Canada’s framework for consumer-driven banking was previously issued in connection with the 2023 Fall Economic Statement and Budget 2024. These developments are described in our article Budget 2024 introduces Canada's consumer-driven banking framework. Then on June 20, 2024, the Consumer-Driven Banking Act (Act) introduced in connection with Bill C-69 received royal assent, in effect partially implementing the framework.

Although the release of the bill to implement the remaining aspects of the framework was anticipated today, the Department of Finance has instead issued “Canada’s Complete Framework for Consumer-Driven Banking” without the corresponding bill in connection with the 2024 Fall Economic Statement (FES 2024). FES 2024 gives us a more fulsome picture of the consumer-driven banking framework.

This article highlights the new elements of the framework introduced in connection with FES 2024.

A vision for governance

A challenge in structuring the framework lies in the fact that some financial institutions in Canada are regulated by the federal government (i.e. banks) and others by provincial governments (i.e. credit unions).

The framework lays out a new ambitious path forward for governance, one that anticipates collaboration between the Department of Finance, the Financial Consumer Agency of Canada (FCAC) and provincial and territorial regulators designated by the Minister of Finance and who enter into an agreement or a Memorandum of Understanding with the FCAC to oversee certain aspects of the consumer-driven banking system within their provinces. This would permit participation in the framework by banks as well as credit unions. In provinces and territories where this designation has occurred, some parts of the Act would be supervised by the FCAC, and other parts would be supervised by the appropriate provincial or territorial regulator.

In-scope data

The data in scope remains consistent with the Act.

Prohibition on screen scraping

The framework refers to the prohibition on screen scraping as being intended to come into force only after the framework is fully operational, signaling that the bill that should have been released with FES 2024 does include a phased prohibition on screen scraping as previously reported in the media.

Reciprocal access

A participant that receives data will be required to share data with other participants as well. This reciprocal access will be a condition and requirement for continued participation.

Accreditation

The framework remains light on details regarding accreditation.

Entities seeking accreditation will have to submit an application to the FCAC. This application will include details about their organization, operational standards and financial capacity. The FCAC will have the power to suspend or revoke an organization's accreditation if it fails to meet its obligations under the framework or poses a risk to consumers.

The framework recognizes the possibility of tiered accreditation at a later date. We await more information on whether banks will be exempted from accreditation requirements in light of the framework omitting exemptions for banks that was included in an earlier version of the framework.

A new class of accredited service providers

Accredited third-party service providers that meet necessary eligibility criteria, including a national security clearing and approval by the FCAC, will be able to perform certain tasks related to consent management, authentication management and the movement of data on behalf of participants.

Consent

The interval for a participant to reconfirm customer consent to the sharing of their data will be every 12 months or following certain events. More detail is also provided in respect of the real-time consent dashboards that participants will have to make available to their customers.

Liability

The framework reiterates the previously enunciated principle that liability moves with the data and rests with the party at fault if anything goes wrong, with no added guidance as to how this principle will be applied. We are unlikely to see further guidance on this given the Department of Finance’s stated continued engagement with industry, federal regulators, provincial and territorial governments, and other stakeholders to finalize additional liability requirements concerning service level standards, third-party usage, reporting, investigations, recordkeeping, and traceability.

The framework does, however, clarify that consumers will not be held liable for financial losses incurred as a result of sharing their financial data within the consumer-driven banking framework. It also notes that complaint handling requirements will align with existing financial sector practices.

Security

Updates to the Act will set security requirements for all participants, establishing a minimum “floor” to protect consumer data, and a security certification will be mandated. Participants will also be required to meet ongoing reporting obligations, including surveillance audits, which will be overseen by the FCAC. The Department of Finance has not yet finalized which security certification will be mandated and the extent of the reporting obligations.

An additional core framework element

The framework adds a new core element for national security to safeguard and protect the integrity of the consumer banking and financial systems. The framework includes safeguards and provides authorities to the Minister of Finance that align with existing financial sector statutes, such as the Retail Payment Activities Act, the Bank Act and the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. The authorities will permit the Minister to refuse, suspend, or revoke access to the framework for national security-related reasons and to direct the FCAC to take measures related to the framework for reasons related to national security, to safeguard the integrity or security of Canada’s financial system, or in the best interest of the financial system.

Single technical standard

The intent of using a single technical standard has been reiterated with a reference for the first time to interoperability with standards used in other jurisdictions being a factor to be considered.

What now?

The framework states that the federal government is aiming to launch the consumer-driven banking framework in early 2026. We have yet to see the bill accompanying the framework, and many details of the framework will likely be addressed in regulations under the Act, for topics that the Minister of Finance has yet to consult on. With an election looming, it remains to be seen if open banking will finally become a reality by 2026.

 ***

For any questions you may have about this topic, please contact the authors or a member of our Financial Services & Technology (FSxT) Group.