All posts From the Mozaic blog

Open banking in Canada (2026): what consumer-driven banking changes for you, and for Mozaic

Open banking in Canada is now law and the draft rules are in. When it starts, which banks are in, what changes for your bank data, and what it means for Mozaic users.

By 14 min read
A small Quebec town on the St. Lawrence shore under a wide sky, standing in for a banking system whose doors are being opened one at a time.

Open banking in Canada is finally law, has a draft rulebook, and has a regulator with a name. After nearly a decade of consultations, the federal government calls it consumer-driven banking, and the idea is simple: your financial data belongs to you, and you should be able to share it with an app of your choice without handing that app your online-banking password.

This guide gathers what Finance Canada, the Bank of Canada, Payments Canada and the Competition Bureau have actually said in 2026, then translates it into concrete changes for two audiences: any Canadian who uses a budgeting or net-worth app, and Mozaic users specifically. Where the details are still in draft, I say so.

Open banking in Canada at a glance

  • It is law. Bill C-15, the Budget 2025 Implementation Act, No. 1, received Royal Assent on March 26, 2026. It repealed the skeleton Consumer-Driven Banking Act of June 2024 and replaced it with a complete one.
  • The Bank of Canada runs it, not the Financial Consumer Agency of Canada as originally planned. Budget 2025 moved supervision to the central bank, which already oversees payment service providers under the Retail Payment Activities Act.
  • The rules are drafted, not final. The proposed Consumer-Driven Banking Regulations appeared in the Canada Gazette, Part I on June 27, 2026 for a 60-day comment period that closed August 26, 2026.
  • About nine million Canadians were sharing bank data by typing their credentials into a third-party app when Finance Canada last counted, in December 2024. Its stated goal is to end that practice, but only once the framework is operating.
  • Read access first, then payments. Phase one lets you share account data. Phase two, targeted for mid-2027, adds "write" actions such as switching accounts or paying bills, and depends on the Real-Time Rail, which is due to launch in the fourth quarter of 2026.
  • For Mozaic users, nothing changes today. When your bank exposes an accredited API, your connection will move onto it. Read-only stays, Montreal data residency stays, the free manual tier stays.

What is consumer-driven banking?

Consumer-driven banking is the Government of Canada's name for open banking. Finance Canada defines it as a framework that lets consumers and small businesses securely transfer their financial data through an application programming interface, an API, to approved service providers of their choice. The name change is deliberate: Ottawa wanted the emphasis on the consumer directing the data, not on the bank opening up. In this article I use both terms because the search box does.

When does open banking start in Canada? Key dates

The timeline matters because the framework has slipped before and readers deserve to know how firm each date is.

December 2024. The 2024 Fall Economic Statement published what Finance Canada called a "complete framework" and put a number on the problem: about nine million Canadians share their financial data by giving their banking credentials to service providers. Finance's own wording was that screen scraping "raises security, liability, and privacy risks to consumers and the financial system."

November 4, 2025. Budget 2025 changed the plan in two ways. Oversight moved from the Financial Consumer Agency of Canada to the Bank of Canada, and the government committed to "accelerate the next phase of consumer-driven banking, including legislating the ability to direct actions, such as switching accounts or making bill payments, or 'write access,' by mid-2027, once Canada's Real-Time Rail project is live and in widespread use." The Bank of Canada was allotted up to $19.3 million over two years for implementation.

March 5, 2026. Speaking at Open Banking Expo Canada in Toronto, Jeanne Pratt, Acting Commissioner of Competition, framed the framework as a competition tool. The Bureau's line is that open banking can lower barriers for new entrants and make it easier for consumers to compare and switch, and that affordability is its top priority.

March 26, 2026. Bill C-15 received Royal Assent. The new Consumer-Driven Banking Act gives the Bank of Canada supervisory powers, sets administrative monetary penalties of up to $10 million for a participating entity and $1 million for an individual, and limits a consumer's liability for unauthorized access unless there is gross negligence.

June 27, 2026. The proposed regulations were pre-published. Finance Canada framed them as fraud prevention as much as competition policy. Minister of Finance and National Revenue François-Philippe Champagne put it this way: "We are taking action to ensure Canadians can feel confident that their financial systems are secure, while at the same time strengthening economic resilience, increasing innovation and competition in the financial sector, as well as fostering new industry partnerships."

August 24, 2026. The by-law and rules for Payments Canada's Real-Time Rail came into force after the Minister approved them. Payments Canada describes them as the core legal framework needed ahead of a phased launch in the fourth quarter of 2026.

August 26, 2026. Comments on the draft regulations closed. As of this writing the final text has not been published.

Still to come. Final regulations, then accreditation, then the first banks going live with read access. The regulations are meant to come into force in stages: accreditation first, then the common rules and assessment fees within one year of final publication. Finance Canada has said the schedule for individual products and services will be set out when the final regulations are published. So the practical answer to "when does open banking start in Canada" is: not before the final rules land, and account types will arrive one at a time after that.

How Canada's open banking framework works

The Act and the draft regulations together answer five questions.

Which data and which accounts are covered

In-scope data is what you provided to the institution and what the institution holds about your accounts: identity and profile data, account numbers and terms, fees, interest rates, balances and transactions, plus product data about what the institution offers. It covers deposit accounts (chequing and savings), payment products, lending accounts (secured and unsecured), and registered and non-registered investment accounts. The draft phases access by account type: deposit and payment accounts first, then lending, then registered and non-registered investment accounts. The order is in the draft; the dates attach to each phase only when the final regulations are published. "Derived data", information an institution has significantly enhanced to increase its commercial value, is excluded.

What it costs

Nothing. Participating institutions must share in-scope data free of charge, and the draft bars them from charging you for obtaining, renewing or withdrawing a consent either.

Which banks are part of open banking in Canada

The largest banks, chosen by a retail-volume threshold, are mandated. Other federally regulated financial institutions, credit unions, Crown corporations that take deposits, and payment service providers registered under the Retail Payment Activities Act can opt in if they meet the technical and security requirements. The Minister can also designate a provincial regulator to oversee certain provisions for entities in its jurisdiction, which is the door through which provincially regulated institutions such as Desjardins and the credit unions could enter. Mozaic's bank directory lists how each of the big banks connects today.

Who gets to receive your data

Only accredited participants. The draft regulations set out four accreditation pathways. Regulated financial institutions and registered payment service providers get a shorter path built on their existing oversight. Everyone else, including fintechs, must show insurance or comparable guarantees against the risks of handling the data, meet baseline security requirements, and satisfy the national-security provisions. Any participant that outsources consent management, authentication or data movement must use an accredited third-party service provider. The Bank of Canada will publish a real-time public registry listing each participant, its accreditation status including any suspension, and a named contact for complaints.

How consent works

Consent must be clear, simple and not misleading, and so must revocation. It is valid for at most 12 months, after which it has to be renewed. A participant must trigger an earlier renewal if it learns your authentication information has been stolen or exposed, or if your circumstances or its own change significantly. The Bank of Canada's enforcement tools include suspension and revocation of accreditation, compliance agreements and monetary penalties.

What open banking changes for Canadian consumers

Strip away the policy language and six things change once the framework is operating.

  1. No more typing your bank password into an app. Today, connecting most Canadian banks to a budgeting app means entering your online-banking credentials in the aggregator's screen. Under the framework you authenticate at your bank, the way you already do for a card-on-file or a tax-slip download, and the bank hands the app a token scoped to what you approved.
  2. Your bank's fraud guarantee stops being a grey zone. The Financial Consumer Agency of Canada is blunt about it: give your online-banking username and password to a third party and "you may lose the protection your bank offers against unauthorized transactions." Consent-based API access removes that argument, and the Act caps your liability for unauthorized access unless you were grossly negligent.
  3. You can see and revoke every consent. A 12-month clock, a clear revocation path, and a rule that the participant must ask again when something material changes. In practice this looks a lot like the periodic reconnect prompts you already get, but with the rules written down and enforced.
  4. You can check who you are dealing with. The Bank of Canada's public registry will tell you whether an app is accredited, whether it has been suspended, and whom to complain to.
  5. Your data is free to move. Institutions cannot charge you or the app for in-scope data, and they cannot alter it on the way out.
  6. Payments come later. Write access, meaning an app moving money or switching an account on your instruction, is a mid-2027 target and depends on the Real-Time Rail. Payments Canada is launching that rail in waves in the fourth quarter of 2026, with banks required to receive real-time payments once they gain access, while offering customers the ability to send them stays optional at first. All participants are due to be onboarded sometime in 2027.

Open banking vs screen scraping

The phrase Finance Canada keeps using is screen scraping, and it is worth being precise about it because it describes how most Canadian bank connections work today. A screen-scraping connection logs in with your username and password and reads what appears on the page. The better providers do it over encrypted channels, keep the credentials out of the app's hands, and return only a read-only token, but the bank still sees a login that looks like you. Open banking replaces that with a bank-issued API token tied to a consent you approved at the bank. The practical differences: no password leaves your hands, the bank knows exactly which app is reading what, consent expires and can be revoked, and the liability rules are written down. The guide to a bank connection that stopped syncing explains why today's connections break and how to fix them until the switch happens.

What open banking does not change yet

A few limits are worth stating plainly, because a lot of coverage skips them.

  • Screen scraping is not banned today. The prohibition takes effect only once the framework is fully operating, so the current model continues in the meantime.
  • Investment accounts arrive last. They are in scope, but the draft phase-in puts deposit and payment accounts first and investments after lending. Brokerages that are not banks are not mandated. The Canadian Investment Regulatory Organization has said it is consulting on how investment dealers could qualify to participate and how to avoid duplicating securities rules.
  • Credit unions and Desjardins are opt-in. The mandate applies to the largest banks. Whether and when a provincially regulated institution joins depends on that institution and on its provincial regulator.
  • The first wave of the Real-Time Rail may not include every big bank. Payments Canada told The Logic in May 2026 that it could not confirm whether all six of the largest banks would be in the first phase.
  • The rules can still move. Fintechs Canada welcomed the draft but said that making participation possible "requires a proportionate pathway for small and scaling fintechs, which the proposed framework does not currently provide", and argued that "the final rules must be practical and proportionate so companies of all sizes can compete." An April 2026 Policy Options piece made the same point more sharply, warning that a single-tier accreditation bar for non-banks risks repeating Australia's early mistake, where compliance costs shut out smaller entrants until the law was retrofitted.

What open banking changes for Mozaic users

Here is where we stand today, without embellishment. Mozaic connects Canadian banks through Plaid and brokerages mainly through SnapTrade. For most Canadian banks that means you enter your online-banking credentials in Plaid's encrypted screen during setup; Mozaic never sees or stores the password and receives only a read-only token. Brokerage connections through SnapTrade use the broker's own API or login flow. Every connection is read-only: the tokens we hold cannot move money, place a trade or change a position, and the security page explains the architecture. Canadian bank connections re-confirm access periodically, sometimes every few months and for some institutions far more often, and the reconnect guide walks through what that looks like.

That places Mozaic users, like the users of every other Canadian aggregator, inside the nine million Canadians Finance Canada is talking about. So the framework matters to us. This is what it will change, and what it will not.

What changes.

  • Setup loses the password step. When a bank you use exposes an accredited API, your Mozaic connection will move onto it through our data provider. Plaid has said it connects Canadian institutions through APIs wherever they are available, and we will use those APIs as they appear. Setup becomes a redirect to your bank, an approval screen, and a redirect back.
  • Consent becomes explicit and dated. You will approve a defined scope of data for a defined period. Mozaic already shows each connection's last-updated state and lets you revoke it in the app; under the framework the revocation also lands in your bank's own consent dashboard.
  • Account coverage should widen over time. The framework mandates data the big banks have never exposed through aggregators in a consistent way, including product terms, fees and interest rates. As that data arrives through the API we can show it, and the free-of-charge rule means it will not turn into a pass-through fee.
  • Investment accounts come last, so the brokerage side changes least. Wealthsimple, Questrade and Interactive Brokers keep connecting through SnapTrade, and the registered and investment accounts the big banks themselves hold keep arriving through Plaid, until the investment phase and the dealer accreditation questions are settled. The supported institutions list and the brokers directory will say which path each institution uses.

What does not change.

  • Read-only stays read-only. Phase two would allow accredited apps to initiate payments. Mozaic will not ask for write access. A net-worth tool has no business moving your money, and the read-only design is written into how we request tokens, not into a policy we could relax later.
  • Canadian data residency stays. The framework governs how data leaves your bank. Where it lives afterward is still governed by PIPEDA and, for Quebec residents, Law 25. Mozaic's database runs in Google Cloud's northamerica-northeast1 region, the Montreal data centre.
  • The free tier stays free. Manual accounts, budgets, goals and net worth in any currency remain free to use; the subscription ($99 CAD/year, or $12.99 CAD/month) pays for automatic bank and brokerage connections, whichever rails they run on.
  • Reconnect prompts do not go away. A 12-month consent clock is the framework's rule, not ours, so expect a renewal roughly once a year even after the migration.

What to do now

Three practical steps while open banking in Canada moves from draft to live.

  1. Keep reconnecting as usual. Until your bank is on an accredited API, the current flow is the only one, and it is safe: read-only tokens, encrypted transport, no password stored by the app. The reconnect guide covers the common failure modes.
  2. Check any app against the registry once it exists. When the Bank of Canada publishes its list of participating entities, an app that is not on it is either not yet accredited or not planning to be. Ask which.
  3. Read your bank's account agreement. The clause about sharing credentials is the one the framework is designed to make moot. Knowing what yours says today tells you how much the switch is worth to you.

The bottom line

Open banking in Canada is the first real change to how Canadians can share bank data since aggregators arrived. The law is passed, the regulator is named, the draft rules are specific, and the payments rail it depends on has a legal framework and a launch quarter. What is left is the part that has slipped before: final regulations, accreditation, and the first banks going live. For consumers the payoff is concrete: no more handing an app your password, consent you can see and revoke, a registry you can check, and liability rules on paper. For Mozaic users the migration will be invisible except for an easier setup, because the things that matter most, read-only access and Canadian data residency, were already true.

If you want a net-worth tracker that shows every connection's freshness at a glance while the rails change underneath it, Mozaic is free to use for manual tracking, and automatic connections come with the subscription.

Sources

Sources used in this article, checked in September 2026. Official and primary sources first, then commentary and reporting:

None of this is legal advice. If you have a question about how Mozaic handles your data, email me at laurent.risser@mozaicfinance.com.

Frequently asked

There is no live date yet. The Consumer-Driven Banking Act became law on March 26, 2026, and the proposed regulations were published on June 27, 2026 with comments closing August 26. The Bank of Canada still has to finalize the rules, accredit participants and publish its registry before any data flows. The government's own sequence is read access first, then payment and account-switching features by mid-2027.
Not through the regulated framework. Apps that connect to Canadian banks today still do it through data providers such as Plaid and Flinks, most often by having you enter your online-banking credentials in the provider's screen. That continues until the framework is operating and your bank exposes an accredited API.
Screen scraping means an app logs in with your username and password and copies what it sees. Open banking means you authenticate at your bank, approve a specific scope of data for a specific app, and the bank sends that data through an API. No password changes hands, consent expires after at most 12 months under the proposed regulations, and you can revoke it. Finance Canada counted about nine million Canadians sharing data by screen scraping in December 2024.
Under the proposed regulations, participation is mandatory for the largest banks, selected by a retail-volume threshold, which in practice means the big banks. Other federally regulated financial institutions, credit unions, deposit-taking Crown corporations and registered payment service providers can opt in. Provincially regulated institutions such as Desjardins are not automatically included.
Phase one is read-only under the proposed regulations: an accredited app can see balances and transactions but cannot move funds. Payment initiation is a separate, later phase targeted for mid-2027, and an app would need explicit consent for it. The Act limits your liability for unauthorized access unless you were grossly negligent, and sets administrative monetary penalties of up to $10 million for a participating entity.
Nothing today. When a bank you use exposes an accredited API, your Mozaic connection will move onto it through our data provider, which removes the password step from setup. Everything else stays: connections remain read-only, the database stays in Google Cloud's Montreal region, and the manual tier stays free.