Canada’s open banking framework, now called consumer-driven banking, is taking shape. The Consumer-Driven Banking Act received royal assent in March 2026, and the government published proposed regulations in the Canada Gazette on 2026-06-27 (Canada Gazette). Consultancies such as Deloitte have been mapping what it means for banks and fintechs (Deloitte). For fintechs and payment service providers, the headline is simple: access to bank data will come with an accreditation, and accreditation comes with security obligations.
How the framework works
- Who must participate: participation will initially be mandated for specified large banks, based on a threshold for retail volume.
- What data: deposit accounts, payment products, investment accounts and lending accounts.
- Consent: consumers authorize access, and consent is normally valid for no longer than 12 months.
- Reliability: data endpoints must be available 99.5% of the time each month (proposed Regulations).
The Bank of Canada oversees the framework and accredits participants, and will set standards for governance, risk management and operational resilience (Bank of Canada).
Four ways to be accredited
The proposed Regulations set out four accreditation pathways: a full pathway for entities such as fintechs, a streamlined pathway for payment service providers registered under the Retail Payment Activities Act, a pathway for federal and provincial financial institutions, and one for third-party service providers. The proposed accreditation fee is $2,500, indexed annually (Canada Gazette).
If you are already registered with the Bank of Canada under the RPAA, your existing risk management and incident response framework is your head start. See what the RPAA requires of payment service providers.
The security bar
Under the proposal, participants need a baseline security program covering incident management and response, system and application security, access control and authentication, and data protection and encryption. Multi-factor authentication is mandatory. Breaches must be reported to the Bank of Canada “as soon as feasible after the breach occurs”. Applicants must also show how insurance or comparable guarantees cover the risks of handling consumer-driven banking data (Canada Gazette).
What fintechs and PSPs should do now
- Decide your role. Will you access data, provide services to accredited entities, or both?
- Gap-assess against the baseline. Incident response, access control, MFA and encryption are the areas the proposal names.
- Get independent evidence. A SOC 2 report or ISO 27001 certificate helps demonstrate a working security program to the regulator and to banks. See ISO 27001 or SOC 2?
- Prepare for privacy obligations. Consumer financial data is personal information under PIPEDA and, in Quebec, Law 25.
- Track the final rules. The text above is a proposal. Final regulations will be published in the Canada Gazette, Part II.
Accel GRC organizes the program and evidence, Ubitrak provides security testing and SOC 2 readiness, and we already support RPAA-registered payment service providers. Contact us.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult