On August 4, 2021, the Advisory Committee on Open Banking, a task force created by the Government of Canada to lead a review into the merits of open banking, publicly released its final report. The Report makes recommendations on how to implement a secure open-banking system that enhances the welfare of Canadian consumers and businesses, and supports innovation and economic growth in Canada. It follows an initial report that was issued in connection with the first phase of the federal government’s consultation process on open banking. Designed to harness the benefits of both government and industry-led models for open banking, the Advisory Committee calls for certain functionality to be operational in as little as 18 months.

“Open banking” refers to a system that allows consumers and small businesses to transfer their financial data securely and efficiently among financial institutions and accredited third parties, providing consumers greater control over their data and allowing them to use innovative, new financial services. In keeping with the rapid digital transformation of the global economy, open banking would realize consumers’ right to data portability and provide a system of secure, efficient and consumer-permissioned data sharing to help consumers better manage their finances and improve their financial outcomes.

1. Recommendations for vision

Like many proposals in the Canadian financial services sector, the Report recommends a “made-in-Canada system,” where industry would manage the implementation and administration of an open banking system, while government would establish clear policy objectives, set the framework and timeline and bring together the various participants. Canada’s hybrid open banking system would aim to achieve six key consumer outcomes:

• Consumer data is protected;
• Consumers are in control of their data;
• Consumers receive access to a wider range of useful, competitive and consumer friendly financial services;
• Consumers have reliable, consistent access to services;
• Consumers have recourse when issues arise; and
• Consumers benefit from consistent consumer protection and market conduct standards.

The Report also recommends that financial inclusion be considered in the design of an open banking system and be complemented by financial education policies, programs, and resources.

2. Recommendations for scope

To expedite the process, the Advisory Committee recommends a phased approach to open banking – Phase One: System Design and Implementation (18 months), and Phase Two: Ongoing Administration of the System (beyond 18 months).

The Report emphasizes that the initial scope of an openbanking system must be broad enough to provide Canadians with access to a wide range of useful, competitive and consumer-friendly financial services. To that end, the Report recommends that federally regulated banks be required to participate in the initial scope of the open banking system, while provincially regulated financial institutions, such as credit unions would, have the opportunity to join on a voluntary basis. Other entities would be allowed to participate upon meeting accreditation criteria and following the rules of the open banking system.

Under the proposed two-phased approach, the initial scope would enable both consumers and small and medium enterprises to participate. Phase One would reflect data currently available to Canadians through their online banking applications, including chequing and savings accounts, investments accounts, and lending products, and would be limited to read access functions¹.

Once established, and once the risks understood and appropriately addressed, the Report anticipates that the scope of the system would be expanded to include new types of data as well as write access functions.

3. Recommendations for governance

The Report recommends that the government appoint a lead individual responsible for convening stakeholders to advance the key foundational elements (within the first nine months of their appointment) – common rules, an accreditation framework and technical specifications – and the implementation of a system (over the following nine months). The Report indicates that, while the lead could be internal or external to government, they should understand the financial and technology sectors and their participants. They should also be recognized as a proponent of innovation.

Following the conclusion of the lead’s work programme, the Report recommends that the government establish a formal governance entity to provide ongoing administration and transition support. It recommends that the government consider a legislative or regulatory framework to codify elements of open banking, with a view to expanding to additional products or functions over time.

4. Recommendations for common rules

Common rules would ensure efficient functioning, consumer protection and a positive consumer experience. The Report recommends the development of common rules in relation to three central areas of concern: liability, privacy and security.

It is recommended that liability flow with the data and rest with the party at fault. Further, rules regarding complaints handling and liability attribution would need to be simple and efficient for consumers. In all functions of open banking, the Report recommends that consumers be limited from liability beyond a fixed-dollar amount (e.g., $50) except in the case of gross negligence or a criminal act. The rules would also need to prescribe clear and automatic terms of redress for consumers, which would include immediate compensation for any financial loss, and follow appropriate standards of care for protection and redress regarding a loss of sensitive financial data.

Development of common rules for privacy is recommended in two areas:

• Consent management: Ensuring consumers have clear understanding of who has their data, what that data includes, and how it is being used; a standardized process for consumers to provide and revoke consent to share their data; and considerations for how financially marginalized or vulnerable consumers will navigate an open banking system; and
• Privacy management: Policies, practices and procedures built into operations that protect personal information.

Finally, common rules for security are recommended for operational and systemic risk and data security. Third-party service providers seeking accreditation would also need to meet a minimum “floor” of security standards, with stronger standards required based for higher-risk services or providers.

5. Recommendations for accreditation

The Advisory Committee proposes all entities seeking entry into the open banking system meet certain accreditation criteria, with the exception of federally regulated banks. The accreditation process would be independent, transparent and coherent with other regulatory regimes, like the Payments Canada rules or the regulatory framework proposed by the new Retail Payment Activities Act. Accreditation would follow criteria developed with the intention of demonstrating an ability to comply with the common rules surrounding liability, privacy and security, including having the financial capacity to ensure consumers are protected in the event of loss.

Fundamental to the accreditation regime is the need to keep barriers to entry low enough to allow participation by a wide range of entities while also protecting consumers, end users and other participants. To achieve this balance, the Report recommends that flexibility and tiered participation that is proportionate to the degree of risk to the system.

6. Recommendations for technical specifications and standards

The Report recommends that the open banking lead engage technical expertise to develop technical specifications that support established public policy objectives. Recommended principles include accessibility and inclusivity for all accredited system participants, safe and efficient transfer of data, the capability to evolve with technological change, and interoperability with international approaches. In the event that no adequate solution emerges, the Report suggests government intervention.

The Report concludes by recommending the government move forward quickly to implement the open banking system. As an immediate next step, the Advisory Committee urges the government to designate the open banking lead to convene industry, government and consumers in designing the foundation of the system. Following the subsequent testing and accreditation periods, Canada could see the implementation of a much-anticipated open banking system in operation by January 2023, better positioning Canadians and Canadian businesses to improve their financial outcomes and recover more quickly from the impacts of the COVID-19 pandemic.

A special thank you to Cindy Qi (articling student) for her assistance with this article.

 ¹ Read access refers to the ability for third-party service providers to receive consumer financial data, but not edit this data on banks’ servers.