Consumer-Driven Banking Regulations

Summary#

The government has published draft Consumer-Driven Banking Regulations under the new Consumer-Driven Banking Act. The rules set out how Canadians can share their bank and transaction data securely with approved providers, and they put the Bank of Canada in charge of accrediting and supervising participants. The Canada Gazette notice was published June 27, 2026, and the public can comment for 60 days.

What it does#

• Establishes an accreditation system so only approved providers can take part in a new data‑sharing system. The accreditation fee is $2,500 (adjusted for inflation).
• Puts the Bank of Canada in charge of a public registry and supervision of participants.
• Requires participating firms to meet security, record‑keeping and reporting rules, including keeping records for 5 years and reporting breaches quickly.
• Sets technical and service standards, including that API endpoints be available 99.5% of the time each month and that at least 24 months of consumer transaction history be available on request.
• Splits responsibilities and liability: the data requester is responsible for getting consent and receiving data securely; the data provider must authenticate the consumer.
• Creates a national‑security review process for applicants. The Minister of Finance has 60 days to decide whether to review an application (extendable by 60‑day blocks), and a review period is 180 days (also extendable).
• Defines who must notify the Bank and customers when accreditation is revoked or when a provider exits the system.
• Includes administrative penalties with maximums of $1,000,000 for individuals and $10,000,000 for entities for designated violations.
• Keeps the ban on screen‑scraping in the law but says the ban will be brought into force later after more consultation.

Who's affected#

• Canadians who want to share their bank, payment, investment and lending account data with third‑party apps or services.
• Banks and other federally regulated financial institutions (some large banks will be mandated to join).
• Provincial credit unions and other provincially regulated institutions that choose to opt in.
• Fintechs and other third‑party businesses that would apply for accreditation or act as accredited third‑party service providers (ATPSPs).
• Payment service providers already registered under the Retail Payment Activities Act.
• Bank of Canada, which will run the registry and supervise compliance.
• The designated external complaints body and a technical standards body (both must meet reporting and fee requirements).
• It is unclear from the notice exactly which smaller niche providers will meet every accreditation path; the rules create multiple application pathways and some exemptions for provincially regulated entities.

Why it matters#

• Consumers will have a clearer, regulated way to share their financial data with apps that offer budgeting, switching services, credit assessments, and other tools.
• The rules aim to replace risky practices like “screen scraping” with secure API‑based sharing, reducing the need to give out bank login credentials.
• The regulations set security, transparency and liability rules so people have more protection if something goes wrong.
• There are costs to businesses: the government estimates $457.7 million in total present value costs to industry over 10 years but projects $13.2 billion in monetized benefits over the same period. These are preliminary estimates and do not capture every possible benefit or cost.
• The national‑security checks and the Bank of Canada’s oversight mean some applicants could be refused on security grounds.
• The consultation period and staged roll‑out give stakeholders time to comment and to prepare before all parts take effect.