidelines relating to: CDR receipts delivery channel (updated checklist item: 1CO3.00.42) Bundled CDR Consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO3.01.60) ◦ redirect to app (new checklist item: 1CO3.01.61) ◦ decoupled authentication (new checklist item: 1CO3.01.62) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO3.01.08) ◦ detailed scope requests (updated checklist item: 1CO3.01.09) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO3.01.51) ◦ CDR receipts delivery channel (updated checklist item: 1CO3.01.58) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO3.01.53) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO3. Trusted Adviser disclosure consent v1.35.0.2025.09.15

Consent: Disclosure consents, Trusted Adviser disclosure consents

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow Standards changes Updates to standards relating to: language to be used (updated checklist item: 1CO4.00.14) Guidelines changes Updates to guidelines relating to: CDR receipts delivery channel (updated checklist item: 1CO4.00.52) Bundled CDR Consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO4.01.62) ◦ redirect to app (new checklist item: 1CO4.01.63) ◦ decoupled authentication (new checklist item: 1CO4.01.64) • Updates to standards relating to: language to be used (updated checklist item: 1CO4.01.22) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO4.01.41) ◦ CDR receipts delivery channel (updated checklist item: 1CO4.01.59) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO4.01.43) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO4. Insights disclosure consent v1.35.0.2025.09.12

Consent: Disclosure consents, Insight disclosure consents

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO5.00.20) • detailed scope requests (updated checklist item: 1CO5.00.21) Guidelines changes Updates to guidelines relating to: CDR receipts delivery channel (updated checklist item: 1CO5.00.46) Bundled CDR Consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO5.01.70) ◦ redirect to app (new checklist item: 1CO5.01.71) ◦ decoupled authentication (new checklist item: 1CO5.01.72) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO5.01.32) ◦ detailed scope requests (updated checklist item: 1CO5.01.33) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO5.01.48) ◦ CDR data sharing education (updated checklist item: 1CO5.01.63) ◦ CDR receipts delivery channel (updated checklist item: 1CO5.01.67) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO5.01.50) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO5. Business consumer disclosure consent v1.35.0.2025.09.12

Consent: Disclosure consents, Business consumer disclosure consents

As part of general maintenance, updates to research participant demographic information to reflect CX research until Q3 2025. This has resulted in figure updates on multiple pages, including: • most data tables on Participant demographics • ‘Participants engaged in CX research’ section on Accessibility, inclusivity and the CDR • ‘About CDR behavioural archetypes’ section on Behavioural archetypes

Overview: Participant demographics Accessibility, inclusivity and the CDR Behavioural archetypes

Updated CX artefacts and requirements to reflect Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines. This includes: Amending collection and use consent Standards changes Updates to standards relating to previously future dated obligations that have now come into effect (updated checklist items: 1CO2.01.62, 1CO2.00.63) Guidelines changes • Updates to guidelines relating to: ◦ CDR data sharing education (updated checklist item: 1CO2.00.60) ◦ CDR receipts (updated checklist item: 1CO2.00.64) • Retirement of guideline relating to previously future dated obligations that have now come into effect (updated checklist item: 1CO2.00.65) Amending business consumer disclosure consent - Detached flow Standards changes Updates to standards relating to previously future dated obligations that have now come into effect (updated checklist items: 1CO2.02.35–36) Guidelines changes • Updates to guidelines relating to CDR receipts (updated checklist item: 1CO2.02.40) • Retirement of guideline relating to previously future dated obligations that have now come into effect (updated checklist item: 1CO2.02.41) Amending business consumer disclosure consent - Bundled CDR Consents New CX artefacts and requirements relating to amending bundled collection, use and disclosure consents for business consumers. These artefacts provide implementation examples to follow relevant rules and standards and better demonstrate a more probable implementation. CX Guideline website page • Updates to page hierarchy to add new section for ‘Amending business consumer disclosure consent - Bundled CDR Consents’ • Updates to include references to consultations for guidelines • Updates to CX checklist • New open source design asset 1CO2. Amending consent v1.35.0.2025.08.04

Consent: Amending consents