Canada creates a new consumer-directed financial data-sharing framework

Plain-language summary · AI-assisted · not legal advice

A new federal law establishes a formal system — called consumer-driven banking — that lets consumers (including businesses) instruct their bank or other accredited financial institutions to share their financial data with other accredited entities of their choosing. Banks listed in the attached schedule are automatically covered; other financial institutions, payment service providers, and other entities can apply to the Bank of Canada for accreditation to participate. Participating entities must follow strict rules on consent (express, limited to 12 months, renewable), data security, breach reporting, complaints handling (including an external ombudsman body), and liability — with consumers generally protected from financial losses arising from unauthorized data access. An accreditation and enforcement regime, including administrative monetary penalties up to $10 million for entities and criminal fines up to $5 million, is in place. Screen-scraping — using a consumer's login credentials to access their data directly — is prohibited subject to future regulatory exceptions.

Who this affects: federally regulated banks and financial institutions · provincial credit unions, caisseepopulaires and deposit-taking Crown corporations · registered payment service providers · fintech companies and other data recipients seeking accreditation · individual and business consumers of financial services