Open banking has been arriving in Canada for roughly six years. It has been formally legislated twice, assigned to two different regulators, paused by a prorogation, and scheduled for a launch date that has now passed without a launch. There is a real framework underneath all of this, and there is a specific date in June 2026 when it became meaningfully more concrete. Both facts deserve stating, and most coverage manages only one.
Key Takeaway
Canada's Consumer-Driven Banking Act was first enacted in June 2024 through Bill C-69, paused when Parliament was prorogued in January 2025, and then repealed and replaced in its entirety by Bill C-15, which received Royal Assent on March 26, 2026. Oversight moved from the Financial Consumer Agency of Canada to the Bank of Canada under Budget 2025, with $36.9 million previously allocated to FCAC left unspent. The government had targeted a launch in early 2026; as of March 2026 the Bank of Canada reported it was still in the information-gathering stage and said it would be premature to set a date. Draft Phase 1 regulations were released June 27, 2026 with a 60-day consultation, and coming into force approximately twelve months after final publication points realistically to a 2027 rollout. Until then, Canadian businesses continue sharing banking credentials with accounting and lending applications through screen scraping, which is the practice the framework exists to replace.
The Only Question Worth Asking First
Business owners encountering open banking coverage generally want to know one thing: can I do anything differently yet? The answer today is no, and understanding why is more useful than another explanation of what open banking will eventually enable.
The gap between announcement and availability in this file is unusually large, and it has a specific cost. Businesses that read "launching early 2026" in late 2024 and deferred decisions about accounting integrations, lending relationships or data governance have now waited two years for something that has not arrived and will not arrive this year. Knowing that the realistic horizon is 2027 rather than imminent is itself actionable, because it changes whether you wait or proceed with the tools that exist.
The Timeline, With The Slippage Left In
Most summaries present a clean roadmap. The actual sequence is worth reading in full because the pattern is the point.
Finance Canada set out its initial open banking framework in Budget 2024 and passed the Consumer-Driven Banking Act in June that year, including foundational elements of scope and technical standards, and designated the FCAC as lead agency, with government adopting a phased approach to three elements of scope: participants, breadth of data sharing, and functionality[1]. The first part of the CDBA, establishing the framework's structure, received Royal Assent in spring 2024[2].
In the 2024 Fall Economic Statement, the federal government announced plans to launch an open banking framework in early 2026[2]. Progress then paused following the prorogation of Parliament in January 2025[2].
Budget 2025 revived and substantially restructured the file, reiterating a commitment to advance open banking by introducing legislation to complete the CDBA, extending the framework to include payment initiation by mid-2027, moving oversight to the Bank of Canada, and proposing amendments to PIPEDA[2].
Then the decisive procedural step: Bill C-15, the Budget 2025 Implementation Act No. 1, received Royal Assent on March 26, 2026, with Division 9 of Part 5 repealing the original CDBA and replacing it with a comprehensive new Consumer-Driven Banking Act[3].
Most recently, on June 27, 2026, the Department of Finance released draft Consumer-Driven Banking Regulations to operationalize the first phase, with a 60-day consultation window; after that closes it will take around twelve months to bring the regulations into force, which realistically points to a phased rollout around 2027[4].
The Regulator Switch Nobody Explained Well
The change of lead agency is the most substantive structural development and received remarkably little scrutiny.
In July 2024, the FCAC publicly welcomed its new mandate, stating that with the passing of Bill C-69 it officially assumed responsibility for overseeing, administering and enforcing Canada's Consumer-Driven Banking Framework, with its Interim Commissioner noting that the evolution of the agency's mandate over 23 years positioned it to oversee the framework[5]. FCAC was allocated $1 million in the 2024 federal budget to develop a consumer awareness campaign[5].
Budget 2025 reversed that. Oversight was delegated to the Bank of Canada, marking a shift from earlier plans for the FCAC, and the remaining $36.9 million previously allocated to FCAC in the 2024 Fall Economic Statement will not be spent[2]. Commentary describes the Bank as chosen for its independence, national reach and regulatory heft, consolidating oversight of multiple modernization efforts under one institution[6], and notes it already supervised registered payment service providers under the Retail Payment Activities Act, with FINTRAC retaining its AML and counter-terrorist-financing supervisory role[7].
The rationale is defensible: consolidating open banking with retail payments supervision under one regulator has genuine coherence. But the switch also has a cost that explains part of the delay. A regulator that inherits a file eighteen months into its design has to build institutional capacity from a different starting point than the agency that spent two years preparing for it, which is consistent with what the Bank said about its own readiness, discussed next.
The Act Was Repealed And Rewritten
A point that is easy to miss and materially affects how a business should read older analysis.
Bill C-15 did not amend the 2024 Consumer-Driven Banking Act. Division 9 of Part 5 repeals the original CDBA enacted as Part 1 in June 2024 and replaces it with a comprehensive new CDBA[3].
Repeal and replacement rather than amendment means that legal analysis written between June 2024 and March 2026 describes a statute that no longer exists. For a business or advisor relying on published commentary about Canadian open banking obligations, the March 26, 2026 date is a hard cutoff: material predating it should be treated as historical context rather than current law, regardless of how confidently it is written.
It also indicates the scale of the redesign. Governments amend when adjusting; they repeal and replace when the architecture changes, and the shift in regulator, the addition of national security machinery and the extension to payment initiation together amount to an architectural change.
Where It Actually Stands Now
The most candid available statement about readiness comes from the regulator itself.
As of March 2026, the Bank of Canada reported that it was still in the information-gathering stage and said it would be premature to set a date until the required work was fully understood, with a 2026 launch widely seen as at risk[8]. The same source notes the planned roadmap of Phase 1 read access in early 2026 and Phase 2 write access in mid-2027, and states plainly that these dates may slip[8].
Set that against the June 27, 2026 draft regulations, with a 60-day consultation followed by roughly twelve months to force[4]. Sixty days from late June closes in late August 2026. Twelve months from a subsequent final publication lands in the second half of 2027 at the earliest, and that assumes no further consultation round and no slippage in a file that has slipped at every prior stage.
The honest summary for a Canadian business planning around this: read access is unlikely to be usefully available before 2027, payment initiation is a 2027-at-earliest proposition that depends on infrastructure discussed below, and any vendor telling you otherwise is selling something.
Read Access, Then Write Access
The phasing determines what becomes possible when, and the two phases differ enormously in what they enable.
Phase 1 is read access, under which consumers will be able to share account information with accredited providers securely[6]. Phase 2 is write access, targeted for mid-2027, expanding the rails to support payments, account switching, and embedded-finance transactions[6][7].
For a small business the distinction is significant. Read access improves how third parties see your finances: cleaner data into accounting software, better underwriting inputs, more reliable cash flow tools. It does not change how money moves. Write access changes how money moves, and account switching in particular is the provision with genuine competitive consequence, because the friction of moving business banking has always been a substantial part of what protects incumbent relationships.
An owner frustrated by their bank should note that the provision most likely to help them is in the later phase, which is also the phase with the additional dependency described next.
The Dependency That Could Move Phase 2
An underreported structural link that a business planning around 2027 should understand.
Canada's Real-Time Rail is described as the country's new instant payment infrastructure, managed by Payments Canada, enabling 24/7 transfers with settlement in seconds under the ISO 20022 standard, with launch planned for Q3 2026, and it is characterized as a necessary condition for Phase 2 of open banking[7].
Phase 2 therefore does not depend only on the open banking timeline; it depends on a separate infrastructure programme delivering on its own schedule. Any slippage in the Real-Time Rail propagates directly into payment initiation, which means the mid-2027 target for write access carries compounded timeline risk rather than the single-programme risk it appears to.
For businesses evaluating payment strategy, the practical reading is that the open banking payment capability should be treated as a possibility for the late 2020s rather than a near-term planning assumption, and that decisions about payment infrastructure should not be deferred waiting for it.
What You Are Doing Right Now Instead
The status quo the framework is designed to replace deserves plain description, because most business owners are participating in it without having thought about it.
Until the framework launches, many apps use screen scraping or aggregator APIs, which is riskier, and the FCAC explains the difference and how to protect yourself[8]. The framework itself is designed to replace risky online password sharing with secure data connections and to increase competition[9], and will let you share financial data with accredited fintechs via secure APIs without giving your banking password to apps[8].
Stated concretely: if your bookkeeping platform, cash flow tool, expense system or alternative lender pulls your bank transactions automatically, there is a meaningful chance it does so by holding credentials that would let it do anything your online banking lets you do, rather than through a permissioned read-only connection. That is a materially different risk posture than most owners believe they have accepted, and it interacts with the account agreement terms many banks impose regarding credential sharing.
This connects to the data governance questions this publication has examined elsewhere: a business with a careful vendor management process for its accounting software may nonetheless have handed that software the keys to its bank account through a checkbox during onboarding.
The Actual Prize For Small Business
Beyond security, the substantive benefit for Canadian small businesses is in lending, and it is worth being specific.
The FCAC framed the consumer version of this at the outset: applications allowing people to build credit using transaction data, making it easier to get a loan, rent an apartment or qualify for a mortgage[5]. Legal commentary identifies the same mechanism on the business side, noting the framework may open new avenues for partnerships with fintechs and the development of innovative data-driven products including alternative credit scoring models[3]. Importantly, the framework covers individuals and businesses, allowing consumers and SMEs to authorise secure access to their financial data by accredited third parties[7].
The underwriting implication is the one that matters. A Canadian business with a short operating history, irregular revenue, or a thin credit file is difficult to underwrite from conventional inputs, and is precisely the profile that struggles for bank credit. Transaction-level data changes what a lender can assess: actual cash flow patterns, revenue seasonality, customer payment behaviour, and expense stability, observed directly rather than inferred from financial statements prepared months after the fact.
Set against the finding examined elsewhere in this publication that Canada's Big Six have been retreating from parts of mid-market corporate finance, the significance grows. Open banking does not restore bank appetite, but it materially lowers the cost for non-bank lenders to underwrite smaller Canadian businesses, which is where the competitive effect on pricing would come from if it comes at all.
What Is In Scope
The data coverage determines how useful read access will actually be. The framework covers deposit accounts, credit cards, lines of credit, and where applicable investment accounts such as TFSAs and RRSPs, with the Big Six banks as mandatory participants[8].
Mandatory Big Six participation is the provision that makes the framework viable rather than optional, since a data-sharing regime the largest institutions could decline would deliver nothing. But note what the enumerated scope does not clearly include: business banking products beyond the listed categories, merchant acquiring data, payroll, or accounting-adjacent financial records held outside banks. The framework is bank data mobility, which is narrower than the financial picture of a business, and that limitation is the subject of the critique below.
The National Security Addition
An element added in Budget 2025 that has no obvious counterpart in most other jurisdictions' open banking regimes.
The CDBA will have built-in national security safeguards, with the Canadian Security Intelligence Service and the RCMP assisting with monitoring and responding to potential threats including fraud, misuse and cyberattacks involving consumer data shared through open banking, supported by $25.7 million over five years beginning in 2025-26 and $5 million ongoing[2].
Two readings. Charitably, this reflects a considered judgment that a national financial data-sharing rail is critical infrastructure and should be treated as such from the outset, which is arguably more mature than jurisdictions that added security architecture retroactively. Less charitably, embedding intelligence and police agencies in a consumer data framework raises governance questions about data access that the available commentary does not address in detail, and the funding is modest relative to the ambition.
For a business, the practical relevance is limited today but worth tracking: the accreditation regime that third parties must satisfy will be shaped in part by these considerations, which may affect how many providers ultimately participate and therefore how much competition the framework actually delivers.
The Critique: Banking Is Not Finance
The most substantive criticism of the Canadian approach is not about timing but about scope, and it comes from a Canadian CPA writing specifically about small business.
Writing in Policy Options, Eric Saumure, a CPA, principal at Zenbooks and founder of OpenSME, argues that Canada's 2026 open banking launch is a milestone, but that without a broader open finance plan, consumers and small businesses will miss out on real affordability gains[9]. The argument is that the launch is Canada's first real step toward a more modern financial data framework, building on years of payments modernization work at Payments Canada, and that it should not be the last, with an open finance roadmap focused on scope, governance and competition needed to deliver what budget documents have long promised: more choice, better prices and a system that works for people and businesses rather than institutions[9].
The distinction between open banking and open finance is exactly the scope gap noted above. A small business's financial reality includes payment processing, payroll, lending, insurance and accounting records, most of which sit outside the bank data the framework covers. A regime that mobilizes only bank data delivers a partial picture, and the underwriting and switching benefits are correspondingly partial.
Commentary from the industry side reaches a similar conclusion from a different direction, advising institutions to look beyond banking because the coming data mobility right points to open finance[6]. It is worth noting that source's own commercial interest as a data connectivity provider, but the structural observation stands independently.
A Worked Case: The Thin-File Borrower
A three-year-old Canadian services business with strong and growing cash flow, no fixed assets, and a founder who had drawn minimal salary applied for a modest operating line. The illustration below is constructed to demonstrate the mechanism rather than reported from a specific engagement.
Conventional underwriting produced an unfavourable picture. Financial statements showed low retained earnings because the founder had reinvested, limited collateral because the business was asset-light, and a short operating history. The application was declined, and the business funded working capital through a high-cost merchant advance instead.
The transaction-level reality was considerably better than the statements suggested: eighteen months of consistent monthly deposits, low revenue concentration, customers paying within terms, and stable operating expenses. Under a read-access regime, a lender could observe that pattern directly and price it, rather than inferring risk from a balance sheet that reflected reinvestment decisions rather than fragility.
The transferable point is that open banking's value for small business is not primarily convenience; it is that transaction data describes a materially different, and frequently more favourable, risk profile than year-old financial statements do. That is also why the delay has a real cost: every year the framework does not exist is a year of businesses like this one being underwritten on the wrong inputs.
What A Business Should Do Now
Stop waiting. The realistic horizon is 2027, and decisions deferred since 2024 in anticipation of this framework have already cost two years. Proceed with the tools that exist.
Audit what already holds your banking credentials. Identify every application with access to your bank data and establish whether it uses credential-based screen scraping or a permissioned connection. This is worth doing today regardless of the framework's timing.
Check your bank's terms on credential sharing. Many account agreements address this, and a business that has shared credentials may have affected its position on unauthorized-transaction protections. This is a question for your bank in writing.
Treat any pre-launch "open banking" marketing sceptically. No accreditation regime is in force. A provider describing itself as open-banking-enabled today is describing an aspiration or using aggregator infrastructure, not participating in a regulated framework.
If you are credit-constrained, understand why. If your difficulty is a thin file rather than genuine weakness, transaction-based underwriting is likely to help you when it arrives, and it is worth knowing that so you can revisit financing then rather than accepting current terms as permanent.
Track two dates, not one. Final publication of the Phase 1 regulations, which starts the twelve-month clock, and the Real-Time Rail launch, which conditions Phase 2.
The Limits Of This Analysis
Several caveats matter. This is a fast-moving file that has changed materially at least four times, and the position described here reflects sources available to mid-2026; verify current status before relying on any date. Because Bill C-15 repealed and replaced the CDBA on March 26, 2026, this article's description of the framework draws partly on commentary predating that replacement, and details of the new Act may differ from the framework as previously described. The draft Phase 1 regulations were in a 60-day consultation at the time of writing and may change before final publication. Timeline inferences in this article, particularly the conclusion that read access is unlikely before 2027, are our own arithmetic from the published consultation and coming-into-force periods rather than official statements. Several sources cited are commercial providers of data connectivity or compliance services with an interest in the framework's advancement, and one is a general tracker site rather than a primary source. This is not legal, financial or technology procurement advice.
Frequently Asked Questions
Is open banking live in Canada?
Who regulates it?
Is the 2024 Consumer-Driven Banking Act still the law?
What is the difference between the two phases?
Why might Phase 2 slip further?
What should a small business do in the meantime?
References
- Open Banking Expo. Canadian Government Publishes Consumer-Driven Banking Framework, on Budget 2024, the June 2024 Act, FCAC designation and the phased approach to scope. openbankingexpo.com/news/canadian-government-publishes-consumer-driven-banking-framework
- McMillan LLP. (2025, November 18). Canada's Open Banking Framework: Key Updates From Budget 2025, on the prorogation pause, the regulator shift, unspent FCAC funding and national security safeguards. mcmillan.ca/insights/publications/canadas-open-banking-framework-key-updates-from-budget-2025
- DLA Piper. (2026, April 22). The New Consumer-Driven Banking Act Explained, on Bill C-15's Royal Assent March 26, 2026 and the repeal and replacement of the original CDBA. dlapiper.com/en-pl/insights/publications/2026/04/the-new-consumer-driven-banking-act-explained
- RedCompass Labs. (2026, July 8). Canada Finally Moves The Needle On Open Banking, on the June 27, 2026 draft regulations, the 60-day consultation and the twelve-month coming-into-force period. redcompasslabs.com/insights/canada-finally-moves-the-needle-on-open-banking
- Financial Consumer Agency of Canada. (2024, July 3). FCAC Welcomes New Mandate To Oversee Canada's Consumer-Driven Banking Framework. Government of Canada. canada.ca/en/financial-consumer-agency/news/2024/06/fcac-welcomes-new-mandate
- Flinks. (2026). Open Banking In Canada: What The 2026 Launch Means For Fintechs. Note: published by a financial data connectivity provider. flinks.com/blog/open-banking-canada-2026-launch-fintech-institutions
- Facephi. (2026, May 4). Open Banking In Canada 2026: Real-Time Payments And Open Banking, on the Real-Time Rail dependency and the RPAA supervision context. Note: published by a digital identity and compliance vendor. facephi.com/observatory/en/open-banking-canada-real-time-payments-2026
- Open Banking Tracker. Open Banking In Canada, on the Bank of Canada's March 2026 position, scope coverage and mandatory Big Six participation. Note: a tracker site rather than a primary source. openbankingtracker.com/country/canada
- Saumure, E. (2025, December 5). Canada Needs An Open Finance Roadmap, Not Just Open Banking. Policy Options, Institute for Research on Public Policy. policyoptions.irpp.org/2025/12/open-finance
This article discusses legislation, draft regulations and industry commentary and is provided for general informational purposes. It is not legal, financial or technology procurement advice. This file has changed materially several times and draft regulations remain in consultation; verify current status before relying on any date stated here.