Updated July 2026: The proposed Consumer-Driven Banking Regulations were published in the Canada Gazette on June 27, 2026. This post has been updated to reflect the draft rules and the public comment period, which closes August 26, 2026.
A Long-Awaited Shift for Financial Data in Canada
After years of consultation, Canada’s open banking framework now has proposed operating rules. On June 27, 2026, Finance Canada published the proposed Consumer-Driven Banking Regulations in the Canada Gazette — the first time the framework has moved from legislative intent to specific, operational requirements.
The federal government has confirmed that the Bank of Canada will oversee open banking, chosen for its independence, national reach, and regulatory heft. This move replaces the Financial Consumer Agency of Canada (FCAC) and consolidates oversight of multiple modernization efforts under one trusted institution.
The Consumer-Driven Banking Act received Royal Assent in March 2026. The proposed regulations — open for public comment until August 26, 2026 — set the specific requirements for accreditation, security, consent, liability, and data sharing. For the first time, the rules are real:
- Phase 1 - Read Access (2026): Consumers will be able to share account information with accredited providers securely, with data phased in by account type: deposit and payment accounts first, followed by lending accounts, then registered and non-registered investment accounts.
- Phase 2 - Write Access: The framework's second phase expands the rails to support payments, account switching, and embedded-finance transactions. Budget 2025 targeted mid-2027, contingent on Canada's Real-Time Rail being live and in widespread use; the June 2026 regulations don't restate a date.
This shift isn’t just administrative. It’s a foundational redesign of Canada’s financial data infrastructure, one built on trust, competition, and interoperability.
What do Canada's proposed Consumer-Driven Banking Regulations require?
The proposed regulations, published June 27, 2026, set the operating rules for Canada's open banking framework: accredited entities share consumer-authorized financial data via API with the consumer's consent. Data providers are responsible for authenticating the consumer; data recipients are responsible for obtaining and managing consent. Participating entities must meet defined security standards, maintain 99.5% monthly API uptime, make a minimum of 24 months of transaction history available, renew consent at least every 12 months, and retain records for five years. Penalties reach $1M for individuals and $10M for participating entities. The regulations are open for public comment until August 26, 2026, with the framework expected to come into force within one year of final publication.
From Policy Uncertainty to Market Confidence
For fintechs and financial institutions, the difference between policy uncertainty and regulatory clarity is transformative.
With the Bank of Canada now at the helm, the framework gains credibility and momentum. Industry leaders expect that consolidation will simplify accreditation and reduce redundancy. With the proposed regulations published, the accreditation pathways are now defined — including a streamlined stream for payment service providers already registered under the Retail Payment Activities Act.
The staged rollout also gives the ecosystem time to mature:
- Establish consistent data-sharing and accreditation standards.
- Layer on transactional functionality that supports embedded finance, portability, and account mobility.
- Foster a competitive, innovation-ready financial marketplace.
As the cost and friction of switching financial providers decline, competition will intensify. Institutions that treat open banking as a minimum compliance exercise will fall behind those that embrace it as a strategic advantage, offering faster, more personalized, and consumer-centric experiences.
.png)
What the Draft Regulations Require — and What That Means for Your Infrastructure Decisions
The proposed Consumer-Driven Banking Regulations are the first time the framework has moved from legislative intent to operational specificity. Most coverage will walk through the requirements in the order they appear. Here are the details that actually change what financial institutions and fintechs build next — and why.
The regulations assume three parties. Most of the market will operate with four.
The framework is written for a direct model: data provider, data recipient, and the consumer between them. In practice, most participating entities won't build direct integrations with every counterparty. They'll work through an intermediary — an accredited third-party service provider — which adds a fourth party to the transaction. How obligations like service levels and authentication apply across that additional leg is one of the questions the consultation period exists to resolve. Institutions evaluating how to participate should be reading the regulations from the model they'll actually operate in, not the one the document defaults to.
.png)
One technical standard, one designated body.
The Act requires every participating entity to implement a single technical standard, set by a designated technical standards body. The designation criteria are specific: the body must be meaningfully Canadian, operate under a governance structure that is fair, open, and accessible with independent decision-making, and maintain a standard that is safe, secure, and interoperable. The body hasn't been named yet (the Minister of Finance holds the designation authority), but the requirement itself removes a major source of fragmentation. Everyone will build to the same spec.
The enrichment layer is yours to keep.
Derived data — defined in the regulations as information significantly enhanced by a participating entity to increase its usefulness or commercial value — is excluded from mandatory sharing requirements. FIs share raw transaction data under the framework. The intelligence built on top of that data (underwriting signals, affordability assessments, risk scores) is not something the framework compels anyone to hand over. That's a design choice, and it rewards the institutions and platforms that invested in enrichment before the regulations arrived.
Liability flows with the data.
The regulations assign accountability by role at each point the data moves: the entity requesting data is responsible for obtaining consumer consent and receiving data securely. The entity providing data is responsible for authenticating the consumer (including multi-factor authentication) and transmitting data securely. Which side of the transaction you're on determines what you're accountable for, and the infrastructure used to manage consent or authentication must itself be accredited. Choosing an infrastructure partner is now a liability decision, not just a technical one.
Third-party infrastructure must be accredited.
Any participating entity that outsources consent management, authentication, or data movement must use an accredited third-party service provider (ATPSP). This is a new, mandatory category of regulated infrastructure. The Bank of Canada will maintain a real-time public registry of all participating entities and ATPSPs — the mechanism partners will use to verify one another before any data moves. The detailed accreditation criteria for ATPSPs are expected in follow-up guidance after the comment period.
Data scope is broader than most teams are planning for.
Phase one covers deposit and payment accounts, with lending accounts and registered and non-registered investment accounts phased in afterward. The data categories run deeper than balances and transactions: consumer profile data includes employment information, and account data includes account agreements — items that are rarely part of data sharing today. Transaction data spans recent, pending, pre-authorized, and historical, with a minimum of 24 months of history available on request. Teams planning for balances and transactions alone will find the requirement wider than their current integrations.
24 months of history is the floor — and the use cases it supports already exist.
Credit underwriting, cash flow analysis, and affordability assessments are already being built on consumer-permissioned data. What the 24-month minimum does is make them more reliable and extend them to consumers who've been excluded because shorter windows didn't capture enough of their financial picture. The mandate standardizes the depth that serious financial products have always needed.
Consent isn't a one-time setup — it's recurring infrastructure.
Consumer consent is valid for a maximum of 12 months and must be renewed. Renewal is also triggered if authentication information is compromised or if there's a significant change in circumstances on either side of the relationship. Consent records must be retained for five years. This is an ongoing operational capability that has to be designed into the product, not bolted on at onboarding.
Participation is mandated for some, strategic for everyone else.
Large banks above a retail volume threshold (the specific threshold hasn't been published) are required to participate from the outset. Credit unions, provincially regulated institutions, and other eligible entities may opt in once accredited. For the opt-in segment, the question isn't compliance. It's whether the distribution, product, and customer-relationship opportunities the framework opens are ones they can afford to watch from the sidelines.
Service levels, penalties, and timelines are specific.
API endpoints must maintain 99.5% monthly uptime, with rate limiting permitted only for technical stability or security reasons. Maximum penalties reach $1M for individuals and $10M for participating entities or ATPSPs. Accreditation requirements come into force first, followed by common rules and assessment fees, with the full framework expected within one year of final publication. The government's own analysis projects roughly $13.2 billion in economic benefits over ten years against $457.7 million in costs.
Screen scraping is legislated out — but the enforcement date is still pending.
The prohibition on screen scraping exists in the Act. It will not come into force until further consultation and policy development are complete, and screen scraping remains permitted during the initial rollout. The direction is clear; the timeline isn't.
The window to shape the final rules closes August 26.
The proposed regulations are open for public comment for 60 days. The accreditation criteria, service level definitions, and consent requirements are not yet final. Stakeholders with a position in this framework have until August 26, 2026, to weigh in before the details harden.
A Broader Push: Modernization, Mobility, and Market Fairness
The 2025 Budget marked more than just the launch of open banking. It’s a coordinated modernization agenda that extends across data mobility, payments, and competition policy:
Account Transfers and Portability
Ottawa is introducing reforms to eliminate fees and shorten transfer times for registered accounts (e.g., RRSPs). Coupled with write-access functionality, these changes remove long-standing barriers to switching and signal a firm policy goal: greater competition among financial institutions
Data Mobility Rights
A new data mobility right will give consumers legal authority to move or share their financial data across sectors: from banking to insurance, wealth, and telecom. This right forms the foundation of consumer-directed finance, ensuring individuals, not institutions, control how their information flows.
Stablecoins and the Payments Frontier
The government also announced a federal stablecoin framework that integrates CAD-denominated digital assets into the payments system under Bank of Canada oversight. By regulating stablecoins as payment instruments rather than securities, Ottawa aims to promote safe innovation and monetary sovereignty.
Together, these initiatives represent a major modernization of Canadian financial infrastructure, aligning data, payments, and competition policy under a single, coordinated vision.
Flinks: Built for the Moment and Building What Comes Next
At Flinks, this moment validates a mission we’ve pursued from day one: making financial data accessible, portable, and actionable.
With secure connections already serving the country’s leading fintechs and financial institutions, Flinks’ platform provides the infrastructure for consumer-permissioned finance:
- Trusted connectivity built on consent.
- Data enrichment that turns raw data into intelligence for credit, risk, and personalization.
- Interoperable API standards designed to integrate seamlessly with open banking and payments frameworks.
- Managed services, including white-label consent, technical standards maintenance, and reporting, that reduce the operational lift of participating in a regulated framework.
The proposed regulations formalize the structure Flinks has been operating in for years: consent-based data sharing, role-assigned accountability, and accredited infrastructure between data providers and data recipients. Since its founding, Flinks has been at the forefront of secure data connectivity and money movement in Canada.
We didn’t wait for regulation to build responsibly, we built the rails that regulation is now catching up to.
Trusted partnerships and regulatory alignment
Through integrations with National Bank of Canada, EQ Bank, and other leading Canadian financial institutions, Flinks has already demonstrated what compliant, open-banking environments look like in practice, long before they were mandated. Collaboration and readiness are well underway across the ecosystem.
In many cases, Flinks has acted as an access and accreditation partner, vetting fintechs seeking API connections for banks. This approach closely mirrors the accreditation and oversight processes that are now being formalized.
“Long before Open Banking was policy, it was already happening — securely, responsibly, and at scale — through Flinks.”
- Julien Cousineau, Founder & CEO, Flinks
Your Readiness Roadmap
The countdown has begun. Here’s how forward-looking institutions are already taking steps to get ahead:
- Map your data flows. Understand where customer data lives, how it’s shared, and where consent frameworks need to evolve. The draft regulations define data scope in specific categories — profile, account, and product data — so this mapping now has a concrete target.
- Align with accreditation expectations. The accreditation pathways are now defined in the draft regulations, with detailed criteria expected in follow-up Bank of Canada guidance. Security, privacy, and operational resilience will define readiness under Bank of Canada supervision.
- Build early-stage partnerships. Start exploring use cases for read-access data integrations now so you're ready when transactional (write-access) capabilities follow.
- Design for portability. Expect consumer demand for frictionless onboarding, switching and account funding.
- Look beyond banking. The coming data mobility right points to open finance— a future where financial, wealth, and payments ecosystems converge.
Flinks is already working with partners across these readiness fronts to help translate regulation into real, market-ready capability.
From Rules to Execution
Canada now has a supervisor, a statute, and draft operating rules for consumer-permissioned finance. What's left is execution — accreditation, integration, and the product decisions that follow.
For years, the question was when the framework would arrive. The draft rules answer that. The question now belongs to institutions.
Watch the recording of our latest webinar, Open Banking in Canada: The Opportunity Beyond Compliance, to learn how to move past the regulatory summary and into what it means for how you build.
.png)
