CDR consent duration
CDR consents last 7 days, 90 days, or up to 12 months; you pick at the bank's consent screen. Here's how to choose, what happens at expiry, and how to renew or revoke.
19 Oct 2026
You authorise on your bank’s consent screen.
Any day
Revoke from your bank or BankSync. Fetches stop.
19 Oct 2027
Consent expires. Renew with one re-authorisation.
About two weeks before expiry, BankSync reminds you in the app and by email.
CDR consents last 7 days, 90 days, or up to 12 months. 12 months is the maximum allowed under CDR rules. You pick the duration at the bank's consent screen. The consent expires automatically; you can revoke it earlier from your bank or the recipient's app at any time.
The three durations.
- 7 days
- Best forA one-off task, like a tax-time export or a single financial review.
- TradeoffYou re-authorise often if you keep using the connection.
- 90 days
- Best forShort-term projects, quarterly reporting, or testing a new tool.
- TradeoffQuarterly re-consent prompts; not ideal for set-and-forget workflows.
- 12 months (max)
- Best forOngoing automation: budget tracking, AI agents, dashboards, accounting feeds.
- TradeoffYou re-consent once a year; in exchange, the connection just works.
What happens at expiry.
When a consent expires, the Accredited Data Recipient (or its CDR Representative) loses the right to fetch new data from the bank. The recipient's CDR Policy governs what happens to data already received. Common patterns:
- Data is retained but flagged read-only, in case you re-consent and want history continuity.
- Data is de-identified for analytics.
- Data is deleted in line with the policy and your account settings.
How to revoke early
You can revoke at any time, no questions asked, from either side:
- From your bank: every ADI must provide a CDR consent dashboard (look for "Data sharing" or "CDR" in your internet banking).
- From BankSync: open a connected bank in your dashboard and click "Revoke consent".
Both actions take effect immediately and propagate within minutes. The consent record remains in the audit trail for both you and the bank.
Questions, answered.
How long does a CDR consent last?
You choose at consent time: 7 days, 90 days, or up to 12 months. 12 months is the maximum permitted under the CDR rules. Once it expires, the recipient cannot fetch new data until you re-authorise.
Can I change the duration after I consent?
No. The duration is locked in at the consent step. To change it you must revoke the existing consent and create a new one with your preferred duration.
What happens when a CDR consent expires?
New data fetches stop immediately. Data already received and stored under the consent remains subject to the recipient's CDR Policy and CDR rules around retention and deletion. Some recipients de-identify or delete on expiry; others retain it as authorised by you.
How do I renew a CDR consent?
Most accredited recipients send a reminder before expiry with a one-click re-consent flow that takes you back to your bank. BankSync prompts renewal in-app and via email roughly two weeks before expiry.
How do I revoke a CDR consent early?
Two ways. (1) From your bank app or internet-banking dashboard, every Authorised Deposit-taking Institution must offer a CDR consent dashboard. (2) From the recipient's app, BankSync, like every accredited provider, has a "Revoke" button in the bank-connection settings.
Why are there only three duration options?
CDR rules cap consent duration at 12 months and standardise the choices to make the user experience predictable and revocation reliable. Any duration over 12 months would breach CDR rules and require fresh consent.
Does BankSync use the maximum 12-month duration by default?
BankSync defaults to 12 months because it minimises consent fatigue, but you choose at the bank's consent screen. If you prefer 90 days for a one-off project, pick that, BankSync handles renewal prompts automatically.