Open Banking in the Broker Channel: The 2026 Picture
Figures from Frollo’s State of Open Banking 2026 report, built on Frollo and NextGen data.
Scale
Where the consent journey breaks
At three of the largest banks examined, around two in three abandoned consents occur in steps 2 and 3 — on the bank’s infrastructure, not yours.
Broker Daily’s coverage of the report puts CBA’s abandonments at 278,553 in FY25–26 with 38.8% during pre-authentication, Macquarie’s at 44.3% pre-authentication, and ANZ’s at 57.9% pre-identification. These appeared in that outlet’s reporting rather than across the trade press.
Reliability vs volume, FY25–26
Errors reported rising roughly three times faster than usage. Error figure per Broker Daily’s reporting.
Reported increases were largest at Westpac, St.George, Macquarie and NAB, with 10 of the 15 largest data holders recording a rise.
Consumer vs business files
Figures reported by Lisa Schutz, founder and CEO of Verifier. The manual nominated representative process is identified as the cause.
Most abandoned consents fail on your client’s bank’s screens, before any data reaches your file. You cannot fix that step — so the value sits in the explanation you give beforehand and the fallback you define in advance.
Two in Three Abandoned Open Banking Consents Die in the Bank’s First Two Steps
Frollo’s State of Open Banking 2026 report confirms the broker channel has adopted the technology. The number worth your attention is not the growth rate — it is where the consents fail, and who controls that step.
The short version: Open banking is now embedded enough in broker workflows that its failure modes, not its benefits, are the operational story. Most abandoned consents collapse at the client’s own bank, before the client ever reaches an account-selection screen. That makes a failed consent a file-sequencing and record-keeping decision — one ASIC’s best interests duty guidance already has language for.
What the 2026 report actually measured
Frollo released its State of Open Banking 2026 report this week, built on its own data and that of its parent company NextGen, which operates the ApplyOnline lodgement platform. The headline figures describe a system that has left the pilot phase behind.
Active Consumer Data Right authorisations reached 1,347,328 in June 2026. Consent volumes grew 4.83 times across the 24 months to that point. API invocations hit 4.48 billion in FY25–26, up 125% year on year. Applications using open banking data through NextGen rose 234% over FY25–26, and by September 2026 10.1% of all loans submitted through ApplyOnline used open banking data. Roughly 120,000 consents have been completed with a mortgage broker.
Tony Thrassis, Frollo’s head of open banking markets and compliance, put the shift plainly: “The foundations are in place, and the momentum is real.” He added that “the question is no longer whether Open Banking works” but “how quickly we can make it work for everyone.”
Wendy den Hartog, chief operating officer at Beyond Bank Australia — which the report profiles as a case study, reporting applications turned around about 50% faster than under its previous process — described the same change from the lender side: “Now it’s no longer whether it’s something that you want to adopt.”
That is the version of this story most outlets ran. It is accurate, and for brokers it is also the least useful part of the report.
Where consents break — and why it is not your software
The more operationally relevant finding is about abandonment. The report examined the consent journey at three of the largest banks and found that around two in three abandoned consents happen in the first two steps at the bank — the point where the consumer identifies themselves and completes authentication, typically by entering a one-time passcode.
Read that carefully, because it relocates the problem. Those two steps do not happen in your CRM, in your aggregator’s platform, or on a screen you control. They happen on the client’s own bank’s infrastructure, after your link has done its job. By the time a consent fails at that stage, the client has not rejected data sharing, declined to proceed, or changed their mind about you. They have run into a login flow.
Broker Daily, reporting on the same report, published a bank-level breakdown that sharpens the point considerably. On its account, CBA recorded 278,553 abandoned consents in FY25–26, with 38.8% occurring during pre-authentication; Macquarie saw 44.3% of abandonments at the pre-authentication stage; and ANZ saw 57.9% at the pre-identification stage. Those figures appeared in that outlet’s coverage rather than across the trade press, so treat them as its reading of the report rather than as settled industry data — but the pattern they describe is consistent with the aggregate finding that every outlet reported.
The report’s own conclusion on this, as quoted in that coverage, is that the inconsistency between banks shows “the consent experience isn’t standardised, and that confuses consumers.”
The practical consequence: which institution your client banks with is a variable in whether your consent request completes. That is not something you can fix, but it is something you can plan around — and planning around it is cheaper than discovering it on a file with a finance clause running.
The reliability problem sitting underneath the growth
There is a second finding that complicates the optimistic reading. According to Broker Daily’s coverage, server-side errors across all data holders rose 355% in FY25–26, against that 125% rise in API invocations — errors growing roughly three times faster than volume. It reports that 10 of the 15 largest data holders saw errors increase, with the largest rises at Westpac, St.George, Macquarie and NAB, and that the report concludes infrastructure has “not scaled proportionally” with demand.
Again, that specific breakdown sits with one outlet. But it is corroborated in direction by material the report’s own publisher put on the record: Frollo lists “reliability must keep pace with growth” as one of the report’s six themes, and Thrassis named “reliable infrastructure at every bank” among the friction points the industry already knows about.
For a broker, errors growing faster than volume has one practical translation: on these figures the error rate per call rose rather than fell as adoption grew. Your workflow needs a defined second path, not an exception process you improvise.
A failed consent is a BID decision, not an IT annoyance
This is where the report stops being a technology story. Best interests duty obligations for mortgage brokers sit in Part 3-5A of the National Consumer Credit Protection Act 2009, and ASIC’s expectations are set out in RG 273 Mortgage brokers: Best interests duty, issued 24 June 2020. Three paragraphs of that guidance speak directly to a file where the data did not arrive.
RG 273.35 starts from the assumption that you will need more than the client first offers: “The information initially disclosed by consumers will often be insufficient for you to identify the consumer’s individual circumstances and do the analysis necessary to recommend products based on what would be in their best interests.”
RG 273.40 then addresses incomplete information directly: “If it is reasonably apparent that the information about a consumer’s individual circumstances is incomplete or inaccurate, you should make further inquiries to obtain complete and accurate information.”
And RG 273.41 sets the outer limit: “If critical information is not obtained when inquiring about a consumer’s circumstances, you should refrain from making a recommendation.”
Note what that guidance does and does not say, because the distinction matters. A failed open banking consent is not, by itself, a reason to stop a file — a consent that collapses at an OTP screen tells you nothing about the client’s circumstances, and statements obtained another way may give you everything you need. What RG 273.41 addresses is the different situation where critical information is simply never obtained and a recommendation is made anyway. The fallback path is precisely what keeps a file on the right side of that line.
RG 273.162 is the companion obligation on records: “As a mortgage broker, we expect you to keep records of how you have acted when providing credit assistance. This includes records of inquiries you make into the consumer’s circumstances, and the consideration, investigation and assessment of the products you recommend.” On ASIC’s stated expectation, how you obtained the client’s financial information — and what you did when the first attempt failed — is part of the record of your inquiries.
None of this is legal advice, and RG 273 is ASIC guidance on its expectations rather than the operative provision itself. Your licensee or aggregator’s compliance team is the right place to settle how your own file standard should handle a failed consent.
What the adoption numbers do and do not tell you
One figure in the trade coverage deserves care. Broker Daily reports that open banking features in 35% of mortgage applications submitted through NextGen, and that up to 60% of brokers at Connective and Mortgage Choice use it regularly, both aggregators reaching that level within six to eight months. That 35% sits well above the 10.1% platform-wide figure for September 2026 that appeared across multiple outlets.
Those numbers are not in conflict — they describe different populations — but the gap is the interesting part. On the most straightforward reading, it suggests adoption is concentrated rather than evenly spread: platform-wide averages are pulled down by brokers and lenders who have not switched on, while firms that have committed are running at multiples of the average. If that reading is right, the competitive question is not whether open banking becomes standard. It is whether you are in the group where it already is.
The efficiency case, as reported, is not marginal. Broker Daily cites one Mortgage Choice office handling roughly 40 deals a week that estimates open banking saves at least an hour per deal on data collection. The named brokers quoted in that coverage are more measured about the client-facing side. Peter Liu, a practising broker and co-founder of AutoCalc, noted that clients often still prefer providing statements, and that “a clear explanation of what clients are authorising and how their information will be used would help.” Kellie Crocker, a partner at RLA Finance in Townsville, pointed to client frustration with unsuccessful attempts and limited understanding of the technology.
Those two observations are the same observation. Consent friction is a client-communication problem as much as a technical one — and the part you control is the explanation you give before the client taps the link.
Business clients are a different problem entirely
If you write commercial, asset finance or self-employed files, the report’s small-business findings matter more than its consumer ones. The nominated representative process — the mechanism that lets a person share data on behalf of a business — remains manual and inconsistent between banks.
The numbers attached to that are stark. Lisa Schutz, founder and chief executive of Verifier, reports drop-out rates of 50–60% for business consumers using the CDR, against 3% for her firm’s consumer lending applications. Her assessment of the regime overall was positive — “We’re finding CDR fantastic” and “it’s working really well for Verifier and its consumer lending customers” — followed by the qualification that “we just need the same for business consumers.”
Rehan D’Almeida, chief executive of FinTech Australia, framed the sequencing: “The moment we get nominated representative clear, then opening this up to SMEs becomes really important. It’s not just accounting; it opens up to lending and cash flow.” Until that happens, treat open banking as a consumer-file tool and plan commercial data collection the way you always have.
Policy worth tracking
Modelling by Lateral Economics for FinTech Australia, cited in the report, puts the value of three CDR policy changes at an estimated $1.2 billion a year to the economy by 2035: not proceeding with a proposed de minimis exemption for smaller banks, introducing a new third-party disclosure consent, and streamlining nominated representative arrangements for business. Frollo opposes allowing ADIs with under $5 billion in resident assets to exit the CDR, arguing it would fragment the system and push users back toward screen scraping.
What to review on your files this week
- Write the explanation once, and reuse it. Two sentences on what the client is authorising, what you will see, how long access lasts and how they revoke it. Both brokers quoted in the coverage identified explanation as the gap. This is the cheapest intervention available to you.
- Decide your fallback before you need it. Define now what happens when a consent fails: how long you wait, whether you retry, when you switch to statements, and who in your team does it. An undefined fallback becomes a stalled file.
- Do not make open banking the only path on a time-critical file. On a file with a finance clause or an auction date, send the consent request early enough that a failure costs you a day rather than the deal.
- Ask where the client banks before you send the link. You are already asking. The report’s finding simply means the answer carries operational information about how smoothly the next step is likely to go.
- Note the method, not just the outcome. Record how the client’s financial information was obtained and what you did if the first attempt failed. RG 273.162 sets out ASIC’s expectation that records cover the inquiries you make.
- Keep commercial files on the conventional path. With business drop-out rates reported at 50–60%, open banking is not yet the efficient route for an SME or self-employed file.
Key takeaways
- Open banking adoption in the broker channel is now substantial: 234% growth in applications using it through NextGen in FY25–26, and 10.1% of ApplyOnline lodgements in September 2026.
- Around two in three abandoned consents, at three of the largest banks examined, fail in the first two steps at the bank — identification and authentication — not at a stage you control.
- One outlet’s reading of the report puts server-side errors up 355% against 125% growth in API calls — errors growing faster than volume, which means the error rate per call rose rather than fell.
- A failed consent is not, by itself, a reason to stop a file. ASIC’s BID guidance speaks to obtaining complete information where it is reasonably apparent that information is incomplete, and to keeping records of the inquiries you make.
- Business-client data sharing remains the weak point, with reported drop-out rates of 50–60% against 3% for consumer applications.
The strategic read
The easy conclusion from a report like this is that brokers should adopt open banking. Most of the channel has already heard that, and a meaningful part of it has acted. The harder and more useful conclusion is that adoption is no longer the differentiator — competence at the failure path is.
Two brokers can use the same platform, send the same consent request to the same client at the same bank, and get different outcomes depending on whether they explained the authorisation properly beforehand, whether they built a defined fallback, and whether they recorded what they did. None of that is technology. All of it is process, and process is the part of this that sits entirely inside your business.
The infrastructure will improve; the report’s own authors are explicit that reliability has to catch up with volume, and the policy agenda for business data sharing is live. In the meantime, the brokers who get the value out of open banking in 2027 will not be the ones with the best tools. They will be the ones whose files do not stall when the client’s bank drops the connection.
Breaking news for modern brokers
Lender policy shifts, regulator activity and market data — read through the lens of what it changes on your files.
More at The Broker Times →The Consent Failure Playbook
Two working tools: what to do before you send a consent request, and what to do when one fails.
Most abandonments happen at the client’s bank, in steps you do not control. These are the steps you do.
Select what happened. Each option gives the practical next step and the file-note prompt that goes with it.
This is the most common failure point and it tells you nothing about the client’s circumstances or willingness. Re-send once if the client is available, then switch to statements rather than letting the file idle. Do not read it as client reluctance.
File note prompt: consent request sent [date]; not completed at data holder authentication; financial information obtained by [method] on [date].
A legitimate client choice, and brokers quoted in the coverage say it is common. Take the statements. Before you do, offer the one-paragraph explanation of what sharing would involve — hesitancy is reported to track with limited understanding rather than firm objection.
File note prompt: data sharing explained and offered; client elected to provide statements directly.
A partial data set needs the most care, because the file can look complete when it is not. ASIC’s guidance speaks to this: RG 273.40 states that where it is “reasonably apparent that the information about a consumer’s individual circumstances is incomplete or inaccurate, you should make further inquiries to obtain complete and accurate information.” Reconcile what arrived against what the client told you, and close the gaps before you assess.
File note prompt: accounts received [list]; accounts missing [list]; further inquiries made by [method]; gap resolved [date].
Expect friction. The nominated representative process is reported as manual and inconsistent between banks, with business-consumer drop-out of 50–60% against 3% on consumer files. Plan the conventional document path as the primary route on these files rather than the exception.
File note prompt: business file; financials and bank statements obtained directly from client / accountant on [date].
Stop waiting and move. One re-send attempt, then the document path, in parallel rather than in sequence. Where critical information cannot be obtained at all, RG 273.41 states that “if critical information is not obtained when inquiring about a consumer’s circumstances, you should refrain from making a recommendation” — which is the reason the fallback exists.
File note prompt: deadline [date]; consent not completed by [time]; document path commenced [date]; client informed [date].
Before you change your file standard
RG 273 sets out ASIC’s expectations rather than the operative provision itself, and the file-note prompts above are general illustrations, not templates approved for your licence. Settle your own standard with your licensee or aggregator’s compliance team.
Disclaimer: This article is for general information and professional development purposes only. It does not constitute legal, compliance, or financial advice. Brokers should consult their aggregator’s compliance team and, where required, seek independent legal advice regarding their obligations under the National Consumer Credit Protection Act 2009 and ASIC’s responsible lending guidelines.
