Canada’s Consumer-Driven Banking Act Is Now Law: What It Means, What’s Still Missing, and What Banks Should Do Next

On March 26th, Budget 2025, Canada’s “Canada Strong” bill, received Royal Assent, officially enacting the Consumer-Driven Banking Act (CDBA) into law. For anyone who has been watching Canadian open banking for the past several years, this is about as big as it gets.

I’ve been at the centre of this community for a long time. I’m GM for North America at Ozone API, host of the Mr. Open Banking podcast, and I’ve chaired the main stage at Open Banking Expo Canada for the last two years. So when news like this drops, people tend to ask me questions. I thought it was worth putting some of the most common ones in writing.

The CDBA just received Royal Assent. For people outside the industry, what does that actually mean — and why does March 26th matter?

March 26th matters because that’s the day Bill C-15 received Royal Assent, which enacted the Consumer-Driven Banking Act as part of Budget 2025 implementation. That makes March 26th the “it’s real now” date: the day Canada moved from talking about open banking to actually legislating it. 

It doesn’t mean every app suddenly starts sharing data tomorrow, but it does mean the country has now committed, in law, to building the framework for secure data sharing, accreditation, consent, liability, and the rest of the machinery that makes Consumer-Driven Banking work.

Canada has been debating open banking for years. What finally got this across the finish line?

What got it across the finish line was Canada finally deciding this was also an issue of sovereignty and national strength, not just a financial technology issue. In an increasingly competitive world where data sharing, payments, and trust mechanisms are strategic assets – collectively known as Digital Public Infrastructure (DPI) – Ottawa came to realize that laying the foundation for a Canadian DPI framework is fundamental to the country competing on the global stage and building a sound digital future. 

The Act assigns oversight to the Bank of Canada rather than the FCAC. That’s an interesting choice. What does it signal about where Canada is taking this?

It signals that Canada is treating this as more than consumer protection; it’s treating it as financial infrastructure. Moving oversight to the Bank of Canada says: this is about systemic trust, national standards, and a modern payments and data layer, not just a narrower market-conduct file. The message is clear: Canada wants open banking to be built like core infrastructure and aligned with the bigger modernization agenda. Consumer-Driven Banking is now considered a key part of how Canada intends to ensure its future readiness for years to come.

The CDBA is described as the “legal foundation” for open banking — but there’s still a lot of work ahead on standards selection and the accreditation regime. How much does the Act actually settle, and what’s still up in the air?

The Act sets the legal skeleton: who the framework covers, what the purpose is, and who gets the authority to build the system; but there is still a lot of work to be done. Canada still has to choose the technical standard, lock in the accreditation process, define a firm implementation timeline and finalize the common rules on security, liability, privacy, and national security. Along the way, they’ll have to start building the technology infrastructure and systems to support the data sharing network itself.

So the big thing the Act settles is direction. It says Canada is doing this, and it gives the government and the Bank of Canada the mandate to make it real. What remains up in the air is the implementation layer: which standards win, how participants get approved, how they begin to share their actual consumer data and how the ecosystem is governed day to day. This is where the rubber hits the road.

You’ve watched open banking roll out across the UK, EU, Australia, Brazil, and beyond. Where does Canada’s approach sit relative to those markets — and what can it realistically learn from them?

Canada sits somewhere between the UK’s prescriptive model and Australia’s broader Consumer Data Right, while trying to avoid the US habit of leaving too much to bilateral deals between market players. In practice, that means Canada is aiming for a regulated, trust-first system, but one that still gives industry room to shape the rails.

As a relative latecomer, Canada can learn a lot from those who came before. From the UK: Strong central coordination and a real accreditation backbone. From Australia: Think beyond banking, because data rights get more powerful when they expand across sectors. From Brazil: Speed matters, but so does execution discipline. And from the U.S.: A market can move fast without law, but laws can set goals and rules to speed things along – get the best of both worlds.

For a bank or credit union in Canada right now, what’s the single most important thing they should be doing in response to this news?

The single most important thing for banks and credit unions right now is to start mapping their APIs to a common standard and begin accreditation readiness work. For the former, the FDX API is a relatively safe bet; although it hasn’t been formally selected, many Canadian banks and technology firms have already chosen this route. For the latter, the Bank of Canada has indicated alignment with the current accreditation process for payment service providers, so that’s a good place to start. Internally, get your house in order on APIs for data sharing, respective consent flows, and third-party risk, because the institutions that move first will define the ecosystem.

What are you watching most closely over the next 12 months as Canada moves from legislation to implementation?

Of all the elements, I’m watching the standards selection process and accreditation timeline most closely. Canada’s framework hinges on picking a technical spec that’s secure, interoperable, and ready for day one; and the Bank of Canada’s first moves around how participants can join will show if this ecosystem starts with a clean foundation.

Second, I’m tracking how the accreditation regime gets built and who gets in first. The big banks will lead, but if credit unions and fintechs can join early, this becomes a true marketplace instead of a closed club. Done correctly, this could be a major feather in the cap of an administration keen on improving competition in the Canadian financial sector.

Third is the realization of the bigger picture: The move towards data rights. One of the most exciting updates to the Consumer-Driven Banking strategy was the commitment to update Canada’s privacy legislation, PIPEDA, to support generalized data sharing. The coming years will reveal if this is just open banking or the foundation for broad data rights well beyond finance.

Canada has waited a long time for this. The passage of the CDBA is a genuine milestone — not a finish line, but a real starting gun. There is a lot of work still to be done, from standards selection to accreditation to the actual build-out of a functioning ecosystem. But the legal foundation is now in place, and that changes everything.

Eyal Sivan is the General Manager for North America at Ozone API and has been recognised as the #1 Open Finance Influencer globally by Open Future World. Want to speak to him directly? Book a call with Eyal to talk about Consumer-Driven Banking in Canada.