Consumer-Driven Banking: New Details Set Out In Draft Regulations

In our last bulletin, we outlined the Bank of Canada’s mandate under the Consumer-Driven Banking Act (the “Act”) and discussed Bill C-15, which received Royal Assent on March 26, 2026; marking a significant milestone in the development of Canada’s consumer-driven banking legislative framework (also known as “open banking”).

Open banking allows consumers to securely share their financial data, held by their financial institutions, with third-party providers of their choosing.¹ Previously, Canadians lacked a secure way to share their financial data, leaving many to rely on “screen scraping”; a practice that requires handing over banking credentials and exposes consumers to security risks.² Open banking will allow Canadians to securely share their financial data while maintaining greater control over it.

Consumer-Driven Banking Regulations

On June 27, 2026, the Government of Canada released the Consumer-Driven Banking Regulations (the “Regulations“) for public consultation, with stakeholder input requested by August 26, 2026.³

Privacy Protections Under the Regulations

Among other things, the Regulations introduce a detailed consent management regime that restricts how participating entities may use consumer data. Under the framework, shared data may be used only for the purposes consented to by the consumer, except in limited exceptions, which include (i) reasonable investigations into contraventions of law, (ii) emergencies threatening life, health, or security, and (iii) publicly available data.⁴

Further, consent must also be renewed outside the standard 12-month cycle in specific circumstances, including where a consumer’s authentication information has been stolen or otherwise exposed to imminent risk.⁵

The Act grants consumers the right to request data deletion. The Regulations clarify that participating entities are not required to delete data that has been irreversibly anonymized but must notify consumers in writing where deletion is otherwise refused or delayed, including specifying when deletion will be completed, without requiring any further action from the consumer.⁶

Participating entities should note that obligations under applicable privacy laws, such as the Personal Information Protection and Electronic Documents Act (PIPEDA), will continue to apply.⁷ Compliance with the Act and Regulations will not automatically satisfy privacy laws. For example, while PIPEDA contains similar consent exemptions to those listed in the Regulations, PIPEDA’s exemptions are narrower in respect to publicly available information.⁸ A participating entity hoping to use publicly available information without consent must ensure it meets the exception under the Regulation, as well as a valid exception under applicable privacy laws.

What Banks Need to Know

While the Act does not apply to derived data, in-scope data is defined broadly in the Regulations to include identity data, account information, and the terms of products and services that are available or offered to consumers.⁹

While banks mandated to participate in the framework are not subject to the accreditation process, they remain fully subject to the so-called “common rules” that establish obligations related to privacy and consent, liability, security, national security and integrity.

As data providers, banks must authenticate consumers using multi-factor authentication upon receiving the first data request for any consent period, and bear liability for losses arising from that authentication process.¹⁰

Considerations for Non-Bank Service Providers

Unlike banks, most non-bank service providers (including fintechs) must go through the full accreditation process before participating in the framework.¹¹ Applicants must:

• have a place of business in Canada;
• hold sufficient insurance or a comparable guarantee covering data management risks;
• obtain independent third-party confirmation of their security safeguards;
• pay an application fee, which will be initially set at $2,500;
• implement an ongoing integrity and good character policy for key personnel; and
• comply with applicable technical standards to be established under s. 125(1) of the Act.¹²

As data requesters, they bear liability for the consent-seeking and data receipt portions of any transaction.¹³

What Comes Next

Implementation will follow a phased approach: accreditation requirements will come into force first, with the common rules and assessment fees taking effect at later dates. The full framework is intended to be operational within one year of final publication.¹⁴ With the draft Regulations now published, it is expected that the Bank of Canada will begin issuing supervisory guidelines for consultation to provide further clarity on its supervisory expectations.¹⁵

Footnotes

1. Government of Canada, Legislation passes to implement Budget 2025: Canada Strong.

2. Government of Canada, Budget 2025: Canada’s Consumer-Driven Banking Framework.

3. Consumer-Driven Banking Regulations, Canada Gazette, Part I, vol 160, no 26. (Regulations)

4. Regulations, ss 42(a)-(c).

5. Regulations, ss 44(1)(a)-(c).

6. Regulations, ss 45(1)-(2).

7. Personal Information Protection and Electronic Documents Act, SC 2000, c 5. (PIPEDA) The federal government’s proposed legislation to replace PIPEDA, the Protecting Privacy and Consumer Data Act (Bill C-36) would introduce a data deletion right and greater enforcement measures. See our bulletin on the topic here.

8. PIPEDA, s 7(2)(c.1).

9. Regulations, s.2.

10. Regulations, s 53(b).

11. Streamlined accreditation is available for payment service providers that are already registered under the Retail Payment Activities Act, S.C. 2021, c. 23, s. 177.

12. Regulations, ss 7(1)(a)-(d).

13. Regulations, s 53(a).

14. Regulations, s.v. “Implementation”.

15. Ibid.