Bank of Canada Opens Consultation on Supervising Consumer-Driven Banking

The consultation marks the first substantive step in defining how the Bank intends to oversee and supervise participants in the Ecosystem. While Canada has spent years discussing Policy Frameworks, Governance Models, and Legislative Foundations for Open Banking, this consultation begins the transition from Theory to Implementation. At its core, the proposal addresses a fundamental question:

“Who will be permitted to participate in Canada’s Open Banking Ecosystem, and under what conditions?”

The Bank’s draft Guidelines establish a proposed Accreditation Framework for Organizations seeking to access, manage, or facilitate consumer Financial Data within the CDB environment. These Guidelines will shape the Standards that banks, lenders, credit unions, payment service Providers (PSPs), and third-party Firms must satisfy before they can participate in the regime.

The consultation introduces the first two Supervisory Guidelines in what the Bank has indicated will be a broader series of regulatory and operational guidance documents governing Canada’s CDB Ecosystem, and remains open until December 08, 2026, after which the Bank will review stakeholder feedback and continue refining the Supervisory Framework.

Guideline 1: Participating Entities

The first Guideline applies to entities that hold or provide access to Financial Data and are expected to participate directly in the Framework. These include:

• ■Federally Regulated Banks
• ■Credit Unions
• ■Mortgage and Lending Institutions
• ■Other Financial Service Providers
• ■Payment Service Providers (PSPs) registered under the Retail Payment Activities Act (RPAA)

Perhaps the most consequential feature of this Guideline is the proposed Accreditation Model.

The Bank has outlined three potential pathways to Accreditation, allowing Organizations with different regulatory histories and operational profiles to qualify for participation. Importantly, one of these pathways creates a streamlined route for PSPs that have already completed registration requirements under the RPAA. This approach recognizes prior regulatory oversight and seeks to avoid duplication of compliance efforts.

Guideline 2: Third-Party Service Providers

The second Guideline focuses on Organizations that may not directly provide Financial products but play critical enabling roles in the Open Banking Ecosystem. These include Firms that:

• ■Manage Consumer Consent
• ■Facilitate Authentication and Identity Verification
• ■Process or Transmit Consumer-Authorized Financial Data
• ■Provide Technology Infrastructure Supporting Secure Data Exchange

These service Providers are expected to occupy a pivotal position within the Ecosystem. Consumer trust in Open Banking will depend heavily on how securely consent is collected, maintained, and audited, as well as how authentication processes protect individuals from fraud and misuse. As a result, Accreditation criteria for these Firms are likely to receive considerable scrutiny from both regulators and industry participants.

A Progressive Rulebook

The Bank has made it clear that these two Guidelines represent only the beginning of the Supervisory Framework. Future consultations are expected to address additional aspects of CDB, potentially including:

• ■Operational Resilience Requirements
• ■Incident Reporting Obligations
• ■Cybersecurity Controls
• ■Consumer Protection Measures
• ■Data Governance Standards
• ■Third-Party Risk Management Requirements
• ■Market Conduct Expectations

Together, these future Guidelines will determine how the Ecosystem functions in practice and how confidence is maintained among consumers, regulated Institutions, and Fintech innovators.

Status

The consultation period is currently active, with stakeholder comments due by December 08, 2026.

Industry participants, Financial Institutions, Fintech Firms, Technology Providers, and Consumer Advocacy Groups now have an opportunity to influence the final direction of the Accreditation Framework before Supervisory requirements are finalized.

The publication of these draft Guidelines should not be viewed as the endpoint of the Open Banking journey. Rather, it represents the beginning of a phased Supervisory process that will continue to evolve alongside the broader consumer-driven banking Framework. Organizations considering participation in the Ecosystem should monitor future consultations closely, as additional Supervisory requirements are expected over the coming months and years.

FTF Analysis

For years, Canada’s Open Banking journey has been dominated by policy discussions, industry working groups, legislative proposals, and consultation exercises. This consultation signals a shift from Framework design to Supervisory execution.

The significance of the proposal lies not in the introduction of Accreditation itself, but in how Accreditation will be granted. The Bank of Canada’s proposed pathways provide an early indication of how it intends to balance innovation, competition, consumer protection, and system integrity within the Consumer-Driven Banking Ecosystem.

The streamlined Accreditation pathway for Payment Service Providers already registered under the Retail Payment Activities Act (RPAA) is particularly noteworthy. While technical in nature, it effectively rewards organizations that invested early in regulatory compliance and may provide a faster route into the Open Banking ecosystem. For many firms, RPAA registration may prove to be more than a compliance milestone. It could become a strategic advantage.

The consultation also reinforces a broader reality. Open Banking is no longer solely about Banks. Consent Managers, Authentication Providers, and Data Service Firms are emerging as critical components of Canada’s Digital Trust Infrastructure. Their ability to securely manage consumer permissions, identity verification, and Data exchange will play a vital role in maintaining confidence in the ecosystem.

For Financial Institutions, Fintechs, Cybersecurity Leaders, and Compliance Teams, the key questions now shift from whether Open Banking will happen to how participation will be supervised. Future Guidance on Security Controls, Operational Resilience, Third-Party Risk, Audit Obligations, and Accountability Mechanisms will determine the Framework’s effectiveness.

More than an Accreditation exercise, this consultation offers the first concrete view of how the Bank of Canada intends to govern and enforce participation in Canada’s next generation of financial data sharing. It is, in many respects, the first draft of the Supervisory Rulebook for Canadian Open Banking.