Consumer-Driven Banking Regulations

Summary#

The Canada Gazette published a proposal called the Consumer-Driven Banking Regulations on June 27, 2026. The rules would put in place a government‑led "open banking" system under the Consumer-Driven Banking Act and give the Bank of Canada the job of supervising who can access and share people’s financial data. This is a proposal (not law yet) and the government asked for feedback for 60 days.

What it does#

• Sets up a supervised framework to let people and businesses share their bank, payment, investment and lending data with approved providers using secure APIs. Phase one is limited to “read‑only” data sharing.
• Creates accreditation paths and rules for:
  • banks and other financial institutions,
  • payment service providers (PSPs),
  • fintechs and other businesses,
  • accredited third‑party service providers (called ATPSPs).
• Requires security, consent, record‑keeping and reporting rules (including breach reporting and investigations).
• Sets minimum technical standards such as endpoint availability of 99.5% per month and access to at least 24 months of account history.
• Defines consent rules (normal consent periods no longer than 12 months and specific triggers that force earlier renewal).
• Builds in national security checks led by the Minister of Finance with timelines (Minister has 60 days to decide to review; a full review runs up to 180 days, with possible extensions).
• Introduces fees and cost recovery:
  • one‑time accreditation fee of $2,500 (adjusted for inflation),
  • annual assessment base fees for participating entities from $10,000 up to $150,000 (depending on asset size),
  • annual fees of $50,000 for the external complaints body and $10,000 for ATPSPs.
• Allows the Bank of Canada to impose administrative penalties. Maximum penalties are $1,000,000 for individuals and $10,000,000 for entities.
• Keeps a staged approach for bringing parts of the rules into force and delays a full ban on screen scraping for later policy work.

Who's affected#

• Everyday bank customers and small businesses that may want to share account data with budgeting apps, lenders, or comparison tools.
• Incumbent banks and federally regulated financial institutions required to participate if mandated by the Minister.
• Fintech companies, PSPs and other private sector providers that want to take part or act as service providers.
• Accredited third‑party service providers (ATPSPs) that perform consent, authentication or data movement services.
• Provincial credit unions and other provincially regulated institutions that may choose to opt in.
• The Bank of Canada, the Minister of Finance, and new bodies such as a designated technical standards body and an external complaints body.
• The government estimates about 680 affected businesses at the start, of which about 578 would be small businesses. The analysis also assumes roughly 9 million Canadians (about 27%) might use these services early on.

Why it matters#

• It aims to give people more control over their financial data and make it easier to switch services, compare offers, or get new kinds of financial products (for example, tools that improve budgeting, find cheaper subscriptions, or help lenders assess credit more fairly).
• The government’s cost–benefit analysis estimates monetized benefits of $13.2 billion (present value over 10 years) against costs of $457.7 million, for a net benefit of about $12.7 billion (present value). These are estimates and many benefits are hard to quantify.
• It replaces the common but insecure practice of “screen scraping” with a supervised, API‑based system (the scrape ban itself is to be phased in later).
• There will be new compliance costs and rules for businesses, which are expected to fall mainly on institutions and service providers. Small businesses could face proportionally larger burdens than big firms.
• This is still a proposed regulation. Stakeholders had 60 days to comment after publication and the rules must go through the formal regulatory process before they take effect.