Canada’s Open Banking Framework Takes Shape

On December 16, the Canadian government released its Complete Consumer-Driven Banking Framework as part of its 2024 Fall Economic Statement for the year. The framework is built around three primary goals: 

1. To ensure financial safety and stability for Canadians
2. To protect consumers while giving them access to tools to make informed financial decisions
3. To promote competition and innovation in the financial services and fintech sectors. 

We’ve said it before and we’ll say it again – we believe that financial data should be accessible and actionable for all consumers to better enable decisions, experiences, and outcomes. We also believe that it increases competition, creates a more level playing field, and increases digital innovation to help improve financial outcomes for consumers. We are pleased to see the Canadian government moving forward with a framework to drive forward the safe adoption of Open Finance in Canada.

This framework comes just a few months after the U.S. published its final rule from the Consumer Financial Protection Bureau under Section 1033 of the Dodd-Frank Act to establish consumer data rights. While there are clear similarities and we know both the U.S. and Canada are committed to creating interoperable data-sharing standards, there are also some core differences. 

Core Framework Elements

Below is a quick overview of the complete framework and how it aims to benefit Canadian consumers: 

1. Governance: Oversight will be managed by the Financial Consumer Agency of Canada (FCAC). The framework will also include a new position, Senior Deputy Commissioner of Consumer-Driven Banking, responsible for overseeing compliance and consumer protection.
2. Scope: Initially, major retail banks will be required to participate, with other financial institutions (like credit unions) able to opt in. The scope of covered data includes checking and savings accounts, investment products available through online portals, and lending products such as credit cards and mortgages. The prohibition against screen scraping is intended to go into effect after the framework is fully operational, with a target date of early 2026. 
3. Accreditation: Canada’s framework includes a formal accreditation framework, inclusive of process, oversight, and criteria for entities wishing to collect consumer-permissioned data from data holders. Only accredited entities will be able to access consumer data. This ensures only trusted providers can participate in data-sharing, with the FCAC overseeing the accreditation process.
4. Common Rules: These rules will cover privacy, security, and liability, providing a consistent and clear framework for participants. Privacy will be especially protected, with consumers having control over which data is shared and for how long.
5. Privacy: The framework includes additional privacy rules that are unique to financial data sharing focused on consent management. Participants will be required to reconfirm consent at specified intervals (every 12 months) or following certain events. 
6. Liability: Liability under this framework is based on the principle that liability moves with the data and rests with the party at-fault if anything goes wrong. 
7. Security: Strong security measures will be in place to protect consumer data, with all participants required to meet a high standard for data protection. Ongoing audits will ensure compliance.
8. National Security: To safeguard the integrity of the financial system, the government will have powers to intervene in cases where national security or financial system stability is at risk.
9. A Single Technical Standard: The framework mandates the use of secure, standardized APIs, ensuring interoperability and alignment with global best practices. The government will mandate the use of a single technical standard.

Next Steps

The Consumer-Driven Banking Act was passed in June 2024, and additional legislation is slated to be proposed in the coming months to solidify key components such as accreditation and national security measures. The goal is to have the framework fully operational by early 2026. The FCAC will oversee the implementation and compliance of the framework, ensuring participants follow privacy, security, and liability standards. A new advisory committee will be established to ensure uniform guidelines and penalties.