Change log

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Collection and use consents - Default example Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO.00.56) ◦ redirect to app (new checklist item: 1CO.00.57) ◦ decoupled authentication (new checklist item: 1CO.00.58) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO.02.26) ◦ detailed scope requests (updated checklist item: 1CO.02.27) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO.01.30) ◦ CDR data sharing education (updated checklist item: 1CO.02.50) ◦ CDR receipts delivery channel (updated checklist item: 1CO.00.54) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO.01.32) CDR representative arrangement Guidelines changes Updates to guideline relating to CDR receipts delivery channel (updated checklist item: 1CO.03c.38) Business consumer statement Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO.04.17) • detailed scope requests (updated checklist item: 1CO.04.18) Notification to hold data as a data holder New CX artefacts and requirements for clause 7.2 of Schedule 3, Conditions for accredited person to be data holder. These artefacts provide implementation examples to reflect requirements for collection consent and subclause 7.2(2) of Schedule 3, Conditions involving notification prior to first collection. Permission to hold collected data as a data holder New CX artefacts and requirements relating to clause 7.2 of Schedule 3, Conditions for an accredited person to be a data holder. These artefacts demonstrate how data recipients can obtain consumer consent to become a data holder of collected CDR data (subclause 7.2(2A) of Schedule 3). CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO. Collection and use consents v1.35.0.2025.09.17

Consent: Collection and use consents

Updated CX artefacts and requirements to reflect Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH. This includes: AP holding collected data as a data holder New CX artefacts and requirements relating to consent management for clause 7.2 of Schedule 3 — conditions for an accredited person to be a data holder. These artefacts provide implementation examples for data recipient dashboards regarding collection consents where subclause 7.2(2) of Schedule 3 applies. Permission to hold collected data as a data holder New CX artefacts and requirements relating to consent management when clause 7.2 of Schedule 3 is in effect — conditions for an accredited person to be a data holder. These artefacts provide implementation examples for data recipient dashboards where consumers have granted permission for the recipient to become a data holder of collected CDR data (subclause 7.2(2A) of Schedule 3). CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 4CM1. Collection and use consent v1.35.0.2025.09.17

Consent Management (Data recipient): Collection and use consents

Updated CX artefacts and requirements to reflect Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH. This includes: Collection consent withdrawal — AP holding collected data as a data holder New CX artefacts and requirements relating to consent withdrawal for clause 7.2 of Schedule 3 — conditions for accredited person to be data holder. These artefacts provide implementation examples to reflect requirements for collection consent withdrawal where subclause 7.2(2) of Schedule 3 applies. Consent withdrawal – Permission to hold collected data as a data holder New CX artefacts and requirements relating to consent withdrawal when clause 7.2 of Schedule 3 is in effect — conditions for an accredited person to be a data holder. These artefacts provide implementation examples for consent withdrawal where consumers have granted permission for the recipient to become a data holder of collected CDR data (subclause 7.2(2A) of Schedule 3). CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 4CM2. DR Withdrawal v1.35.0.2025.09.17

Consent Management (Data recipient): Withdrawal

New CX artefacts and optional guidance to reflect Change Request 703: CX Guidelines | Pre-consent. This includes: • New CX artefacts and guidance relating to Pre-consent. This is the screens after the consumer has commenced CDR onboarding, but before the step where their CDR consent is sought. This guidance is optional and does not include any mandatory requirements. These artefacts provide implementation examples to reflect CX research and new guidelines that may facilitate a consumer's propensity to consent and aid their understanding of the process. • New open source design asset 1CO0. Pre-consent v1.35.0.2025.09.16

Consent: Pre-consent

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow - Disclosing unmodified data Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO1.01.24) • detailed scope requests (updated checklist item: 1CO1.01.25) Detached flow - Disclosing modified data Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO1.02.06) • detailed scope requests (updated checklist item: 1CO1.02.07) Bundled CDR consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO1.03.47) ◦ redirect to app (new checklist item: 1CO1.03.48) ◦ decoupled authentication (new checklist item: 1CO1.03.49) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO1.03.21) ◦ detailed scope requests (updated checklist item: 1CO1.03.22) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO1.03.28) ◦ CDR data sharing education (updated checklist item: 1CO1.03.41) ◦ CDR receipts delivery channel (updated checklist item: 1CO1.03.44) • Retirement of guideline relating to data holder selection (retired checklist item: 1CO1.03.30) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO1. AP disclosure consent v1.35.0.2025.09.15

Consent: Disclosure consents, Accredited person disclosure consents

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO3.00.09) • detailed scope requests (updated checklist item: 1CO3.00.10) Guidelines changes Updates to guidelines relating to: CDR receipts delivery channel (updated checklist item: 1CO3.00.42) Bundled CDR Consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO3.01.60) ◦ redirect to app (new checklist item: 1CO3.01.61) ◦ decoupled authentication (new checklist item: 1CO3.01.62) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO3.01.08) ◦ detailed scope requests (updated checklist item: 1CO3.01.09) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO3.01.51) ◦ CDR receipts delivery channel (updated checklist item: 1CO3.01.58) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO3.01.53) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO3. Trusted Adviser disclosure consent v1.35.0.2025.09.15

Consent: Disclosure consents, Trusted Adviser disclosure consents

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow Standards changes Updates to standards relating to: language to be used (updated checklist item: 1CO4.00.14) Guidelines changes Updates to guidelines relating to: CDR receipts delivery channel (updated checklist item: 1CO4.00.52) Bundled CDR Consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO4.01.62) ◦ redirect to app (new checklist item: 1CO4.01.63) ◦ decoupled authentication (new checklist item: 1CO4.01.64) • Updates to standards relating to: language to be used (updated checklist item: 1CO4.01.22) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO4.01.41) ◦ CDR receipts delivery channel (updated checklist item: 1CO4.01.59) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO4.01.43) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO4. Insights disclosure consent v1.35.0.2025.09.12

Consent: Disclosure consents, Insight disclosure consents

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO5.00.20) • detailed scope requests (updated checklist item: 1CO5.00.21) Guidelines changes Updates to guidelines relating to: CDR receipts delivery channel (updated checklist item: 1CO5.00.46) Bundled CDR Consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO5.01.70) ◦ redirect to app (new checklist item: 1CO5.01.71) ◦ decoupled authentication (new checklist item: 1CO5.01.72) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO5.01.32) ◦ detailed scope requests (updated checklist item: 1CO5.01.33) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO5.01.48) ◦ CDR data sharing education (updated checklist item: 1CO5.01.63) ◦ CDR receipts delivery channel (updated checklist item: 1CO5.01.67) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO5.01.50) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO5. Business consumer disclosure consent v1.35.0.2025.09.12

Consent: Disclosure consents, Business consumer disclosure consents

Updated CX artefacts and requirements to reflect Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines. This includes: Amending collection and use consent Standards changes Updates to standards relating to previously future dated obligations that have now come into effect (updated checklist items: 1CO2.01.62, 1CO2.00.63) Guidelines changes • Updates to guidelines relating to: ◦ CDR data sharing education (updated checklist item: 1CO2.00.60) ◦ CDR receipts (updated checklist item: 1CO2.00.64) • Retirement of guideline relating to previously future dated obligations that have now come into effect (updated checklist item: 1CO2.00.65) Amending business consumer disclosure consent - Detached flow Standards changes Updates to standards relating to previously future dated obligations that have now come into effect (updated checklist items: 1CO2.02.35–36) Guidelines changes • Updates to guidelines relating to CDR receipts (updated checklist item: 1CO2.02.40) • Retirement of guideline relating to previously future dated obligations that have now come into effect (updated checklist item: 1CO2.02.41) Amending business consumer disclosure consent - Bundled CDR Consents New CX artefacts and requirements relating to amending bundled collection, use and disclosure consents for business consumers. These artefacts provide implementation examples to follow relevant rules and standards and better demonstrate a more probable implementation. CX Guideline website page • Updates to page hierarchy to add new section for ‘Amending business consumer disclosure consent - Bundled CDR Consents’ • Updates to include references to consultations for guidelines • Updates to CX checklist • New open source design asset 1CO2. Amending consent v1.35.0.2025.08.04

Consent: Amending consents