Consumer-Driven Banking (Open Banking Canada)

Government of Canada (via Department of Finance), with oversight and enforcement by the Financial Consumer Agency of Canada (FCAC) under the new Consumer-Driven Banking Act.

Canada

Banking

• Banking / financial accounts, transactions
• Lending products (credit cards, lines of credit, mortgages)
• Investments and deposit products may also be included under phases
• Consent and permissioned data sharing

• Consumers must have control over their data, give explicit permission, and clearly understand what information is being shared.
• Consent should be limited in duration, easy to withdraw, and clearly communicated to users.
• Reciprocity: accredited entities must enable data sharing under a shared rulebook.
• One unified technical standard will be chosen to ensure interoperability, along with consistent requirements for privacy, liability, and security (e.g., the FDX API).
• Accreditation and supervision will be managed by the FCAC, supported by a publicly accessible registry of participants.

JSON

• Banks that exceed a specific size threshold will be required to participate.
• Other federally regulated institutions, including credit unions, can choose to join voluntarily.
• Accredited third-party providers (fintechs) will be permitted to request data based on consumer authorization.

• It offers safe and consumer-driven data sharing
• It has common technical standard across the country
• It comes with reciprocity and interoperability
• It gets oversight by FCAC, with accreditation, liability, security, privacy rules
• It has public registry of participants
• It offers transparency, governance, consumer protections

• Authentication & authorization: expected to leverage OAuth2, OpenID Connect, FAPI (global best practices)
• Encryption: use of TLS, secure transport
• Token-based access, scope enforcement
• Auditing, logging, monitoring, rate limiting
• Incident management, oversight
• Strong privacy, liability, and security obligations in common rules, based on a principle that liability follows the data

• Once the framework is live, the FCAC will release the technical standard, accreditation requirements, participant registry, and all public documentation.
• The government will also create educational materials for both consumers and industry stakeholders.

• The concept and consultations started years ago, with open banking appearing repeatedly in earlier financial sector discussions.
• In the 2024 budget, the government formally committed to the framework, and the Consumer-Driven Banking Act was enacted in June 2024.
• By December 2024, the Fall Economic Statement released the “Complete Framework,” outlining the roadmap toward implementation by 2026.

• Accreditation compliance, audits, oversight and enforcement via FCAC
• Participants must follow common rules, reporting, logging, security requirements
• Incident reporting obligations, liability provisions

• FCAC will oversee, manage, and enforce the framework.
• The Department of Finance will continue to hold responsibility for policy and legislation.
• A new Senior Deputy Commissioner for Consumer-Driven Banking will be appointed within the FCAC.
• Unified rules will cover liability, privacy, security, national security, and integrity requirements.

• Consumer-Driven Banking Act (2024) establishing the legal foundation.
• Other enabling regulations and amendments to FCAC’s mandate and regulatory controls.
• The Consumer-Driven Banking regulation is set to be clarified and expanded in 2026.