generated: '2026-07-20'
method: searched
source: DSB Consumer Data Standards + ACCC CDR Register (data-holder brand) + openapi
docs: https://www.gatewaybank.com.au/important-information/consumer-data-right-cdr/
standards:
- id: cdr-consumer-data-standards
  conforms: true
  evidence: Active ADI and ACCC-registered CDR data holder brand (id
    298987af-3ead-eb11-a822-000d3a884a20, ABN 47087650093); live PRD endpoint serving
    CDS Banking API v5 confirmed 2026-07-20.
- id: oauth2
  conforms: true
  evidence: Consumer-data surface uses OAuth2 authorization_code (CDR security profile).
- id: openid-connect
  conforms: true
  evidence: CDR security profile is OIDC-based; corporate site also serves an OIDC
    discovery document.
- id: fapi
  conforms: true
  evidence: CDR security profile mandates FAPI (PAR, PKCE, private_key_jwt/MTLS) for
    accredited Data Recipients.
- id: rfc8594-sunset-deprecation
  conforms: partial
  evidence: CDS version negotiation via x-v/x-min-v with 406 on unsupported versions;
    per-endpoint obsolete-version retirement rather than HTTP Sunset headers.
- id: rfc9457-problem-details
  conforms: false
  evidence: Uses the CDS ErrorV2 envelope (errors[].code URN), not
    application/problem+json.
- id: json-api
  conforms: false
compliance:
  regulator: APRA (Authorised Deposit-taking Institution)
  regime: Australian Consumer Data Right (CDR / Open Banking)
  status: active data holder
  register: https://api.cdr.gov.au/cdr-register/v1/banking/data-holders/brands/summary
  note: Regulatory compliance posture is externally verifiable via the ACCC CDR
    Register; the bank publishes no SOC 2 / ISO 27001 / PCI trust-center program.