What changed on this page, 5 August 2026. An earlier version of this guide said the Financial Consumer Agency of Canada would be the lead regulator for open banking, described a 2025 timeline, and stated a welcome bonus figure we could not verify. All three were wrong or out of date. The Consumer-Driven Banking Act puts oversight with the Bank of Canada, not FCAC. The Act received royal assent in March 2026 and the supporting regulations were only published in draft on 27 June 2026. The unverified bonus figure has been removed rather than replaced. We are stating the correction rather than quietly editing, because a page that was wrong about who regulates your data should say so.
The short answer
Open banking in Canada is called consumer-driven banking, and it is real now. The Consumer-Driven Banking Act received royal assent in March 2026. The Consumer-Driven Banking Regulations, which are what actually make it operate, were pre-published in the Canada Gazette on 27 June 2026 for a 60 day comment period.
What you get: the ability to let an accredited app read specified data from your bank accounts without handing over your banking password, at no charge, with consent that expires at least every 12 months, and a free external complaints body if it goes wrong.
What you do not get yet: the ability to move money or switch accounts through a third party app. Phase one is read only.
When: the government intends the full set of regulations to be in force within one year of final publication in the Canada Gazette, Part II, phased in by account type, starting with deposit and payment accounts. Final publication has not happened yet, so nobody can honestly give you a consumer launch date today.
What consumer-driven banking actually is
Strip away the branding and it is a permission system. Right now your bank holds the record of what you earn, what you spend and what you owe, and the only way to give another company access to it is to hand over the keys to the whole account. Consumer-driven banking creates a legal and technical route to say: this specific company, may read this specific data, for this long, and I can revoke it.
The government's stated objectives, in the Regulatory Impact Analysis Statement published with the draft regulations, are to promote competition and innovation in the financial sector, improve financial outcomes for Canadian consumers and businesses, ensure consumers can share their data securely and are protected while doing so, and strengthen Canada's position in the global digital economy. It also says the framework was designed by studying jurisdictions that went first, naming Singapore, the United Kingdom, the European Union and Australia.
Practically, the sorts of services this is meant to make safe and ordinary are the ones many Canadians already use awkwardly: a budgeting app that reads every account you hold in one place, a lender that verifies your income from your actual cash flow rather than from a stack of PDF statements, and an app that can tell you a product you already qualify for is cheaper somewhere else.
The problem it replaces, and why it matters more than the benefits
The single most concrete number in the whole file is this one: about nine million Canadians currently access financial data sharing services by providing their confidential banking credentials, a practice the government calls screen scraping. The Regulatory Impact Analysis Statement describes it as unregulated and technologically unsecure, and says it can leave consumers without recourse if something goes wrong, such as a leak of their personal or financial information.
If you have ever connected a budgeting app, a lender, a landlord verification service or an accounting tool to your bank account by typing your online banking username and password into it, you did this. The consequences are worth being blunt about:
- A copy of your live banking credentials now sits with a third party. You cannot see where, and you cannot limit what it reaches.
- Access is not read only in any technical sense. Whatever you can do in online banking, those credentials can do.
- Sharing credentials commonly breaches your own banking agreement, which is the argument a bank can reach for if you later dispute a transaction.
- Revoking it means changing your banking password, not clicking a switch.
Consumer-driven banking replaces the whole arrangement with a permissioned interface where the app never sees your password. That is the real product here, and it is a bigger deal than any of the shiny use cases.
Five things the framework gives you
1. It is free, and it has to stay free
Participating entities are required to share consumer-authorized in-scope data and may not impose a charge for doing so, nor for obtaining, renewing or withdrawing your consent. Your bank cannot bill you for letting your data out, and cannot bill you for changing your mind.
2. Consent expires by default
A period of valid consent can be no longer than 12 months. The draft regulations also set out exceptional circumstances that force a renewal earlier than that, including when a participating entity becomes aware that your authentication information has been stolen or exposed to imminent risk, when it becomes aware of a significant change in your circumstances, and when there is a significant change in its own circumstances. This is the opposite of how screen scraping works today, where access persists until you change your password.
3. Consent and revocation have to be understandable
The Act sets common rules requiring consent and revocation processes that are clear, simple and not misleading. Whether that gets enforced well is a fair question, but the standard is now written down.
4. Liability follows the data
One of the common rules established in the Act is that liability flows with the data. In a screen scraping world the question of who is responsible when something goes wrong is genuinely murky, and the murk has generally worked against the consumer.
5. A free complaints body, and a public registry you can check
The Minister of Finance can designate an independent, not for profit external complaints body, overseen by the Bank of Canada, to resolve consumer-driven banking complaints free of charge to the consumer. Every participating entity must be a member of it, unless exempted on the basis that it belongs to a recognized provincial equivalent. Separately, the Act requires the Bank of Canada to publish a central public registry listing all participating entities and accredited third-party service providers. If a company claims to be accredited, that registry is where you will be able to check.
What data is in scope, and what is deliberately not
| In scope | Out of scope |
|---|---|
| Deposit accounts | Derived data, defined as information about a consumer, product or service that a participating entity has significantly enhanced to increase its usefulness or commercial value |
| Payment products | Anything a company builds on top of your raw data, such as internal scores, segments or predictions |
| Investment accounts | Payment initiation and account switching, which are not part of phase one |
| Lending accounts |
The derived data exclusion is worth understanding, because it is where the compromise sits. You will be able to move your transaction history. You will not be able to demand the model your bank built out of it. That is a real limit on how much this levels the field, and it is a deliberate policy choice rather than an oversight.
Who runs it, and why that changed
This is the detail most Canadian articles, including an earlier version of this page, get wrong. Oversight sits with the Bank of Canada. Under the Consumer-Driven Banking Act, the Bank is responsible for supervising the participation of financial institutions, credit unions, payment service providers, fintechs and third-party service providers, and it says on its own site that it will build a supervisory framework covering how it supervises participating entities, sets standards for governance, risk management and operational resilience, and monitors trends and issues.
The other roles, from the published documents:
- Department of Finance Canada leads the development of the regulations, with support from the Bank of Canada.
- The Minister of Finance holds the authority to mandate the participation of certain banks, to designate the technical standards body and the external complaints body, and to act on national security grounds, including directing the Bank of Canada to refuse, suspend or revoke access to the framework.
- Provinces and territories have a role in overseeing provincially regulated entities that opt into the framework. That authority is enabling rather than mandatory, so a province has to request it.
- FCAC is not the regulator of this framework. It keeps its existing consumer protection mandate over banks, which is a different job.
Accreditation matters to you as a consumer for one reason: not everyone can join. There are four accreditation pathways depending on the type of applicant, and entities coming in through the non-streamlined route, which is where most fintechs sit, must have a place of business in Canada and must demonstrate how their insurance or comparable guarantees cover the risks of managing consumer-driven banking activity.
When this actually reaches you
Here is the honest position on timing, which is less satisfying than the confident dates you will find elsewhere.
- The draft regulations were published in the Canada Gazette, Part I on 27 June 2026. Part I is the consultation stage. Nothing is in force.
- Coming into force is staggered, beginning with accreditation, followed by requirements related to common rules and assessment fees within one year of final publication.
- Data types are phased in by account complexity: deposit and payment accounts first, then lending accounts, then registered accounts, then non-registered accounts.
- The government says the full suite of proposed regulations is intended to be in force within one year of final publication in the Canada Gazette, Part II, and that the precise staggered dates will be decided after the Part I consultation closes.
- Ministerial orders designating the technical standards body and the external complaints body will be published before the regulations come into force.
So the earliest honest statement is this: final publication has not happened, and the clock that matters starts then. Anyone giving you a firm consumer launch date right now is guessing. What you can watch for is the Part II publication, because from that point the one year window is the government's own commitment.
For scale, the government estimates the framework will cost $457.7 million in total present value over ten years and produce monetized benefits of $13.2 billion in total present value over the same period, while noting those benefit estimates are illustrative and non-exhaustive and that many benefits cannot be quantified at this stage. Treat the benefit figure as a policy estimate, not a fact about your wallet.
What it will not do, despite what you have read
- It will not move your money. Framework functionality is limited to read only access under phase one. Payment initiation is not in this round.
- It will not switch your bank account for you. Automatic account switching, where your payees and direct deposits follow you, is not part of phase one. Moving banks still means moving your own payroll and preauthorized payments by hand.
- It will not cover every institution on day one. Certain banks can be mandated in. Others, including provincially regulated credit unions and payment service providers, participate through accreditation or by opting in.
- It will not hand you your bank's analysis of you. Derived data is excluded.
- It does not change your fraud liability on transfers. That is a separate set of regulations published on the same day, and we cover it in our guide to who pays for an unauthorized e-Transfer in Canada.
Open banking will not lower your account fee. Your account will
Competition effects from a data sharing framework are real, but they are slow and indirect, and none of them are in force yet. The fee you pay every month is not. If you are paying a monthly maintenance fee on a chequing account, that is a decision you can revisit today. KOHO is one Canadian option: a no fee prepaid Mastercard account that takes direct deposit and e-Transfer, with paid plans alongside the free tier. Be clear about what it is not: it is not a bank, deposits are held differently than at a chartered bank, and it is not a participant in the consumer-driven banking framework, because no accredited participants exist yet. Read the current plan terms on the provider's own page before you sign up.
See how the account worksYou can still comment, and the window is short
This is a genuinely open consultation and almost no consumers file. The Canada Gazette notice says interested persons may make representations within 60 days after the date of publication, which was 27 June 2026. Sixty days from that date is 26 August 2026, and that arithmetic is ours rather than a date printed in the notice, so check the Canada Gazette page itself before you rely on the deadline.
You can comment through the online commenting feature on the Canada Gazette website, or by email to obbo@fin.gc.ca, citing the Canada Gazette, Part I and the date of publication. The named contact is Kïrsten Fraser, Director, Financial Services Innovation, Financial Services Division, Financial Sector Policy Branch, Department of Finance Canada, 90 Elgin Street, Ottawa, Ontario, K1A 0G5.
If you have ever had a screen scraping connection break, or been told by a bank that sharing your credentials voided a protection, that is a first-hand consumer experience of exactly the problem this framework exists to solve. That is worth more in a consultation record than another trade association submission.
Get the free Canadian Banking Rights Playbook
The plain English version of the rules banks would rather you skimmed: what they can take, what they must tell you, the fee caps that came into force in 2026, and the exact complaint path with the deadlines that apply. One file, no fluff.
What to do now, while you wait
- Audit what already has your banking password. List every app, lender, landlord service or accounting tool you have connected. If you cannot remember authorizing it, that is your answer.
- Disconnect the ones you no longer use, then change your online banking password. Disconnecting inside an app does not always revoke a stored credential. Changing the password does.
- Prefer connections that do not ask for your password. Some services already use tokenized links rather than credentials. Ask, because the difference is not always obvious in the signup flow.
- When the public registry goes live, check any app you connect against it. The Bank of Canada is required to publish one, and it will be the only reliable way to tell an accredited provider from a company that says it is accredited.
- Do not wait for open banking to fix the fees you are paying now. The competitive effects are real but slow and indirect. Your monthly account fee is something you can change this month.
Common questions
No. The Consumer-Driven Banking Act received royal assent in March 2026, but the regulations that operationalize it were only pre-published in draft in the Canada Gazette, Part I on 27 June 2026, for a 60 day comment period. Nothing is in force. The government says the full suite of regulations is intended to be in force within one year of final publication in the Canada Gazette, Part II, with a staggered start beginning with accreditation. Final publication has not happened, so no honest consumer launch date exists yet.
The Bank of Canada. Under the Consumer-Driven Banking Act it supervises the participation of financial institutions, credit unions, payment service providers, fintechs and third-party service providers, and it must publish a central public registry of participating entities and accredited third-party service providers. The Department of Finance leads the development of the regulations with support from the Bank. The Minister of Finance can mandate certain banks to participate, designate the technical standards body and external complaints body, and act on national security grounds. The Financial Consumer Agency of Canada is not the regulator of this framework, despite what many older articles say.
Not in phase one. The Regulatory Impact Analysis Statement states that framework functionality will be limited to read only access under phase one. Payment initiation and account switching are not included. An accredited app will be able to read specified account data with your consent, and nothing more.
In-scope data includes data related to deposit accounts, payment products, investment accounts and lending accounts. Derived data, meaning information about a consumer, product or service that a participating entity has significantly enhanced to increase its usefulness or commercial value, is excluded from the Act. Participating entities may not impose a charge for sharing consumer-authorized in-scope data, nor for obtaining, renewing or withdrawing consent.
A period of valid consent can be no longer than 12 months. The draft regulations also specify exceptional circumstances that trigger an early renewal, including where a participating entity becomes aware that your authentication information has been stolen or exposed to imminent risk, where it becomes aware of a significant change in your circumstances, and where there is a significant change in its own circumstances.
The Government of Canada's own analysis calls it unregulated and technologically unsecure, says about nine million Canadians currently rely on it, and says it can leave consumers without recourse if something goes wrong, such as a leak of their personal or financial information. Addressing the risks posed by screen scraping is named as one of the reasons the Consumer-Driven Banking Act was introduced. Whatever else the framework achieves, ending password sharing is its central purpose.
Eventually, perhaps, but not in phase one. Account switching requires the ability to initiate payments and move arrangements, which is write access, and phase one is read only. In the meantime, switching still means moving your payroll direct deposit and each preauthorized payment yourself. The realistic near-term benefit is better comparison and faster verification, not portability.
As at 5 August 2026, yes. The Canada Gazette notice allows representations within 60 days after the 27 June 2026 publication date, which works out to 26 August 2026 by our arithmetic. Comments can be filed through the Canada Gazette online commenting feature or emailed to obbo@fin.gc.ca, citing the Canada Gazette, Part I and the publication date. Confirm the closing date on the Canada Gazette page before relying on it.
Related guides
- Unauthorized e-Transfers in Canada, and who actually pays
- How deposit insurance really works at a Canadian money app
- How a bank complaint actually works in Canada, and the 56 day rule
- What the Big Five actually charge for a chequing account
- Low cost and no cost bank accounts in Canada
- NSF fees in Canada are capped at $10: the 2026 rules
- Unclaimed bank balances in Canada, and how to search for yours
Disclosure: Some links on this page are referral links, and Bremo may earn a commission if you open an account, at no cost to you. This does not change what we recommend. Sources, all read on 5 August 2026: the Regulatory Impact Analysis Statement and notice for the proposed Consumer-Driven Banking Regulations, Canada Gazette, Part I, Volume 160, Number 26, published 27 June 2026, for the March 2026 royal assent of the Consumer-Driven Banking Act, the 60 day comment period and the named departmental contact, the objectives and international comparisons, the nine million screen scraping figure and its description as unregulated and technologically unsecure, the in-scope data categories and the derived data exclusion, the no-charge rule for sharing and for obtaining, renewing or withdrawing consent, the read only limit in phase one, the maximum 12 month consent period and the early renewal triggers, the common rules on consent, revocation, liability and security, the external complaints body and its free-to-consumer basis, the central public registry requirement, the four accreditation pathways and the non-streamlined criteria, the Minister's authority to mandate certain banks and to act on national security grounds, the provincial enabling authority, the staggered coming into force approach and the account type sequence, the one year target from Canada Gazette, Part II publication, and the $457.7 million cost and $13.2 billion benefit estimates in total present value over ten years; the Department of Finance Canada news release "Government pre-publishes regulations to prevent fraud and facilitate the next phase of consumer-driven banking", dated 26 June 2026; and the Bank of Canada's own consumer-driven banking page for its supervisory responsibilities. The 26 August 2026 comment deadline is our own arithmetic from the 60 day period and the 27 June publication date, not a date printed in the notice. These regulations are proposed and not yet law, and the timeline can change. This is educational general information, not legal or financial advice.