UNO Now Monitors Its Clients’ Loans Continuously. Non-Bank Consumer Data Opens 9 November — and the Broker Pathway to It Drops the CDR Safeguards

Two things landed in the same fortnight, and brokers should read them together.

On 8 October, Broker Daily reported that digital brokerage UNO Home Loans had relaunched its LoanScore tool on permissioned open banking data supplied through fintech Fiskil. The practical change is small to describe and large in effect: LoanScore stops being a one-off comparison a borrower runs when they happen to think of it, and becomes a loan that is watched continuously.

Four weeks from now, on 9 November 2026, the first tranche of non-bank lenders begins sharing consumer data under the Consumer Data Right. That date comes from the Australian Government’s own CDR rollout page, not from a vendor’s roadmap.

Put the two beside each other and the question for a broker business is not whether open banking is interesting. It is this: when a client’s actual loan position can be monitored without anyone phoning them, what exactly is your annual review for?

What UNO actually built

According to Broker Daily and a release carried by Australian FinTech on 8 October, LoanScore previously compared a borrower’s existing home loan against the market, and its accuracy depended on what the borrower typed in at the time. With Fiskil’s connection in place, UNO can combine its own pricing and product data with the borrower’s real banking data, drawn with the borrower’s permission.

UNO chief executive Vincent Turner framed the borrower’s problem as a simple one: “I don’t even know if I have a good loan or not.” On the shift the data makes, Broker Daily quotes him saying, “Where it gets really interesting is not the self-reported data, it’s when you add open banking,” and, on the monitoring itself, “That’s the real win because it’s not just a LoanScore now, but it also means we continuously monitor it.”

The reported build timeline is worth noting on its own. Broker Daily says UNO’s engineers reached a working product in their own environment in under two weeks, while the company’s CDR requirements progressed in parallel. The engineering was not the constraint. The permissions were.

Broker Daily also cites figures from NextGen, which owns open banking provider Frollo: almost 120,000 consumers shared financial data with brokers through its platform last financial year; open banking features in close to one in 10 broker-originated home loan applications; applications supported by open banking data were approved an average of 11 per cent faster, with refinance approval times improving by up to 21 per cent and some major lenders reporting assessment times falling by as much as 49 per cent. Those numbers appear in that reporting of NextGen’s data rather than in a primary release we could locate, so treat them as NextGen’s figures as reported, not as independently established market fact.

The date that actually changes your client base: 9 November

Open banking has been an ADI story for years. That is why it has mattered less to brokers than the headlines suggested — a large slice of broker-placed business, and almost all of the harder-to-place business, sits with lenders that were not in the regime.

That is now changing on a published timetable. The Government’s CDR rollout page for the non-bank lending sector sets out the sequence:

• The sector was designated on 21 November 2022, and the amendments to the CDR Rules took effect on 4 March 2025.
• Product data sharing obligations applied in the non-bank lending sector from 13 July 2026.
• Consumer data sharing starts for initial providers on 9 November 2026, excluding complex requests.
• Consumer data sharing starts for large providers on 10 May 2027, excluding complex requests.

“Initial providers” is defined by size: lenders whose combined resident loans and finance leases exceed $10 billion on APRA reporting. Large providers that qualified after 13 July 2025 pick up product data obligations 12 months after qualifying and consumer data obligations 15 months after. Lenders that fall into neither tier can join voluntarily by contacting the ACCC and nominating a start date.

Read that against the composition of a typical broker book. The specialist and near-prime lenders that brokers lean on for self-employed clients, credit-impaired clients and the borrowers that The Broker Times has been tracking as refinance-blocked are mostly non-banks. From 9 November, for the largest of them, the loan your client already holds becomes data your client can direct somewhere.

Brokers are a named class in the rules. That is not the same as being protected.

Here is the part that gets skipped in the vendor conversation, and it is the part a principal broker should actually read.

Under the CDR Rules, a consumer can direct an accredited data recipient to disclose their CDR data to a “trusted adviser”. The OAIC’s guidance on the rules sets out the classes listed in subrule 1.10C(2):

• qualified accountants under the Corporations Act 2001
• legal practitioners holding a current practising certificate
• registered tax agents, BAS agents and tax (financial) advisers under the Tax Agent Services Act 2009
• financial counselling agencies
• financial advisers who are relevant providers, excluding provisional and limited-service time-share advisers
• mortgage brokers under the National Consumer Credit Protection Act 2009

Two things follow, and brokers tend to notice only the first.

The first is that brokers are in. You do not need to build accreditation to be handed CDR data this way.

The second is the catch. The OAIC’s guidance states that trusted advisers are not CDR participants and are not subject to the privacy safeguards, and that unless the adviser is also an accredited person the data “will no longer be subject to the protections and safeguards of the CDR system”. It remains subject to your professional obligations, and APP entities need to consider their Privacy Act position. In other words: the easiest pathway into the data is also the one that takes the data out of the regime that was protecting it, and lands the handling squarely on your licence and your office.

Worth noting separately, because it affects how a group structures this: the same guidance says mortgage aggregators are not a trusted adviser class, and neither are real estate agents. The named class is the broker.

Three pathways, three liability positions

The same client data can reach a broker business three ways, and they are not interchangeable. This is the framework worth taking to your licensee.

1. Trusted adviser (subrule 1.10C). Lowest build cost. The consumer gives a “TA disclosure consent” before anything is disclosed, under subparagraph 1.10A(1)(c)(iii), with the consent request following Division 4.3 of the rules — voluntary, express, informed, specific as to purpose, time limited and easily withdrawn. The data arrives outside the privacy safeguards. Your protection of it is your own.

2. CDR representative (rule 1.10AA). You stay unaccredited, but you operate under a written contract with an unrestricted accredited person — the CDR principal — and that contract must meet the minimum requirements in rule 1.10AA(2). Per the OAIC, a CDR representative must comply with Privacy Safeguards 2, 4, 8, 9, 11, 12 and 13 in relation to service data as if it were the principal; must limit use and disclosure to what the contract allows; must follow the principal’s CDR policy; must not engage outsourced service providers; and must delete service data when the principal directs, with records of deletion. The OAIC also states plainly that “the CDR principal is liable for the actions of the CDR representative when handling service data.” More obligations, more protection, and a counterparty with skin in the game.

3. Full accreditation. Heaviest lift, most control, and the only route on which the data stays inside the regime in your own hands.

The commercial point is that pathway choice is a business decision disguised as a compliance one. Pathway 1 is quick and leaves you holding the risk alone. Pathway 2 costs you process and gives you a principal who is accountable. Pathway 3 is a platform strategy, not a broker workflow.

Your aggregator’s paperwork is about to change, and here is why

Before CDR data reaches a trusted adviser, the accredited recipient has work to do under the rules. The OAIC’s guidance describes it: take reasonable steps to confirm the adviser is and remains a member of the class under subrule 1.10C(3), with re-verification about every 12 months as good practice, and a failure potentially breaching rule 7.6; tell the consumer the data will leave the CDR protections under subrule 8.11(1B); record on the consumer dashboard what was disclosed, when and to whom under subrule 7.9(3); keep records of the disclosure, the adviser’s identity and the verification steps under paragraphs 9.3(2)(eb) and (ec); and report the number of consents and advisers per class to the ACCC and the OAIC under subparagraphs 9.4(2)(f)(vi) and (vii).

There is also a limit that cuts against the obvious commercial temptation. Subrule 1.10C(4) says an accredited person must not make nominating an adviser, or consenting to disclosure, a condition of supplying goods or services, subject to the exception in subrule 1.10C(5).

Translated to a broker’s desk: expect to be asked to prove your credit licence or credit representative status, expect to be asked again roughly annually, and expect the consent screen your client sees to tell them, in terms, that their data is leaving the protected system when it comes to you. That last sentence is a client conversation. Better to have authored it than to be surprised by it.

This is a different mechanism from the credit reporting access seeker route this masthead covered on 8 October. That sits under the Privacy Act and the credit reporting framework. This sits under the CDR Rules. They are not substitutes, and a file note that confuses them is a file note that will not hold up.

The retention problem, stated honestly

Strip out the regulation and a plain commercial fact remains. A business that monitors a client’s loan continuously will know a client should move before the client does. A business that reviews annually will find out when the client calls — or when they don’t.

Brokers have a real advantage here and it is not technology. It is that the hard part of a refinance is placement, not detection: knowing which lender will take this self-employed borrower at this LVR with these last two years of returns. Detection is being automated. Placement is not.

The risk is only that detection gets automated by someone else, who then holds the trigger. The opportunity is that a broker who closes the detection gap keeps both halves.

What to review this week

1. Count your non-bank exposure. Pull the share of your book sitting with non-bank lenders, and flag which of those are likely to be “initial providers” on the $10 billion test. Those are the files touched first on 9 November.
2. Ask your aggregator one question in writing: which pathway are we on — trusted adviser, CDR representative, or accredited — and who carries the liability for the data once it reaches my office?
3. Find out what your clients are being shown. If a consent screen tells your client their data loses CDR protection when it comes to you, read that wording before a client reads it to you.
4. Check your verification trail. If an accredited recipient must confirm your class membership annually, decide now who in your business owns that and where the evidence lives.
5. Separate your review triggers from your data triggers. List the events you currently review on — fixed expiry, anniversary, rate move. Then list what you would review on if you had live repayment and balance data. The gap between those two lists is your retention exposure.
6. Price the pathway. Before buying a monitoring tool, establish which pathway it runs on. The cheapest integration is frequently the one that leaves the data outside the safeguards and the risk inside your licence.

What to watch next

Three dates and one unknown. 9 November 2026 for initial non-bank providers. 10 May 2027 for large providers. Twelve and 15 month tails for lenders qualifying after 13 July 2025. The unknown is whether broker-facing monitoring becomes an aggregator utility, offered as part of the CRM, or a product brokers buy separately and carry the compliance weight for themselves. That decision will be made by aggregators over the next two quarters, and brokers will have more influence on it if they ask the pathway question now than if they ask it after the integration ships.

The strategic takeaway

The open banking conversation has moved past data collection. UNO’s relaunch is not a better fact-find; it is a standing claim on the client relationship, built on the premise that the next refinance belongs to whoever noticed first. From 9 November, the lenders holding a meaningful slice of broker-placed business start supplying the raw material for exactly that.

Brokers get into that data more easily than almost anyone, because the rules name them. The work is in choosing the pathway deliberately rather than inheriting one, and in deciding whether detection is something your business does or something it waits for.