The MFAA Has Asked Treasury for ATO Data at the Fact-Find, Not After Lodgement. The CDR’s Trusted Adviser Class Is Built on s 15B — and Your Commercial Files Sit Outside It

Most of the coverage has landed on the obvious part. Brokers and lenders would stop chasing payslips, tax returns, notices of assessment and BAS, because the ATO already holds or receives most of that information. The MFAA puts the problem plainly: the current document-based process “creates opportunities for documents to be altered or fabricated”.

That is the productivity story, and it is real. It is not the part of this submission that should interest you most. Two of the ten recommendations go to the structure of the broker channel rather than its paperwork, and between them they decide two separate things: when verified income data would reach you, and whether it would reach you at all on a meaningful share of your files.

What the submission actually asks for

The MFAA supports including relevant ATO-held data in the CDR for both lending and fraud mitigation, subject to consumer protections and practical implementation. Its priority datasets are specific: PAYG and Single Touch Payroll income information, relevant self-employed and business taxation information, BAS, notices of assessment, HELP debts and tax liabilities, with other income categories considered where useful.

The reason it wants tax data on top of open banking is a distinction worth holding onto, because it is the same distinction that shows up in your own files. Banking data, the submission notes, can show salary credits, spending, balances, loan repayments and cash flow, but “does not necessarily identify the source, gross amount, components or sustainability of income”. A regular deposit does not establish an employer’s reported gross pay, tax withheld, or whether a payment reflects overtime or a bonus. ATO-held data could.

Attachment B sets out eleven indicative field rows for Treasury to assess, from employer identity and year-to-date earnings through to BAS periods, outstanding tax liabilities and reported rental income. The MFAA is explicit that this is “a request for feasibility assessment, not an assertion that every field is currently held in a CDR ready form”. It also asks for data minimisation by design, full returns only where discrete fields will not do, and tax file numbers excluded from shared datasets altogether.

The real fight is about timing

The submission sets out three potential operating models and says which one it wants.

Under Model 1, the consumer authorises access during the broker’s fact-find, before the broker determines options or prepares an application, with the fields later made available to the lender where authorised. Under Model 2, broker and lender each obtain the data under their own consent arrangements. Under Model 3, access is limited to the lender after lodgement.

The MFAA “strongly supports Model 1”. Its objection to Model 3 is the line in this submission that should matter most to anyone running a broking business: it “would prevent brokers from accessing relevant ATO information during the initial assessment of a consumer’s circumstances, limiting the benefits of the reform and potentially creating an uneven playing field between broker and lender distribution channels”.

Sit with the commercial consequence. If verified income data arrives only after lodgement and only in the lender’s hands, then a bank’s own channel is assessing a customer against government-sourced income data at the point of recommendation while you are still assessing against documents the client emailed you. You would carry the best interests duty on that recommendation. They would not.

The s 15B problem for diversified brokerages

Here is the part almost nobody is talking about.

The CDR already has a mechanism for getting data to a broker without the broker becoming an accredited data recipient: the trusted adviser framework. Under subrule 1.10C(2) of the CDR Rules, as set out in OAIC guidance, the prescribed classes are qualified accountants under the Corporations Act 2001; persons admitted to the legal profession holding a current practising certificate; registered tax agents, BAS agents and tax (financial) advisers; financial counselling agencies; financial advisers who are relevant providers, other than provisional and limited-service time-share advisers; and mortgage brokers within the meaning of the National Consumer Credit Protection Act 2009.

That last class is the one that covers you, and it borrows its definition from s 15B of the National Credit Act. ASIC restates that definition at RG 273.7: a mortgage broker is a person who carries on a business of providing credit assistance in relation to credit contracts secured by mortgages over residential property, does not act as the credit provider for most of those contracts, and provides credit assistance for credit contracts offered by more than one credit provider.

Read it against the business you are actually building. The definition is anchored to residential-secured credit assistance, and the MFAA says the consequence directly: the existing trusted adviser classes “do not expressly encompass the broader finance broking sector, including commercial and asset finance brokers who do not otherwise fall within the statutory definition of a mortgage broker”.

Diversification is the growth strategy the entire channel has been urged toward for three years. On the current drafting, the verified-data channel would follow the residential file and stop at the commercial one. Same client, same brokerage, same adviser — two standards of evidence.

The irony is that the commercial side carries the heaviest document burden. Business finance applications, the submission notes, commonly require BAS, business tax returns, financial statements and tax liability information, often obtained through multiple requests to owners and their accountants — the slowest part of a diversified book, and the part the reform would miss.

Recommendation 4 asks Treasury to close the gap, either by expanding the trusted adviser framework or through a broader third-party disclosure consent mechanism — an argument the MFAA says it first put to Treasury in an October 2025 submission on a proposed third party disclosure consent. It supports brokers participating “without necessarily requiring individual CDR accreditation”, provided consent, privacy, security and accountability safeguards hold.

What trusted adviser status does not give you

If you have assumed that receiving CDR data as a trusted adviser means the data stays inside the CDR’s protections, it does not.

In practice, the protection travelling with verified tax data into your CRM would be your own privacy, licensing and record-keeping framework — not the CDR’s. The MFAA flags this too, asking Treasury to consider whether tailored safeguards are needed given the sensitivity of taxation information, and to clarify how CDR retention and deletion requirements would interact with credit licensing record-keeping obligations.

More data does not lower the BID bar

There is a reading of this reform that treats verified ATO data as a compliance shortcut. It is not, and the regulatory guidance is reasonably clear about why.

ASIC separates the two information-gathering exercises. At RG 273.31, obtaining information for responsible lending purposes is a separate obligation from the best interests duty. At RG 273.32, information gathered for responsible lending “may help you to determine what is in the consumer’s best interests”, but “if additional information is needed to make that assessment, you will need to obtain that information from the consumer”. Verified income is an input, not an assessment.

The sharper edge is at RG 273.42: a mortgage broker who provides incomplete or inaccurate information as part of a home loan application will not be acting in the consumer’s best interests, “even if the inaccurate information would increase the likelihood of approval or give the consumer access to better terms”. And at RG 273.41, where critical information is not obtained, ASIC says you should refrain from making a recommendation at all.

Now add the obvious file-note question that arrives with a verified data channel: if government-sourced income data was available to you at the fact-find, why does the application carry a figure that does not match it?

The MFAA saw that coming and asked for proportionality in terms worth quoting, because it is a request rather than a rule:

Treasury has not answered that, and Recommendation 9 asks it to work with ASIC on exactly how access would interact with responsible lending and best interests obligations. Until that is settled, treat the proportionality point as an open question, not a settled protection.

The submission is also honest about the limits of the data itself. ATO-held information “is not necessarily independently verified or current”, and assessments can reflect earlier financial periods. Controls, it says, should focus on “provenance, relevance, timeliness and appropriate corroboration, rather than treating all ATO data as conclusive proof”. Attachment B makes the same point at field level — BAS sales are “not profit or necessarily cash receipts”, and taxable income “differs from lender adjusted serviceable income”.

One scope point is easy to miss. The best interests obligations apply only in relation to credit products regulated under the National Credit Act — credit for personal, domestic or household purposes, or for the purchase or improvement of residential investment property (RG 273.5). Your commercial and asset finance files sit outside RG 273 entirely. The evidence discipline there comes from lender policy and your licensee’s standards, which is a reason to set that standard deliberately rather than inherit it.

Who pays, and when

The MFAA declined to nominate a price threshold without proposed charging parameters, and instead asked Treasury to test per-access, per-application and reusable verification models — including who pays when a broker retrieves data and a lender subsequently needs the same information.

Its warning is specific and lands squarely on small businesses: “A fee charged before a broker has established whether an application is viable may deter early verification, undermining the productivity and fraud prevention rationale.” It also tells Treasury not to assume that an economic benefit to the lender will necessarily accrue to the broker who first requests the information.

If you run pre-qualification conversations that do not all convert — and everyone does — a per-request charge at fact-find is a direct cost on unpaid work. That is the detail to watch when a charging model is published.

How this got here

This submission is the second move, not the first. In April 2026, The Adviser reported an Australian Banking Association open letter to Treasurer Jim Chalmers — co-signed by the MFAA, COBA, AFIA and FinTech Australia — seeking consent-based access to ATO notices of assessment and tax return information, plus improved access to ASIC company registry data. It called a “single, authoritative source of income data” the most effective way to address potentially fraudulent applications and described current manual verification as “increasingly vulnerable to manipulation”. That letter landed while ASIC was making compliance inquiries with CBA, which had self-reported that it may have been the victim of mortgage fraud — a reported victim, not an allegation of wrongdoing by the bank.

What to review this week

What to watch next

A note on visibility. The submission responds to what the MFAA describes as Treasury’s consultation on including ATO data in the CDR, and refers to Treasury having “requested identification of particular fields”. Treasury’s public consultation hub does not list an ATO-data consultation among its open or recently closed items, which is consistent with a targeted process rather than an open call. Watch your association and aggregator updates rather than expecting to read the paper yourself.

Three dated items are worth diarising. Treasury’s Tackling fraud and financial abuse consultation opened on 14 October 2026 and closes on 27 November 2026, and document fraud in lending sits squarely inside it. Two CDR standards consultations — minimum baseline authentication, and FAPI 2.0 alignment — opened on 29 October 2026 and close on 26 November 2026; they are technical, but authentication standards are what determine how onerous a consent flow feels to a client sitting across from you.

The bottom line

Treat this as an access question, not a technology one. The datasets the MFAA has nominated are sensible and the fraud rationale is sound, but neither decides what this reform is worth to your business. Two things do: whether a consumer can authorise verified income data to reach you at the fact-find rather than reaching a lender after lodgement, and whether the definition of “broker” used in the CDR Rules stretches to the commercial and asset finance work the channel has spent years being told to take on.

Both are being decided now, in a process you probably cannot read. The brokers who will have something useful to say about it are the ones who spend an hour this week measuring their own document burden and their own revenue split — because that is the evidence this debate is currently short of.