About nine million Canadians have done something their bank’s terms of service tell them not to do. They typed their online banking username and password into a budgeting app, a tax tool, a lender’s website or an investment platform, so that software could log in as them and copy their transactions. The industry calls it screen scraping. Ottawa calls it a security, privacy and liability risk. And until open banking in Canada arrives, it remains the main way to move your financial data around.
The new system is supposed to replace that workaround with something safer. The government now calls it consumer-driven banking, and after years of consultations, missed timelines and a change in who runs it, the pieces are finally falling into place. The law is passed. Draft regulations were published in June 2026. A new real-time payment system is due to launch before the end of the year.
Here’s what’s actually changing, when you’ll notice it, how it compares with the U.K. and Australia, and which Canadian fintechs stand to gain.
What consumer-driven banking actually is
Strip away the jargon and it’s a simple idea. Your financial data, meaning your balances, transactions and account details, belongs to you. If you want to share it with an app, your bank should send it directly through a secure connection, with your explicit permission, rather than you handing over your password.
That secure connection is an API, an application programming interface. Instead of an app pretending to be you and scraping web pages, the bank and the app exchange only the data you approved, for as long as you approved it. You can revoke access without changing your password. And if something goes wrong, there are rules about who is responsible.
The government’s framework covers a broad range of accounts, according to the proposed regulations in the Canada Gazette:
- Chequing and savings accounts
- Payment products such as credit cards
- Registered and non-registered investment accounts
- Secured and unsecured lending accounts
In scope is your profile information, account details, balances, transactions and product information. Data a bank derives about you, such as an internal risk score, is not.
How we got here: a long road with a detour
Canada has been talking about open banking since 2018, when the federal government set up an advisory committee. The committee’s final report landed in 2021, and Ottawa named an open banking lead in 2022. Then came working groups on accreditation, liability, privacy and security, and a long stretch of internal policy work.
Budget 2024: the framework takes shape
Budget 2024 laid out the first real blueprint. It proposed that the Financial Consumer Agency of Canada (FCAC) would oversee the system, accredit participants and keep a central registry. It promised that consumers would not be held liable for financial losses caused by sharing data within the framework, a key protection. Legislation covering governance, scope and technical standards was introduced that spring.
Budget 2025: the Bank of Canada takes over
Budget 2025, tabled in November 2025, changed the plan in two important ways. First, responsibility shifted from the FCAC to the Bank of Canada, which already supervises payment service providers under the Retail Payment Activities Act. Second, the government committed to a second phase that would add “write access”, meaning the ability for an app to initiate actions such as payments from your account, with consultations planned over the following 12 to 18 months, according to Finance Canada’s summary.
The completed Consumer-Driven Banking Act received royal assent on March 26, 2026, through the 2025 budget implementation legislation. Many of its provisions are not yet in force, which is normal for a framework that still needs regulations.
Where open banking in Canada stands in late 2026
On June 27, 2026, the Department of Finance published proposed Consumer-Driven Banking Regulations, with a 60-day comment period that closed on August 26. The draft fills in many of the practical details:
- Read access first. Phase one is limited to sharing data. No app will be able to move money from your account through the framework at launch.
- Big banks must join. Participation is mandatory for specified large banks above a retail volume threshold. Credit unions and smaller institutions can opt in once accredited.
- Fintechs need accreditation. Companies that want to receive data must apply to the Bank of Canada, show they have a Canadian business presence and insurance, and pass integrity checks on key people. The application fee is set at $2,500, plus annual assessment fees.
- One technical standard. Everyone must build to a single standard set by a body the Finance Minister designates.
- Clear responsibilities. The app requesting your data must get your consent and protect what it receives. The bank sending it must authenticate you and transmit it securely.
- National security powers. The Finance Minister can refuse, suspend or revoke a participant’s access on security grounds.
The government’s own cost-benefit analysis is striking. It puts the 10-year cost of the system at about $458 million and the benefits at about $13.2 billion, largely from better lending decisions, less paperwork for small businesses and consumers finding better savings rates.
What about a launch date? The Bank of Canada’s consumer-driven banking page doesn’t give one. Data-aggregation firm Flinks, reading the draft, expects the full framework to take effect within about a year of the final regulations being published, with accreditation rules coming first. That points to 2027 as the realistic year most Canadians will see it in action. That’s our read, not an official date.
One detail worth flagging: the Act includes a ban on screen scraping, but the government has said it won’t take effect until the framework is fully running and after further consultation. Your current apps won’t suddenly break.
The Real-Time Rail connection
Open banking and faster payments are two halves of the same modernization. Payments Canada’s Real-Time Rail is a new national system for instant, around-the-clock payments that carry richer data than today’s transfers. According to Payments Canada, industry testing was under way in the third quarter of 2026, the rules and by-laws were approved, and launch is set for the fourth quarter of 2026.
Why does it matter here? Write access is most useful when an app can trigger a payment that settles instantly. Flinks expects the write-access phase to depend on the Real-Time Rail being live and widely used, which suggests payment initiation through open banking is unlikely before mid-2027 at the earliest. The Real-Time Rail also supports request-to-pay, which lets a business send you a payment request you approve with a tap.
How Canada compares with the U.K. and Australia
Canada is late. That isn’t necessarily all bad, since it can learn from others’ mistakes.
| United Kingdom | Australia | Canada | |
|---|---|---|---|
| Launched | 2018 | July 2020 (banking) | Expected 2027 |
| Who must take part | Nine largest banks (the “CMA9”) | Banks, then energy | Large banks above a volume threshold |
| Payments | Yes, including recurring payments | Not part of the 2020 launch | Planned second phase |
| Overseer | Competition regulator, then industry body | Competition regulator (ACCC) accredits | Bank of Canada |
The U.K. is the benchmark. Its system was forced on the nine largest banks by the Competition and Markets Authority. By July 2026 it had passed one billion payments and 100 billion API calls, with 18.8 million user connections as of June 2026, according to Open Banking Limited. Variable recurring payments, which let you approve flexible ongoing payments without a direct debit, are now a meaningful share of that volume.
Australia took a broader approach with its Consumer Data Right, designed to apply across banking, energy and other sectors. The ambition was impressive, but it has prompted several government reviews, including one focused on compliance costs. The lesson for Canada: start focused, make it easy for fintechs to join, and add payments once the data-sharing basics work.
Which fintechs stand to benefit
The winners are companies whose products depend on seeing your full financial picture, or on switching you away from an incumbent.
Challenger banks and investment platforms
Wealthsimple, which says more than four million Canadians use it, has expanded well beyond investing into everyday banking products. Easier data sharing makes it simpler to move a direct deposit, verify income or consolidate accounts. KOHO, which offers a prepaid card, savings, credit-building and cash advances to more than 1.5 million Canadians, relies on understanding customers’ cash flow to underwrite products like its cash advances. Both benefit if a sign-up flow can pull verified data in seconds instead of asking for PDFs.
Data aggregators
Companies such as Flinks, which connects to more than 15,000 financial institutions across North America and counts National Bank and Wealthsimple among its clients, built businesses on the old connectivity model. Their challenge is to become the plumbing for the new one, helping both banks and fintechs meet the accreditation and technical requirements.
Lenders, accountants and small-business tools
Online lenders, mortgage brokers, bookkeeping software and tax-preparation apps all spend time and money collecting financial documents. Secure, consented data access cuts that cost and can speed up approvals. The government’s cost-benefit analysis points to small businesses as some of the biggest winners.
The big banks aren’t simply losers here. They’ll be able to receive data too, once accredited, and several already run API connections with aggregators. But the mandate shifts bargaining power toward customers and smaller competitors, which is the point.
What it means for you
For now, nothing changes overnight. When the system goes live, here’s how to make the most of it:
- Look for the official process. Accredited apps will send you to your bank to approve sharing, rather than asking for your password. If an app still asks for your banking credentials after launch, that’s a reason to pause.
- Read the consent screen. It should show what data is shared, with whom and for how long. Share only what the service needs.
- Review your connections. You’ll be able to revoke access. Do a cleanup once a year.
- Shop around. The real payoff of open banking is comparison. Once apps can see your actual spending and borrowing, recommendations for savings accounts, credit cards and mortgages should get far more precise.
- Check accreditation. The Bank of Canada will supervise participants. Before connecting a new app, confirm it’s an accredited participant.
This article is for general information and is not financial advice.
Canada’s version of open banking has been “a year or two away” for most of a decade. This time the law exists, the regulator is named and the regulations are drafted. The remaining risk is execution: picking a technical standard, getting the big banks’ APIs working reliably, and not letting the write-access phase drift. If those happen on schedule, 2027 could be the year Canadians stop handing their banking passwords to apps.
Sources and further reading
- Canada Gazette, Part I: Consumer-Driven Banking Regulations (June 27, 2026)
- Justice Laws: Consumer-Driven Banking Act
- Finance Canada: Budget 2025, Canada’s framework for consumer-driven banking
- Finance Canada: Budget 2024, Canada’s framework for consumer-driven banking
- Bank of Canada: Consumer-driven banking
- Payments Canada: Real-Time Rail
- Open Banking Limited: One billion payments and 100 billion API calls
- Australian Government: Consumer Data Right
- Flinks: What the draft consumer-driven banking regulations mean
- FCAC: Open banking
