Is open banking safe in NZ? Akahu and read-only access explained

Open banking is a secure way for you to let another app see your bank information, or in some cases make a payment, through a connection your bank provides.

Instead of handing an app your online-banking login, you're sent to your bank, you sign in there, and you approve exactly which accounts the app can see. The app gets a secure key for that permission, not your password.

The Customer and Product Data Act 2025 created New Zealand's consumer data right, and regulations under it apply to banking.

• ANZ, ASB, BNZ and Westpac have had to provide open banking since 1 December 2025.
• Kiwibank follows: payments from 1 June 2026 and account information from 1 December 2026.

The regulations set rules for how banks share data, how your consent works and how accredited apps must handle it. For the official detail, see MBIE's open banking page.

Akahu is a New Zealand open finance platform. Many NZ apps, Korin included, use it to connect to banks rather than building a separate connection to each one.

When you connect a bank in one of these apps, Akahu takes you through your bank's approval steps and then passes the data you approved to the app. Akahu has its own privacy notice and terms for what it does with your data, and the app has its own for what it does.

Read-only access means an app can see information, such as balances, transactions and account names, but can't do anything: it can't transfer money, pay bills or change your account.

Open banking can also be used for payments, where an app asks permission to start a payment from your account. That's a separate, explicit permission. Read the approval screen so you know which one you're giving.

Korin only asks for read-only access. It can't move money or make payments.

Open banking is designed to be safer than sharing a password, but it isn't risk-free. Most of the risk is about who you share data with and what they do with it.

• Only connect apps you trust. Check who runs the app, where it's based and how to contact them.
• Read the privacy notice. Look for what data is kept, for how long, and how to delete it.
• Never give an app your bank password or one-time codes. You should only ever enter them on your bank's own pages.
• Watch for scams. Your bank or a real app won't phone or text you asking you to approve a connection or read out a code.
• Remove access you no longer use. Fewer connections means less data in fewer places.

You can withdraw access whenever you like:

• In the app. Most apps have a disconnect option. In Korin, open Accounts and choose Disconnect on the bank.
• With your bank. Banks that offer open banking let you see and manage the connections you've approved. Look in your banking app's settings or security section.
• Delete your data. Disconnecting stops new data being shared; ask the app to delete what it already holds if you want it gone. In Korin, see How do I delete my account and data?.