Canada EU Digital Trade Deal Defines New Digital Business Framework

November 3, 2026 | NCFA Regulatory Insight | Open Banking, Consumer Driven Banking, Fintech Regulation, Canada

How High Will Canada Set the Bar for Open Banking Participation?

On November 2, 2026, the Bank of Canada launched a consultation on draft accreditation guidelines for Canada’s Consumer Driven Banking Framework. The framework is supposed to do more than make financial data sharing safer. The federal government has made competition, innovation and economic growth one of its three policy objectives, alongside consumer protection and financial system safety. That makes the accreditation bar more than a compliance question. How demanding the rules become will help determine which banks, fintechs and other providers participate, and how much real competition open banking ultimately produces.

That competitive promise depends on who can actually enter the system. Canada already has about nine million people sharing financial data through screen scraping, according to the federal framework, so there is an existing market for services that could move into regulated open banking. If accreditation is too expensive or difficult for credible fintechs to obtain, consumers may get safer data sharing without enough new providers to materially improve choice, pricing or service.

The Competition Bureau has warned about this risk for years. The Bureau's October 2026 submission on Canada’s draft Consumer Driven Banking Regulations says smaller fintechs, challenger banks, credit unions and emerging firms can face proportionately higher implementation and compliance costs, and that these costs can discourage entry or expansion. The Bureau supports strong safeguards but recommends that requirements reflect factors such as risk, size, activity and access to consumer data.

NCFA's Open Banking & Consumer-Driven Finance Interactive Intelligence has tracked the same tension across competition, accreditation, switching, innovation and global market design. The question now moving from policy into supervision is whether Canada can protect financial data without setting an entry bar that leaves too few challengers in the market.

What Is the Bank of Canada Consulting On?

On November 2, 2026, the Bank of Canada opened consultation on its first draft supervisory guidelines for accreditation.

Comments are due December 8, 2026, and the Bank specifically asks whether any part of the drafts needs clarification, would be difficult to implement, needs more examples or could “discourage voluntary participation.”

The consultation does not reopen the full Consumer Driven Banking Framework. It deals with how the Bank proposes to assess accreditation applications under the Consumer Driven Banking Act and proposed regulations. The two draft guidelines cover participating entities and accredited Third Party Service Providers, with later Bank consultations expected on other supervisory topics.

Which Accreditation Route Applies in Canada?

Canada proposes three accreditation routes for participating entities. The route depends largely on whether the applicant already operates inside another regulatory framework, while accredited Third Party Service Providers sit beside these three routes under a separate guideline.

1. Standard accreditation for independent applicants. This route applies generally to eligible corporations, trusts, partnerships, funds and other organizations that are not registered payment service providers or federally or provincially regulated financial institutions. The participating entity draft guideline requires the broadest evidence package under this route, including governance, security, technical compliance, consumer dashboards, complaints, insurance or guarantees, operations and national security information.

2. Streamlined accreditation for registered PSPs. Payment service providers already registered under the Retail Payment Activities Act can use a separate streamlined route. They still need to provide security, technical, insurance, governance, operating and national security evidence, but the Bank can rely on regulatory information and oversight that already exist rather than requiring every control to be established again from the beginning.

3. Streamlined accreditation for regulated financial institutions. Banks, authorized foreign banks, trust and loan companies, credit unions, caisses populaires, insurers and certain provincial Crown corporations can use the narrowest participating entity route. Their existing prudential regulation carries more of the supervisory burden, while the draft focuses particularly on technical compliance and a declaration from the responsible senior officer that required security safeguards are in place.

Accredited Third Party Service Providers (TPSPs) use a separate pathway. A TPSP is a company that performs specified technology or operational functions for an accredited participant. The TPSP draft guideline applies when a provider performs activities such as obtaining or managing consent, handling authentication, or providing or receiving consumer data. A software company does not need TPSP accreditation simply because it sells technology to a bank or fintech.

The structure already contains some proportionality. Firms with existing supervision get more streamlined treatment, while independent applicants carry more of the accreditation burden themselves. The unresolved competition question is whether prior regulatory status should be the main route to lower burden or whether lower risk independent fintechs should also have a staged way into the market.

What Will Applicants Need to Prove?

The standard route requires more than corporate information and a security policy. Applicants need an operating evidence file covering ownership, governance, responsible people, regulatory status, security safeguards, technical standards, consumer dashboards, complaints, insurance, expected activity and national security information. The Bank can also request more information while reviewing an application.

Security will require independent confirmation, but firms may be able to reuse credible work they already maintain. The draft says ISO 27001 certifications, SOC reports and NIST based assessments may support an application when an independent assessor maps that work to the Bank's safeguards and explains its scope and limitations. The Bank expects the confirmation to rely on an assessment completed within the previous 12 months.

Insurance also follows a risk based approach. Standard applicants and registered PSPs are expected to hold professional indemnity and cyber insurance, or comparable guarantees, but the Bank does not prescribe one coverage amount for everyone. Applicants need a documented methodology that considers factors such as data sensitivity, data volume, operating scale, complexity and potential losses from privacy, cyber or operational incidents.

Some important costs remain difficult to calculate. The draft guidelines say more information on accreditation fees and the web application process is forthcoming, and the participating entity guideline notes that the Technical Standards Body had not been designated when the draft was prepared. Firms can prepare much of their governance, security and insurance evidence now, but they still cannot fully map the cost and timing of accreditation.

How Do Canada, the UK and Australia Compare?

The UK and Australia show two different ways to make regulatory burden more proportional without removing consumer protection. Both markets allow firms to participate at different levels instead of requiring every company using open banking infrastructure to clear the highest regulatory bar itself.

The UK's Financial Conduct Authority allows a firm providing only account information services to use the registered account information service provider route. A business that combines account information with other regulated payment services needs authorization instead. Firms can also operate as registered agents on behalf of regulated principals. Those agents are part of the regulated ecosystem but do not hold the same independent authorization as their principal. They provide regulated services through that principal, which remains responsible for the activities covered by the arrangement.

Open Banking Limited reported 145 third party providers with live open banking propositions and another 406 registered agents in its 2025 impact report, with potentially thousands of additional firms using open banking data and payments through regulated providers. Open Banking Limited also reported more than 19 million active user connections and over 40 million open banking payments per month in 2026. That does not prove every UK regulatory choice should be copied, but it shows how participation can extend well beyond firms holding their own direct regulatory permission.

Australia goes further by creating several distinct participation routes through its Consumer Data Right accreditation framework. A firm can become fully accredited, obtain sponsored accreditation under a fully accredited sponsor, or participate without its own accreditation as a CDR representative under a written agreement with a fully accredited principal. Each step gives up some independence in exchange for a lower direct entry burden.

In 2025 to 26, Australia's competition regulator reported 30 active accredited data recipients and 178 active CDR representative arrangements. Representative arrangements are not the same as 178 unique companies, but the gap shows how much participation can occur outside full accreditation.

The comparison does not show that one country simply has weak rules and another has strong ones. The UK and Australia still require security, accountability and financial protection. The larger difference is how many ways a company can enter the ecosystem and how much independence it receives at each level.

In the UK, direct regulation is only one part of the market. Hundreds of registered agents operate through regulated principals, while a much larger group of firms can build open banking data or payment functionality into their products through regulated providers. Australia makes that ladder even more explicit. A firm can carry full accreditation, accept less independence under sponsored accreditation, or offer services as a representative while the accredited principal carries the regulatory responsibility.

Australia reported almost six active representative arrangements for every active accredited data recipient in 2025 to 26. That ratio should not be read as a direct count of companies or as proof that Australia's model is superior, but it does show that participation can become much broader when full accreditation is not the only practical entry point.

Canada already does something similar for registered PSPs and financial institutions by recognizing supervision they have completed elsewhere. The main gap is the independent fintech that creates limited risk but does not yet have a regulatory history that qualifies it for a streamlined route.

See: Canada Real-Time Rail Rules and Access

Also Canada already has a recent example of why voluntary participation cannot be taken for granted. BetaKit reported in October 2026 that none of Canada’s Big Six banks was then scheduled to participate in the first phase of the Real Time Rail, citing four fintech sector sources familiar with the rollout. The Real Time Rail and consumer driven banking are different systems, but the participation lesson is relevant. New financial infrastructure does not create competition by itself if major institutions or smaller providers decide the cost, timing or operating burden is not worth joining.

Could Canada's Entry Bar Limit Competition?

The Competition Bureau's October 23 submission puts that issue directly on the table. It supports strong accreditation, reporting, audit and security requirements but warns that fixed compliance costs can weigh more heavily on smaller firms and discourage entry or expansion.

The Bureau recommends considering requirements according to risk, size, activity and access to consumer data. It also suggests a provisional or tier based accreditation model that could let firms enter earlier under appropriate safeguards and move toward full accreditation as their operations and risk grow. Canada's current Bank draft does not create that model.

The Financial Consumer Agency of Canada found that switching barriers can reduce competitive pressure and weaken incentives for providers to compete on price and service. Consumer driven banking can improve comparison and portability, but those advantages are worth less if consumers don't have enough credible alternative providers to choose from.

NCFA's Canada Open Banking Rules and Regulations tracks the broader accreditation, security, liability and supervisory framework. The Bank's current consultation is where those rules begin translating into the practical cost of entering the market.

Canada does not need weaker protection to increase participation. It needs to decide whether security and accountability can remain firm while the pathway to meeting those outcomes varies with the activity, risk and maturity of the applicant. The UK and Australia show that proportionality can be built into market access rather than added after firms have already absorbed the full cost of entry.

How Long Could Accreditation Take?

The Bank does not promise a standard approval time. Once an application is complete, the Bank sends a copy to the Minister of Finance and begins its own review. The Minister has 60 days to decide whether a national security review is needed and can extend that decision period in additional 60 day periods.

If a national security review is opened, the review period is 180 days and can also be extended in additional 180 day periods. Not every applicant will undergo a full review, but the Bank cannot grant accreditation while the Minister's decision or review remains outstanding. Firms tying financing, hiring or product launches to accreditation need to plan for timing they cannot fully control.

See: Real Time Rail Puts Canada’s Productivity Test In Focus

A refused applicant can generally request review within 30 days. The Bank's delegated decision maker can accredit the applicant or confirm the refusal within 120 days after the applicant has had an opportunity to make representations, and a further appeal can go to Federal Court. Once applications begin moving through the system, publishing normal processing times would help founders and investors distinguish routine accreditation from exceptional delay.

What Should Firms Tell the Bank Before December 8?

The Bank wants written feedback by December 8, 2026. Respondents should identify themselves, use the subject line specified on the consultation page, identify the relevant part of the draft and explain the implementation issue as specifically as possible. Commercially sensitive information should only be submitted when it is clearly identified.

Fintechs should put numbers around the burden wherever they can. If security mapping needs 120 staff hours, another assurance exercise costs $40,000, insurance materially increases annual operating cost, or Canadian presence changes the economics of entry, those figures tell the Bank more than simply calling a requirement burdensome.

Registered PSPs and financial institutions should identify evidence another regulator already holds and where the Bank can safely avoid duplication.

Independent fintechs should explain whether a limited, provisional or sponsored route would change their ability or willingness to enter Canada, while TPSPs should identify where responsibility for consent, authentication and data handling remains unclear between provider and participating entity.

NCFA believes Canada should add a proportionate entry route for credible lower risk fintechs that are not already supervised under another regulatory regime. The UK and Australia show that this can be done without removing accountability. Canada should consider narrower permissions for narrower activities, sponsored participation through an accredited firm, or a representative model where a stronger regulated participant carries more responsibility while a younger company proves its product, controls and operating record before seeking full independent accreditation.

Bottom Line

A framework that protects data but attracts too few credible challengers will struggle to deliver the competition, consumer choice, innovation and pricing pressure that consumer driven banking was built to support. The December 8 consultation deadline gives industry a chance to influence that balance before the entry rules become embedded in Canada's open banking market. Responses can be emailed to SupervisionInfo@bank-banque-canada.ca

The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

Buying a Canadian MSB and Reviewing FINTRAC RPAA and Financial Due Diligence

Why MSCI Is Removing Strategy From Its Indexes

How Is Crypto Market Cap Calculated? What a Change in the Top Coins Really Tells You

What Happens When AI Agents Start Trading Together?

Canada’s VC Totals Are Reliant On Mega Deals

Why Canada Is Making It Cheaper to Leave Your Bank

CSA Tokenization Report Shows Where Canada May Scale First

Creative Ways to Boost Team Morale

Webull Adds Free Data as Canadian Brokers Compete Beyond Fees

BBVA Deploys Canadian AI for Derivatives Pricing