Open Banking: What New Consumer-Driven Banking Legislation Means for Fintechs in Canada

Core Framework Element

Fintech Obligations/Considerations

Governance:

Oversight and management of the framework

• Oversight and management rests with the Financial Consumer Agency of Canada (FCAC);
• FCAC to establish framework elements: scope; system participation; safeguards re: integrity and national security; and common rules covering privacy, liability, security;
• FCAC to select a single, technical standard for data sharing (including interoperability with coming U.S. open banking framework);
• FCAC to review framework after 3 years to ensure it continues to meet policy objectives and consumer needs.

Scope:

What entities can participate

Data that must be shared

Functionality, such as read or write access

• CBDA will set requirements on fintechs’ entry into / exit from the framework²;
• Participating entities required to meet prescribed technical and security requirements;
• Initial scope of data required to be shared at consumer’s request: deposit accounts; investment products; lending products. Note: data “materially enhanced” by a fintech to offer “significant additional value or insight” will be excluded from scope;
• Reciprocal access must be granted b/w participants;
• Data to be shared free of charge.

Accreditation:

Requirements and process for participating in consumer-driven banking

• Formal accreditation process, inclusive of process, oversight, and criteria for entities to collect consumer-permissioned data;
• Applicants for accreditation will be evaluated by the FCAC;
• Evaluation points to include: info on the organization; operational standards (including security and privacy controls); financial capacity;
• List of authorized participants will be published by the FCAC;
• Participants subject to reporting on a regular basis and as business model evolves;
• FCAC may suspend or revoke accreditation

Common Rules:

To protect consumers and govern privacy, liability, security

Privacy:

• In addition to existing privacy legislation, framework will include rules unique to financial data sharing to address consent and revocation of access to data;
• Participants to reconfirm consent at regular intervals or following certain events;
• Participants to provide consent dashboards to give consumers real-time knowledge of who has access to their data and to maintain control over the type of data they share, the accounts from which it is being collected, the length of the consents, as well as the ability to revoke consent;
• Participants required to adopt user experience guidelines to govern all areas of consent and revocation.

Liability:

• A statutory rather than contractual liability structure between participants;
• Liability will move with the data and rest with the party-at-fault;
• Consumers not liable for financial losses incurred due to sharing their data;
• Required policies and procedures for complaint handling and redress.

Security:

• Participant’s information security management system must capture all people, processes, tech and infrastructure that interacts with consumer data;
• Established security that will serve as the minimum “floor” to safeguard consumer data;
• Ongoing reporting obligations that will be overseen by the FCAC.

National Security:

Safeguards to protect the integrity and security of the consumer-driven banking framework and financial system

• Framework to include safeguards and provide authority to the Minister of Finance that aligns with existing financial sector statutes, such as the Retail Payment Activities Act, the Bank Act and the Proceeds of Crime (Money Laundering) and Terrorist Financing Act;
• Minister of Finance enabled to refuse, suspend, or revoke access to the framework for national security-related reasons. Minister provided an expanded authority to direct the FCAC to take measures related to the framework for reasons related to national security, to safeguard the integrity or security of Canada’s financial system, or in the best interest of the financial system.

Single Technical Standard:

Establishment, maintenance, and oversight of a technical standard flow of data between consumers and the financial tools of their choice

• API’s to be used to enable different products and services to communicate in a consistent manner;
• Framework will mandate a single technical standard to which APIs are built to support functionality and interoperability.