Income-verified CommBank ID, straight from the Consumer Data Right

The idea

Renters prove income today by emailing payslips and bank statements to strangers. I think the Consumer Data Right can do better - the data already moves between banks under consent, it just needs somewhere safe to land and a way to share a conclusion rather than the raw statements.

So the income comes from Westpac, NAB or ANZ over CDR, with CommBank as the accredited data recipient. It lands in a CDR Data Pod - a per-customer encrypted store that runs only the programs the customer agreed to, works out income, issues zero-knowledge proofs and deletes itself when the consent ends. MATTR VII issues an mDoc "CommBank ID – Income Verified" into the ID Partners wallet SDK inside a mock CommBank app.

Every CDR participant is an authentic Ping CDR Kit participant on its own Ping stack, with its own server profiles. Nothing in the CDR leg is hand-rolled.

The journey, step by step

1. Renter

   Scan the listing

   The QR on the listing opens /rent/verify?listing=surry-hills-123. With the app installed, the universal link goes straight in; otherwise a fallback page offers a cbaapp:// button.

2. CommBank app

   Set up CommBank ID - and tick "Also verify my income"

   The usual set-up carousel, with a new toggle on page three, preselected from the QR. The app fetches the listing so it knows the rent and the income threshold.

3. CommBank app

   PIN, confirm PIN, review details

   Unchanged from the design file below.

4. PingAuthorize

   Ask for an offer, get sent to consent

   The app calls POST /offers. The gateway sees no income in the customer's pod and answers 302 into CDR consent. The app opens it in a secure browser session rather than following it.

5. CommBank (ADR)

   CDR consent at CommBank

   CX-standard screens: purpose, data clusters, two use consents (verify income, generate income proofs), sharing period, deletion election, then pick a bank.

6. Westpac / NAB / ANZ

   Log in at the bank and pick accounts

   The kit PingFederate pushes a signed request object (PAR) over mTLS. The customer enters their mobile, the demo OTP 000789, and selects accounts - joint accounts greyed out with a reason.

7. Ping CDR Kit

   Tokens stay in the kit

   The hybrid callback lands at the kit PingFederate, which swaps the code for certificate-bound tokens and stores them in the kit PingDirectory. The app gets cbaapp://consent-complete?status=success.

8. PingDataSync → Redis

   An event creates the pod

   PingDataSync watches the kit token store and publishes ArrangementEstablished - consent choices, no tokens - to Redis Streams. The pod runtime picks it up and creates a pod with a fresh data key.

9. CDR Data Pod

   Load, aggregate, commit

   The pod reads accounts and transactions through the kit's PingAccess, which injects the bank token. The income aggregator finds the salary stream and annualises net pay. A Poseidon commitment binds the figure. Meanwhile the app shows "Gathering your income…".

10. MATTR VII

    Issue the credential

    Income is ready, so the gateway lets the call through. The offers API creates a MATTR offer, the wallet signs in at CBA PingFederate, and MATTR's claim source pulls identity and income. The wallet stores "CommBank ID – Income Verified".

11. Agent

    Prove income ≥ threshold

    For a listing, the pod generates a Groth16 proof that income clears the threshold, signed over the commitment. The agent opens the link and sees "verified" - never the amount.

12. CDR Data Pod

    Delete in line with the CDR

    When the consent is withdrawn, expires or has served its purpose, the pod deletes that compartment. With no arrangements left it destroys itself and deletes its wrapped key - a crypto-shred.

Where it starts - the CommBank ID set-up design

The design reference is the in-app issuance flow: intro carousel → 4-digit PIN → confirm PIN → Review your details → Claim your ID card → Setting up → You're all set. The income path slots in after Review your details: CDR consent at CommBank and the bank, a wait screen while the pod loads, then the same claim and set-up screens with the richer credential.

What's where

Build progress

Straight from git log at build time.

1. 75e02e708 Oct 2026 08:05Deploy the PingAuthorize offers gateway to Railway; offers-api /offers is gateway-only
2. 7b6542a08 Oct 2026 08:02iOS: default to the Railway environment so device builds work off-network
3. 1fbd10608 Oct 2026 07:50iOS: log on through CBA PingFederate (auth code + PKCE) when CBA_PF_URL is set; Railway uses cba-pf
4. 57f1f7608 Oct 2026 07:30Set Apple team JH6RX4DRG2 for the iOS app and universal links
5. 7a52b8908 Oct 2026 07:24Deploy pod-runtime, zk-verifier, qr-landing and Redis to Railway; point iOS at Railway services
6. 720b20d08 Oct 2026 07:20Set up the hackathon1 MATTR tenant and deploy CBA PF and offers-api to Railway
7. 095e2b608 Oct 2026 06:56Initial hackathon build - CDR income verification via Ping CDR Kit and data pods