Canada’s open banking system has been promised for years. This summer it got its first full set of operating rules. On June 26, 2026, the Department of Finance pre-published the proposed Consumer-Driven Banking Regulations in the Canada Gazette, Part I, opening a 60-day comment period that closed on August 26. The draft is still a draft, but it already answers the questions that decide whether fintechs and banks can build on it: who can join, how long consent lasts, and who pays when something goes wrong.
The choices below are the ones that matter most to founders, banks and the roughly nine million Canadians whose data currently moves in less safe ways.
Why the Rules Exist: Nine Million Screen-Scrapers
Finance Canada says about nine million Canadians share financial data through screen scraping, which means handing over a banking password so a third party can log in as them. The department says that practice exposes people to security, liability and privacy risks, and that the framework would replace it with secure, API-based data sharing (Department of Finance).
The draft covers three kinds of data: consumer profile data, account data such as identifiers, balances and transactions, and product data such as terms. Heavily enhanced, derived data is excluded (Blakes). It would be phased in by account type, with deposit and payment accounts first, then lending, registered and non-registered accounts.
Get the TechPortfolio briefing
The month’s fintech and funding news, plus new tools for founders, in one short email.
Who Gets In: Four Paths to Accreditation
The draft sets out four accreditation pathways: fintechs and other entities, payment service providers registered under the Retail Payment Activities Act, federal and provincial financial institutions, and accredited third-party service providers. Banks that are mandated to take part are not subject to accreditation. Regulated institutions and registered payment providers get streamlined processes, while unregulated fintechs face more extensive requirements, and every applicant may face a national security review by the Minister of Finance (Blakes).
The accreditation fee is proposed at $2,500, indexed annually, with ongoing assessment fees once the framework is running (Blakes). BetaKit reported that a “sponsored” accreditation model, which the industry group FDATA and others had asked for, was not included. The Bank of Canada would supervise participants and keep a public registry of them (Department of Finance).
Consent and Liability: Where the Risk Lands
Consent must be express and lasts at most 12 months before it has to be renewed. Earlier renewal is required if authentication information is compromised or at imminent risk, and the consumer must reauthenticate at the start of each consent period (Blakes).
Liability is the clause lenders and app builders will read twice:
- A participating entity must safeguard the data it controls, including data handled by affiliates or third-party providers, and is liable to consumers for direct financial losses from a breach of its safeguards.
- Consumers are generally not liable for losses from data sharing. The exception is “gross negligence” in protecting their authentication credentials.
- Misuse of credentials alone does not establish gross negligence, and the participating entity has to prove it.
In other words, the draft puts the burden of proof on the business, not the customer. That is a strong consumer protection and a real compliance cost for smaller players.
What Is Missing: Screen Scraping and Timing
Notably, the prohibition on screen scraping will not come into force as part of the initial implementation, according to Blakes. The government has said it is considering a ban, but the draft does not set a date for one (BetaKit). The technical standards body has not been named either: the Minister of Finance is expected to designate it before implementation.
Timing is staged. Accreditation comes first, followed by common rules and assessment fees, with details for specific products and services to come with the final regulations (Department of Finance). The draft does not give a date when companies can start participating. Abraham Tachjian, Canada’s former open banking lead, told BetaKit he was “pleasantly surprised” by the wide scope and said it “sets us up to leapfrog other jurisdictions” (BetaKit).
What to Watch
Watch for the final regulations in the Canada Gazette, Part II. As of an NCFA guide updated September 11, they remained proposed, and we found no sign of final publication as of this writing. After that, watch for the naming of the technical standards body, the opening of accreditation, and whether the screen scraping ban gets a date. For founders, the practical step now is to work out which accreditation path fits the business and what a 12-month consent cycle does to the product.
Frequently Asked Questions
What are the proposed Consumer-Driven Banking Regulations?
They are draft federal rules published on June 26, 2026, that support bringing the Consumer-Driven Banking Act into force. They cover data scope, accreditation, liability, consent and the technical standards body.
How long does a consumer’s consent last under the draft?
Consent must be express and lasts a maximum of 12 months before renewal. It must be renewed earlier if authentication information is compromised or at imminent risk.
Who is liable if shared data is breached?
A participating entity is liable to consumers for direct financial losses from a breach of its security safeguards. Consumers are generally not liable, except for gross negligence, which the entity must prove.
How does a fintech get accredited?
The draft sets four pathways by type of entity. Registered payment service providers and regulated institutions get streamlined processes, while unregulated fintechs face more extensive requirements. The proposed accreditation fee is $2,500.
Will screen scraping be banned?
Not at first. The prohibition on screen scraping will not come into force as part of the initial implementation, and the draft does not set a date for a ban.