Canada’s Open Banking Rules Need a Trust Test
Matthew Leo · Published August 17, 2026 · Business & Policy
Canada’s open-banking system will succeed only if sharing a bank balance feels safer than handing a budgeting app the password to an entire account.
Proposed Consumer-Driven Banking Regulations published June 27 would put the Bank of Canada in charge of supervising banks, credit unions, payment companies, fintechs and other participants. The public consultation runs for 60 days, ending August 26.
The proposal is a major improvement over screen scraping, where a customer gives an app online-banking credentials and the service logs in to collect information. Yet replacing passwords with an application programming interface, or API, does not settle every trust question. Canadians still need clear consent, narrow data access, reliable deletion and a remedy when something goes wrong.
What consumer-driven banking changes
The proposed regulations in the Canada Gazette describe a supervised framework in which approved providers exchange financial data through technical connections after receiving permission from the customer.
The government estimates that about nine million Canadians already use services that depend on screen scraping. Under the new framework, a provider should not need the customer’s banking password to retrieve authorized information. The bank authenticates its customer, while the receiving service manages consent for the data it needs.
| Today’s common approach | Regulated open-banking approach |
|---|---|
| Customer may share a banking username and password | Customer authenticates with the financial institution |
| Service may collect more screen data than required | Access is limited to defined data and consent |
| Oversight and liability can be unclear | Participants operate inside a supervised framework |
| Access can break when a bank changes its website | Data moves through a common technical standard |
The Bank of Canada says it will supervise participants, set expectations for governance, risk management and operational resilience, and monitor trends across the system.
What useful services could emerge
A secure data connection can give a customer one view of accounts held at several institutions. It can help accounting software import business transactions, allow a renter to document payment history or let a service identify recurring charges across multiple cards.
The regulatory analysis estimates $13.2 billion in benefits over ten years against $457.7 million in costs. Those numbers are not a promise to households. The Gazette explicitly describes many benefits as illustrative, and several calculations borrow participation or savings assumptions from the United Kingdom.
For example, the analysis estimates annual savings of $119.65 for people who use open-banking tools to switch mobile plans. A useful comparison service could certainly expose an overpriced plan, but the saving depends on the offers available, the customer’s actual usage and whether switching is practical in that location.
Consent must be specific enough to understand
A strong consent screen should name the accounts, data fields, purpose, receiving company and expiry. “Improve your financial experience” is not a meaningful explanation for continuous access to years of transaction history.
The system should also separate permissions. A tax application may need deposits and business expenses for a defined period, while a mortgage tool may need proof of income. Neither should receive unrelated merchant details indefinitely because the customer clicked one broad button.
Revoking access must stop future collection promptly. The app and bank should both show active connections, and they should use the same plain company name. Consumers should not have to recognize a legal subsidiary hidden behind a familiar brand.
Deletion is different from disconnection
Turning off an API connection prevents new transfers. It does not necessarily erase information the recipient already copied, derived or backed up.
Before approving an app, a customer should be able to see:
- What information will be stored after access ends
- How long transaction records and derived profiles are retained
- Whether the data is used for advertising, credit decisions or model training
- How to request deletion and what legal exceptions apply
- Whether subcontractors receive the information
The framework can improve transport security while still allowing excessive retention. Both problems matter.
A registry should answer more than “approved”
The Bank of Canada will need a public participant registry that ordinary people can use before connecting an account. It should show the provider’s legal and brand names, current status, services, complaint contact, relevant enforcement history and the date of its last security assessment.
Approval should not be presented as a guarantee that an app is suitable or inexpensive. It means the participant met the framework’s requirements and remains subject to oversight. Product quality, fees and advice still need evaluation.
Liability must work at consumer speed
When data moves among a bank, aggregator and app, each company can point toward another after an error. The customer should not have to reconstruct the technical path before receiving help.
A practical complaint process needs one starting point, a short acknowledgement deadline, preservation of relevant logs and a clear route to external review. The institution holding the customer relationship can sort out responsibility with other participants after the consumer receives an answer.
Security incidents also require direct notice. A vague statement that “a service provider experienced an event” is not enough when bank transactions, account identifiers or financial profiles were exposed.
What Canadians should do before launch
Do not interpret the proposed framework as a reason to connect every financial app. Wait until the service appears in the official registry, read the permission screen and grant the smallest useful access.
People currently using screen-scraping services should check whether they gave the provider banking credentials. Changing a password can break the connection, but it may not delete data already held by the company. Ask the provider about its transition plan and deletion process.
Open banking can give Canadians better tools and more control. The real test will be whether people can see who has their information, withdraw permission in seconds and receive a clear remedy without becoming experts in financial plumbing.
Tags: open banking, fintech, privacy, Bank of Canada, consumer finance