Canada’s Open Banking and Fintech Rulebook in 2026

Canada finished legislating open banking in March 2026, seven years after the consultation that started it. The Consumer-Driven Banking Act is now complete, the regulator turned out not to be the one originally named, and draft regulations pre-published in June 2026 set out accreditation streams, fees and data scope. For a fintech founder the practical question is no longer whether the framework is coming but which of four overlapping regimes you have to satisfy (consumer-driven banking, the Retail Payment Activities Act, Payments Canada membership and FINTRAC registration), and in what order.

What is actually legislated

The framework arrived in two legislative pieces. The first, from 2024, created the Consumer-Driven Banking Act and set out the core architecture: scope, participants and the basic obligation on covered institutions to share consumer-permissioned data. The second completed it. Bill C-15, the Budget 2025 implementation act, received royal assent on 26 March 2026 and added the accreditation regime plus the common rules covering security, national security, liability and consent. It also amended PIPEDA to establish an economy-wide right to data mobility, which is the hook for extending data sharing beyond banking later.

What is not legislated is as important. Phase one is read access only. Write access, meaning payment initiation and enrolment in services through a third party, was deferred to a second phase of policy work and consultation that Budget 2025 framed as a 12-to-18-month exercise. The timing of any prohibition on screen scraping is also still open, to be settled through consultation rather than fixed in the Act.

The regulator changed

This is the detail most secondary write-ups get wrong. The 2024 fall economic statement designated the Financial Consumer Agency of Canada as the framework’s administrator and created a Senior Deputy Commissioner of Consumer-Driven Banking there. Budget 2025 reassigned it. The Bank of Canada now administers and supervises consumer-driven banking, on the reasoning that it already supervises payment service providers and can reuse that infrastructure. FCAC has confirmed it is working with the Bank and Finance Canada on an orderly transition of responsibilities while retaining a consumer-education role.

The Bank’s published mandate covers supervising financial institutions, credit unions, payment service providers, fintechs and third-party service providers, setting standards for governance, risk management and operational resilience. Provinces can designate their own regulators for certain provisions applying to provincially regulated entities, with the Bank holding enforcement powers to keep the regime consistent nationally.

Scope, participants and accreditation

Proposed Consumer-Driven Banking Regulations were pre-published in the Canada Gazette on 27 June 2026 with a 60-day comment period, alongside separate anti-fraud regulations under the Bank Act. They are the first concrete numbers anyone has had.

In-scope data covers deposit accounts, payment products, investment accounts and lending accounts: consumer profile information, account identifiers and balances, transaction history and product information, with at least 24 months of history available on request. Derived data is excluded: credit scores, spending categorisation, recommendations, anything a bank has commercially enhanced.

Participation is mandatory for large banks above a retail volume threshold and voluntary for everyone else. The regulatory impact analysis assumes roughly 680 affected businesses and a 25% opt-in rate in year one. Accreditation runs through four streams:

• Standard accreditation for fintechs and other entrants: Canadian place of business, insurance, organisational disclosure, integrity assessments of key personnel and evidence of baseline security compliance.
• Streamlined accreditation for PSPs already registered under the RPAA, leaning on that existing standing.
• Federally and provincially regulated financial institutions, which declare compliance with their existing prudential regulator’s security requirements.
• Accredited third-party service providers handling consent and data movement on behalf of others.

The proposed accreditation fee is $2,500, indexed annually. Annual assessment fees for participating entities are tiered by asset value from $10,000 to $150,000, with $10,000 for third-party service providers. Technical standards will come from a single body designated by the Minister, chosen against criteria including being “meaningfully Canadian” and maintaining independent governance. All of this is draft; final regulations may move.

The RPAA regime is already live

If you touch payment functions for end users, the Retail Payment Activities Act binds you today, independent of open banking. The Bank of Canada’s transition registration window ran from 1 November 2024 to 7 September 2025, and full obligations came into force on 8 September 2025.

A registered PSP must maintain a risk management and incident response framework, safeguard end-user funds through a trust arrangement, insurance or guarantee, report incidents that materially affect users, and file an annual report, due 31 March. The registration fee is $2,500 and is not refundable if the application is refused. Registrations appear in a public registry, which in practice has become a due-diligence checkpoint: banking partners and enterprise customers look you up in it.

The overlap with open banking is deliberate. RPAA registration is what earns you the streamlined accreditation path, so for most fintechs the payments registration comes first and the data accreditation follows.

Real-Time Rail: rules in force, launch imminent

Payments Canada’s Real-Time Rail is the infrastructure piece that has slipped the longest, and as of 2026 it is finally close. System integration testing completed in 2025; user acceptance testing plus performance, security and resilience testing ran through the first quarter of 2026. On 30 June 2026 Payments Canada announced that the RTR By-law and Rules had received all necessary approvals, with the by-law published in the Canada Gazette, Part II, and both coming into force on 24 August 2026. Payments Canada has the system scheduled to launch in Q4 2026.

The RTR uses ISO 20022 messaging, runs continuously, and admits registered PSPs as participants rather than banks alone, which is the part that matters for fintechs. Wise, Float, Paramount Commerce, KOHO and Brim Financial are among the PSPs admitted as Payments Canada members and eligible to apply to participate. Combine an RTR-capable PSP with read access under consumer-driven banking and you have most of what a UK-style account-to-account payment product needs, minus the write access that phase one does not grant.

FINTRAC sits underneath all of it

Money services business registration is separate, older and free, and it catches more fintechs than founders expect. FINTRAC treats you as an MSB if you have a place of business in Canada and do any of: foreign exchange dealing, remitting or transmitting funds, issuing or redeeming money orders or similar instruments, dealing in virtual currency, crowdfunding platform services, cheque cashing, or acquirer services for private ATMs. Thresholds of $1,000 per transaction apply to currency exchange and negotiable instruments; funds transmission triggers registration in any amount.

Registration must be in place before you operate. Obligations then include a compliance programme (designated officer, written policies, risk assessment, training, and a biennial effectiveness review), client identification and ongoing monitoring, beneficial ownership and politically exposed person checks, travel-rule information on transfers, and reporting: suspicious transactions as soon as practicable, and large cash and large virtual currency transactions at $10,000 with a 24-hour aggregation rule. Since 1 October 2025 MSBs must also verify agent eligibility, including criminal record checks; businesses with pre-existing agents have until 1 October 2027 to comply.

How Canada compares

The gap is instructive. The FCA reported in its 2025 open banking update that more than 16 million UK consumers were using open banking services and that open banking payments had grown 53% year over year, with the UK Payments Initiative, a coalition of 31 firms, targeting first live commercial variable recurring payments in early 2026. In the EU, Council and Parliament reached provisional agreement on 27 November 2025 on PSD3 and the PSR, adding IBAN-name verification, fraud information sharing between PSPs and liability rules for providers that fail to deploy preventive tools. Canada is arriving late, and arriving read-only.

What a founder should sequence now

Treat the four regimes as a dependency chain rather than a menu. If you move money, FINTRAC registration and RPAA registration come first, and the latter now buys you the streamlined accreditation route into consumer-driven banking, which is a material saving. If you consume bank data, start building against the designated technical standard rather than around a screen-scraping vendor, because the prohibition is a question of timing, not of whether. If your product depends on initiating payments from a bank account, understand that phase one does not give you that: the realistic route in 2026 is RTR participation through Payments Canada membership, not the open banking framework. And treat every number in the June 2026 draft regulations as provisional until the final version lands in Part II of the Gazette.

Sources

• Department of Finance Canada — Budget 2025: Canada’s Consumer-Driven Banking Framework
• Canada Gazette, Part I — Consumer-Driven Banking Regulations
• Department of Finance Canada — Government pre-publishes consumer-driven banking and anti-fraud regulations
• Bank of Canada — Consumer-driven banking
• Bank of Canada — Retail payments supervision
• Payments Canada — By-law and rules approved for Canada’s Real-Time Rail
• FINTRAC — Money services businesses
• Council of the EU — Payment services: Council and Parliament agreement