Key Takeaways
- The Consumer-Driven Banking Act (CDBA) is a legislative framework for open banking in Canada, introduced in the Budget Implementation Act (Bill C-15).
- The CDBA empowers consumers to securely direct the sharing of their financial data among participating entities, including federally regulated financial institutions and accredited entities.
- The Bank of Canada (BoC) is the primary supervisory authority, responsible for accrediting participating entities, overseeing compliance, and monitoring market trends.
- The CDBA applies to data related to deposit accounts, investment accounts, payment products, credit products, and other regulated financial services.
- Consumers have the right to direct participating entities to share their financial data, and can withdraw consent or request deletion of their data at any time.
Introduction to the Consumer-Driven Banking Act
The Federal government has tabled Bill C-15, also known as the Budget Implementation Act, which introduces the Consumer-Driven Banking Act (CDBA). This omnibus legislation aims to implement various objectives set out in the 2025 Federal Budget, including the establishment of a federal regime for open banking in Canada. The CDBA is a long-anticipated legislative framework that empowers consumers to securely direct the sharing of their financial data among participating entities, including federally regulated financial institutions, other regulated credit unions and financial institutions, registered payment service providers, and other accredited entities.
Regime and Supervisory Authority
The CDBA names the Bank of Canada (BoC) as the primary supervisory authority, responsible for accrediting participating entities, overseeing compliance, and monitoring market trends. The Minister of Finance retains broad powers to issue guidelines and intervene for reasons of national security or public interest. This regulatory framework is designed to ensure that data sharing is secure, transparent, and fosters competition and innovation in Canada’s financial services landscape. The BoC’s role as supervisory authority is crucial in maintaining the integrity of the open banking system and protecting consumer financial information.
Scope of Application
The CDBA applies to data related to deposit accounts, investment accounts, payment products, credit products, and other regulated financial services. This scope of application is broad and encompasses a wide range of financial products and services, ensuring that consumers have control over their financial data across various sectors. The CDBA covers federally regulated financial institutions, other regulated credit unions and financial institutions, registered payment service providers under the Retail Payment Activities Act, and other accredited entities, collectively referred to as "participating entities" under the CDBA.
Accreditation and Registration
Entities wishing to become accredited participants must apply for accreditation, demonstrating compliance with technical standards and security safeguards. Accredited entities will be required to pay an annual fee and be listed in a public registry maintained by the BoC. This accreditation process ensures that participating entities meet the necessary standards for security and data protection, providing consumers with confidence in the open banking system. The public registry will also provide transparency and accountability, allowing consumers to make informed decisions about which entities to share their financial data with.
Consumer Rights and Data Sharing
Consumers can direct participating entities to share their financial data with other participants of their choice. The CDBA mandates express consent, clear communication, and the ability for consumers to withdraw consent or request deletion of their data at any time. This puts consumers in control of their financial data, allowing them to make choices about how their data is shared and used. The CDBA’s emphasis on consumer rights and data sharing is a significant step towards modernizing Canada’s financial sector and promoting consumer-centric banking.
Security and Liability
Participating entities must implement robust security safeguards, report breaches, and notify affected consumers if there is a real risk of significant harm. The CDBA limits consumer liability for unauthorized access unless there is gross negligence. This provision protects consumers from financial losses resulting from unauthorized access to their financial data, while also encouraging participating entities to prioritize security and data protection. The CDBA’s security and liability provisions are designed to ensure that consumers can trust the open banking system and feel confident in sharing their financial data.
Complaints and Redress
The CDBA requires all participating entities to establish internal complaints procedures and to be members of a designated external complaints body, ensuring accessible and impartial dispute resolution. This provides consumers with a clear and efficient process for resolving disputes and addressing concerns related to their financial data. The CDBA’s emphasis on complaints and redress is an important aspect of the open banking framework, as it promotes accountability and transparency among participating entities.
Enforcement and Penalties
The BoC is empowered to conduct audits, issue compliance agreements, and impose administrative monetary penalties for violations, with the maximum penalty for a violation committed by an individual being CAD 1,000,000 and CAD 10,000,000 where the violation was committed by a participating entity or accredited third-party service provider. The CDBA also provides for more serious court-enforced offences, which can lead to a fine of not more than CAD 1,000,000 and/or imprisonment for a term of not more than five years or in the case of an entity, to a fine of not more than CAD 5,000,000 for a conviction or conviction upon indictment. These enforcement and penalty provisions demonstrate the government’s commitment to ensuring compliance with the CDBA and protecting consumers’ financial data.
Conclusion and Future Developments
The Consumer-Driven Banking Act represents a foundational step towards open banking in Canada, empowering consumers to control how their financial data is shared among participating entities. While the government has set a target for launching the open banking framework in early 2026, much will depend on the passage of supporting regulations. Participating entities will need to double their efforts in protecting consumer financial information as well as implementing a robust process for dealing with consumer complaints. As the open banking system evolves, it is likely to have a significant impact on Canada’s financial sector, promoting innovation, competition, and consumer-centric banking.
