How far are we with “open banking” initiative in Canada?

The Government of Canada unveiled its 2023 Fall Economic Statement on November 21, 2023. Within this statement, plans were disclosed regarding the federal government’s aim to enact legislation creating an open banking framework, now labeled as consumer-driven banking. Simultaneously, alongside the release of the Economic Statement, the federal government issued a Policy Statement on Consumer-Driven Banking (referred to as the “Policy Statement”). The objective is to enact legislation and complete the essential governance structure by 2025.

What is consumer-driven banking (a.k.a. open banking)?

Imagine you have a big piggy bank where you keep all your money. Open banking is a bit like having a special box that helps you share some of those money with your friends, but only if you want to.

Usually, when you save your money in one place, like a bank, only that bank can see how much money you have. But with open banking, you can choose to let other trusted companies (not only banks!) see how much money you have or how you spend it. This helps these companies create new and cool ways to help you save or spend your money better, like apps that can show all your accounts in one place or help you find the best deals.

It’s like giving your friends a peek inside your piggy bank to help you figure out how to use your money smarter, but you’re the one who decides who gets to look and who doesn’t.

Ultimately, it empowers individuals to take charge of their financial data. In today’s world, where data is often considered as valuable as oil, success hinges on fostering innovation through safe and secure methods.

Image source: Generated with AI ∙ January 4, 2024 at 3:53 PM

What has been done in EU, UK, Australia, Korea, India and Singapore?

Open banking development varies across different jurisdictions, depending on the regulatory and market drivers. Here are some examples of open banking development in EU, UK, Australia, Korea, India and Singapore:

• EU: The EU has implemented the Revised Payment Services Directive (PSD2), which requires banks to share customer data and payment services with authorized third-party providers (TPPs) through APIs, with the customer’s consent.
• UK: The UK has launched the Open Banking Standard, which goes beyond PSD2 and covers a wider range of financial products and services, such as savings, mortgages, and investments.
• Australia: Australia has introduced the Consumer Data Right (CDR), which gives customers the right to access and share their data across various sectors, starting with banking. The CDR is regulated by the Australian Competition and Consumer Commission (ACCC), which accredits the data recipients and enforces the rules for data sharing.
• Korea: Korea has adopted the Financial Services Commission (FSC)’s Open Banking System, which allows customers to access and manage their accounts from different banks through a single mobile app, without paying any fees. The Open Banking System is based on voluntary participation from banks and fintech companies.
• India: India has developed the Unified Payments Interface (UPI), which is a real-time payment system that enables customers to transfer money and access various financial services from different providers through a single app, using a virtual payment address. The UPI is managed by the National Payments Corporation of India (NPCI), which sets the standards and rules for data sharing and interoperability.
• Singapore: Singapore has adopted a market-driven approach to open banking, where the Monetary Authority of Singapore (MAS) and the Association of Banks in Singapore (ABS) provide guidance and support for data sharing and collaboration between banks and fintech companies, but do not mandate any specific standards or frameworks. The MAS and the ABS have published an API Playbook to facilitate the development and adoption of APIs in the financial sector .

Numerous other jurisdictions have implemented open banking frameworks as well. However, based on the meeting minutes of the Open Banking Canada working groups and steering committee, it appears that they have drawn inspiration from the regulatory approaches of the UK, and Australia. Rather than directly replicating any single framework, the Canadian working groups and steering committee seem to have tailored their approach by incorporating elements from these established models.

What has been done so far in Canada

• January 31, 2020: The Advisory Committee on Open Banking released its first report, which recommended that the Government of Canada move forward to enable consumer-directed finance in Canada.
• August 4, 2020: The Government of Canada launched the second phase of the open banking review, with a focus on data security in financial services.
• January 29, 2021: The Advisory Committee on Open Banking released its final report, which outlined a proposed market structure and regulatory framework for consumer-driven banking in Canada.
• April 19, 2021: The Government of Canada announced in its Budget 2021 that it will introduce legislation to implement a consumer-driven banking framework that will empower Canadians to securely access and share their financial data with financial service providers of their choice.
• July 5, 2021: The Government of Canada appointed Andrew Moor as the open banking lead, who is responsible for leading the development and implementation of the consumer-driven banking framework.
• July 5, 2021 — May 1, 2023: The open banking lead, supported by the open banking secretariat within the Department of Finance and external experts, established four working groups on accreditation, liability, privacy, and security, as well as a steering committee, to develop the common rules and standards for data sharing between banks and third-party providers.
• November 30, 2021: The Government of Canada released its Fall Economic Statement 2021, which reaffirmed its commitment to implement a consumer-driven banking framework and announced the creation of a Consumer-Driven Banking Bureau within the Department of Finance to oversee the framework.
• July 5, 2022: The open banking lead, supported by the open banking secretariat within the Department of Finance and external experts, established four working groups on accreditation, liability, privacy, and security, as well as a steering committee, to develop the common rules and standards for data sharing between banks and third-party providers.
• November 30, 2022: The Government of Canada released its Fall Economic Statement 2022, which reaffirmed its commitment to implement a consumer-driven banking framework and announced the creation of a Consumer-Driven Banking Bureau within the Department of Finance to oversee the framework.
• May 1, 2023: The four working groups completed their work and delivered their final outcomes to the open banking lead.
• November 21, 2023: The Government of Canada released its Fall Economic Statement 2023, which outlined the legislative framework and the implementation plan for consumer-driven banking in Canada.

High-level of requirements

There is no clear drafts of legislation or regulations yet but based on 2023 Fall Economic Statement: Policy Statement on Consumer-Driven Banking, the government intends to develop a legislative framework to facilitate safe and confident consumer access to financial data, aiming to implement this in Budget 2024. The legislation aims to establish rules on liability, privacy, security, accreditation, and technical standards, assigning oversight to a government-led entity:

• Governance and Oversight
  To ensure effective oversight, a government-led entity will supervise and enforce the framework, allowing provincial entities to opt-in. Strong governance will ensure compliance with rules and define roles clearly.
• Scope and Accreditation
  The framework will phase-in participant inclusion, mandating larger financial institutions (i.e: big banks) initially, with options for others to join. A formal accreditation (not a certification) system will ensure trust and security for entities accessing consumer financial data.
• Exemptions and Rules
  Regulated banks and credit unions will be exempt. The framework will enforce common rules addressing privacy, security, and liability obligations, aiming for consistency and consumer trust (similar to ACFC’s requirements).
• Privacy, Liability, and Security
  Participants must adhere to privacy laws, provide clear consent processes, and manage liability transparently. The framework also includes strict security (i.e. comparable to NIST framework or SOC 2 Requirements) requirements to safeguard consumer data.
• Technical Standards
  A single technical standard will be mandated, transitioning from screen scraping to more secure methods like APIs, aligning with international best practices.

What should fintechs do meanwhile?

In conclusion, as federally regulated banks and credit unions are poised to be exempt from the accreditation process, fintech companies should be attentive to potential obligations. For those not exempt, undergoing the accreditation process, estimated to range from 3 to 12 months, is likely to be heavy.

Hence, it is recommended that fintech firms meticulously examine the meeting minutes of the working group and committee. Furthermore, developing familiarity with the open banking frameworks in the UK and Australia is encouraged for a thorough grasp of potential industry standards and best practices. The aspiration is for the framework to exhibit flexibility, particularly benefiting startups, allowing them to introduce genuine innovation despite their smaller scale.

Next steps

The Department of Finance will progress the necessary efforts to establish a Canadian framework overseeing consumer-driven banking, aiming to adopt legislation and fully implement the required governance structure by the year 2025. The legislation set to be unveiled in Budget 2024 will embrace a gradual implementation strategy for the consumer-driven banking framework’s scope.

Initially, federally-regulated financial institutions reaching a designated retail volume will be the initial cohort mandated to partake. Other federally-regulated financial institutions, credit unions, and accredited third parties will have the option to voluntarily join.

Meanwhile, it is crucial for federal agencies like OSFI in partnership with FCAC to introduce a regulatory sandbox framework or an innovation hub to bolster the open banking initiative and attract fintech companies to Canada. This framework complements open banking efforts, fostering innovation and competition, a strategy already implemented in many jurisdictions. Without it, barriers may arise, hindering innovation. Fortunately, there was a plan for OSFI to launch such a regulatory sandbox framework, and we anticipate hearing news on this development in 2024.

Let’s be hopeful that the ultimate regulatory framework will strike a balance: simplicity to entice innovative fintech firms to Canada while ensuring consumer protection and preventing systemic risks. Additionally, this framework should create opportunities for smaller firms, possibly through a regulatory sandbox as mentioned above, enabling them to compete with established financial institutions and influential big tech companies like Apple or Meta, which wield substantial lobbying power and resources. For Canada to position itself as a focal point for genuinely innovative startups, it must establish regulations that strike a balance, preventing dominant forces from stifling healthy competition.

Moreover, while not directly related to this topic, sustainability should also be a focus as well. The escalating volume of data transfer is bound to have an environmental impact. The persistent forest fires from last year served as a preview of the potential consequences of the 6th extinction for Canadians. Therefore, implementing open banking must be approached in a sustainable manner.

**Disclaimer: The views expressed in this article are solely my own and do not reflect the opinions, beliefs, or positions of my employer. Any opinions or information provided in this article are based on my personal experiences and perspectives. Readers are encouraged to form their own opinions and seek additional information as needed.**