Australia Privacy Notice

The global baseline sets a default retention period referenced to applicable statutory law. For Australian transactions, the AML/CTF Act 2006 (Cth) requires a 7-year period, which overrides the global baseline for Australian users.

4.1 How the CDR applies to Opefin Source

When you use Opefin Source in Australia, your bank account data is retrieved via an accredited CDR data recipient. That accredited entity retrieves your data from your bank with your consent and delivers it to Opefin for certificate generation. The specific open banking provider used by Opefin for Australian transactions is specified in the AU Country Addendum and will be confirmed when Australian operations commence.

4.2 Disclosed purpose of CDR consent

The CDR Rules require that CDR data be used only for the purpose disclosed at consent. The purpose disclosed in your Opefin consent flow for Australian users includes: verifying your identity and generating your AML/CTF compliance certificate; EDD screening (PEP, sanctions, and adverse media screening) where that module is activated; creating and maintaining your verified compliance record in the Opefin Compliance Network; enabling accredited reporting entities to query your record for future transactions with notification to you; and improving Opefin products using derived and anonymised data. Raw CDR data is not used for purposes outside this disclosed scope.

4.3 Your CDR consent rights

Under the CDR Rules, you have the following rights in relation to your CDR data:

• The right to give, manage, and withdraw consent to share your CDR data at any time.
• The right to see a list of the data sharing arrangements you have authorised.
• The right to withdraw consent through the CDR consent dashboard provided by your bank or the accredited data recipient.
• The right to request deletion of your CDR data held by an accredited data recipient, subject to legal retention requirements.
• The right to know what data has been accessed and for what purpose.

4.4 Scope of CDR access

We request access to account information only. We do not initiate payments, transfers, or any other transactions via the CDR connection. The specific data sets we access are limited to what is necessary to generate your AML/CTF compliance certificate, conduct identity cross-referencing, and create your Compliance Network record.

The Opefin Compliance Network is a core feature of Opefin Source, not a secondary optional use. By accepting the Global Consumer Terms, the AU Country Specific Additional Consumer Terms, the Global Privacy Policy, and this Privacy Notice, you agree to your certificate and associated verified data being part of the Network for the 7-year statutory retention period applicable to Australian transactions.

5.1 AML/CTF reliance and the Compliance Network

Section 38 of the AML/CTF Act 2006 (Cth) permits reliance by one reporting entity on CDD conducted by another, under specified conditions. The Opefin Compliance Network supports and extends this model for Australian reporting entities, enabling accredited entities to access your verified compliance record for future transactions with notification to you, reducing repeated verification friction.

5.2 Tranche 2 reforms

Australia’s AML/CTF Tranche 2 reforms take effect from 1 July 2026, bringing over 90,000 additional entities including lawyers, accountants, and real estate agents into the AML/CTF regime. This significantly expands the pool of Australian reporting entities that will need to carry out CDD, EDD and source of funds/wealth checks, and the utility of the Opefin Compliance Network for Australian users.

5.3 Notification for Network queries

When an accredited reporting entity queries your Network record, you will receive a notification. You do not need to give fresh consent for each query, but you are notified of each one (and consent will be requested if needed). You may request removal from active Network queries at any time, subject to the 7-year statutory retention period for the underlying certificate.

6.1 Access and correction requests

Under APPs 12 and 13, you have the right to access the personal information we hold about you and to request correction of inaccurate information. Send your request to privacy@opefin.com. We will acknowledge within 5 business days and respond within 30 days.

6.2 Complaints to Opefin

6.3 Complaints to the OAIC

6.4 CDR complaints

7.1 Reporting Entities and AUSTRAC

Reporting entities using Opefin Source in Australia are supervised by AUSTRAC. They must be enrolled with AUSTRAC, maintain a compliant AML/CTF Programme, and comply with the AML/CTF Act 2006 (Cth) and the AML/CTF Rules 2007.

7.2 Overseas disclosure to New Zealand

Opefin is a New Zealand entity. When you use Opefin Source in Australia, your personal information is transferred to New Zealand for processing. The New Zealand Privacy Act 2020 is broadly equivalent to the Australian Privacy Act 1988 (Cth) and satisfies the APP 8 standard. Where we use sub-processors based in other countries, we require them contractually to protect your information to a standard consistent with the APPs.

7.3 Sensitive information

The transaction data retrieved from your bank accounts may include information about your financial position that could be considered sensitive under APP 3. We treat all financial data retrieved via CDR as sensitive information and apply our highest level of security controls to it.

7.4 Notifiable Data Breaches

Australia’s Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988 (Cth)) requires us to notify both the OAIC and affected individuals if we suffer an eligible data breach likely to result in serious harm. If an eligible data breach occurs, and allowed under law, we will notify the OAIC as soon as practicable, notify affected individuals directly, and provide a statement describing the nature of the breach, the kinds of information involved, and the steps we are taking in response.

7.5 Australian Consumer Law

If you are an individual consumer in Australia, the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)) applies to your use of Opefin Source. These laws give you certain guaranteed consumer rights that cannot be excluded by contract. Nothing in our Global Consumer Terms, AU Country Specific Additional Terms, Global Privacy Policy, this notice, or any other Opefin document removes those rights.

7.6 Biometric information

Where the IDV Module is activated, Opefin Source collects biometric information within the meaning of the Privacy Act 1988 (Cth), including a facial image and liveness detection result. This information is processed by our appointed IDV Provider under the IDV Provider’s own privacy framework and explicit consent, which you provide as part of the IDV flow. Opefin receives the verification outcome and may retain your raw biometric information after the verification event if required. Because biometric information is sensitive information under the Privacy Act 1988 (Cth), we obtain your explicit consent before collection and we do not use it for any purpose other than verifying your identity for the AML/CTF certificate.