Open Banking for Client-Authorised Financial Evidence

How Open Banking Shares Account Data

Open banking transfers permitted account data from a bank to an accredited recipient after the customer gives consent and authorises the bank to disclose it. The customer controls the sharing choices through the CDR process.

The account holder owns or holds the relevant account. The bank is the data holder. An accredited data recipient receives data under the CDR framework to provide the agreed service.

A CDR representative works under a written arrangement with an accredited principal and receives the data through that principal. A solicitor’s engagement letter alone does not make the firm an accredited recipient or CDR representative. The OAIC explains the CDR representative model.

The official CDR sharing process follows this sequence:

1. The customer chooses a service and consents to its collection and permitted use of specified data.
2. The bank authenticates the customer through its own process. The customer selects eligible accounts and authorises disclosure.
3. The recipient retrieves the permitted data electronically through standardised application programming interfaces, or APIs.
4. The recipient uses the data for the agreed service. An authorised export can then become a retained source record under the applicable handling rules.

This process shares information. It does not instruct the bank to make a payment. Keep a data-sharing authorisation separate from any authority to transact on the account.

Confirm Authority, Consent and the Collection Route

Confirm who can authorise sharing and who will receive the data before collecting anything for the matter. A client’s interest in a dispute does not give them access to another person’s account.

Use the official CDR provider register to identify the accredited recipient and any representative arrangement. Match the legal entity and service to the proposed collection route. Establish whether the client is an eligible account holder, an authorised secondary user or an appropriate nominated representative for a business account.

A separate trusted-adviser route can allow disclosure to a nominated professional with the consumer’s consent. The OAIC’s trusted-adviser guidance identifies specified professional classes, including practising lawyers and qualified accountants. An investigator’s job title alone does not establish membership of a class. The recipient must take reasonable steps to confirm the adviser’s status. Trusted advisers receive data outside the CDR safeguards unless they are also accredited, so assess their applicable privacy and professional obligations.

Before the client proceeds, record the following details:

• The client’s account authority and any required business or joint-account permissions.
• The purpose of collection and the data categories needed for that purpose.
• The selected accounts and requested transaction period.
• The recipient’s identity and any onward disclosure to a nominated adviser.
• Whether collection is one-off or ongoing, its duration and the permitted period of use.
• How the client can withdraw consent and how retained data will be handled.

Keep the consent receipt and relevant authorisation records with the collection record. The OAIC’s consent guidance separates consent to collection and use from the bank’s authorisation to disclose. A signed engagement does not replace these steps. The client completes authentication with the bank. Never ask them to send banking passwords or one-time authentication codes to the analyst.

Check Coverage Before Replacing a Statement Request

Compare the available account data with the questions and transaction periods the investigation must answer. An export covering recent activity cannot establish an earlier account history.

The banking data standards define account, balance and transaction endpoints. Transaction requests have date filters and paginated results. An omitted oldest-time parameter defaults to a 90-day window, so a successful retrieval alone does not prove that the full requested history arrived.

Ask the recipient to establish the actual earliest and latest transactions returned, the account identity and whether all result pages were collected. Compare those details with the requested period. A zero-transaction period needs a coverage explanation before it can be described as inactivity.

Joint-account sharing depends on the account’s sharing settings and applicable permissions. Closed accounts need particular attention. Official closed-account guidance distinguishes new consents, for which sharing closed-account data is voluntary, from qualifying existing consents. Check which arrangement applies. If the client has lost eligibility with that bank, the collection route also needs reassessment.

An account feed gives structured data. Bank-issued statements preserve the issued document and its account-period context. Source vouchers, payment instructions and account-authority records answer further questions that a transaction description cannot resolve. Retain both the export and statements when you need efficient transaction analysis alongside the original bank documents. Request old bank statements where the collection leaves historical periods uncovered.

Preserve the Data and Its Provenance

Preserve an unchanged, lawfully retained export before sorting or combining transactions. Provenance is the record of where the data came from and what happened to it.

Create a source register that records the bank, account identity and collection route. Attach the consent record and identify the authorised recipient. Record the retrieval time and time zone, requested period, filters and export format. Retain available retrieval references, the original filename and the person who received it. Keep credentials out of the register.

Store the original separately with controlled access. Work from a copy and record transformations such as combining files or standardising dates. A file hash can help detect later changes to the saved export. It cannot establish that the exported data was complete or that every description accurately explains a payment.

Reconcile the export to source statements where available:

1. Match the bank, account holder and account identifier before comparing transactions.
2. Compare the same period and distinguish a balance at retrieval from a statement’s closing balance.
3. Match transaction amounts and references. Investigate differences between transaction dates and posting dates.
4. Identify missing periods, reversals and duplicate entries. Keep any pending entries separate from settled transactions.
5. Record what reconciles, every unresolved difference and the document needed to resolve it.

Keep the original description beside any analytical category. A transfer labelled with a person’s name does not establish whether it was a gift, loan or repayment. The legal team’s use of bank statements as evidence also depends on source and procedural requirements beyond obtaining a data feed.

Handle Withdrawal, Expiry and Missing Data

Treat a failed collection as a reason to check the sharing authority and coverage before drawing a financial conclusion.

Collection problem	Check	Next action
Consent has expired	The recorded consent period and current dashboard status	Seek a fresh valid consent if further collection is needed. Do not continue using expired collection authority.
An account is unavailable	Eligibility, joint-account permissions, nominated-representative status and any closed-account restriction	Resolve the relevant permission or obtain the required records through another authorised route.
The export begins too late	Requested date filters, returned periods and pagination	Obtain the missing range where available or request statements covering it.
Sharing stops after withdrawal	Which collection, use or disclosure consent was withdrawn	Stop the affected activity and assess retained records under the rules applying to each holder.

Withdrawal of authority for future sharing does not settle every question about copies already held. The OAIC’s privacy safeguard guidance requires redundant data to be deleted or de-identified unless an exception applies. A continuing matter does not itself create an unrestricted retention exception.

Identify who holds each copy and the legal basis for keeping or deleting it. A trusted adviser has different obligations from an accredited recipient. Apply any relevant law or court order and record the retention decision. Do not assume that withdrawing collection consent either erases all copies automatically or permits indefinite retention.

Use the Records Within the Legal Team’s Evidence Plan

Use open banking data to answer a defined evidence question, with the collection record attached to the analysis.

In this fictional example, a client authorises collection of one transaction account for a two-year review of disputed transfers. The solicitor confirms the recipient’s status and the client’s permitted sharing choices. The recipient supplies an export, which the team preserves with its consent receipt and retrieval details.

The coverage check shows only the latest year. A bank statement supplied by the client covers the final quarter of that year. Transactions in the overlapping period reconcile after one posting-date difference and a reversing entry are explained. The earlier year remains a recorded gap. The team requests the missing statements and a payment instruction for the disputed transfer.

The resulting file contains a source register, the coverage check and a reconciled transaction schedule. It also contains a specific outstanding statement request. The schedule distinguishes matched transactions from unresolved questions about purpose.

For the bank statements supplied to the matter, FinTrace saves lawyers and forensic accountants hours of conversion and review. Its staged workflow processes large PDF collections into a searchable Excel ledger and a clear findings report. Findings cite the source PDF filename and page, so the supporting evidence is directly at hand. The analysis also flags suspicious transactions and gaps in the supplied statements.

CDR collection belongs to the separately verified recipient route described above. FinTrace’s role here is analysing supplied statements. Keep the collection record with those statements and identify the remaining evidence requests before preparing the legal team’s next schedule.