Overview
The Bank of Canada (the “Bank”) has published two proposed guidelines relating to the accreditation process for prospective participants under the Consumer-Driven Banking Framework: the Participating entity accreditation application requirements under the Consumer-Driven Banking Act (the “Participating Entity Guideline”) and the Third-party service provider accreditation application requirements under the Consumer-Driven Banking Act (the “TPSP Guideline”).
Participating Entity Accreditation Application Requirements
The Participating Entity Guideline clarifies and sets forth additional detail with respect to (i) application information, (ii) the Bank’s decision, (iii) review and appeal procedures, and (iv) application and accreditation requirements for prospective participating entities.
The Participating Entity Guideline supplements the Consumer Driven Banking Regulations (the “Regulations”) by adding additional practical detail and supervisory expectations beyond what is included in the Regulations, including the following:
- Canadian Place of Business: The applicant may be considered to have a place of business in Canada if one or more of the following factors are present: (i) the applicant has a physical location in Canada, which includes home offices, and the place of business does not have to be a storefront or brick-and-mortar location, (ii) the applicant is incorporated in Canada under either federal or provincial legislation, and (iii) the applicant has employees, agents or mandataries in Canada.
- Independent Third-party Assessments: An assessment by a sufficiently skilled third party should demonstrate how the applicant has addressed each of the security safeguard requirements outlined in the Regulations. The confirmation based on this assessment should address implementation of each safeguard, disclose material limitations and explain how any alternative framework supports compliance. The assessment is expected to be completed within the 12 months before the application was submitted.
- Insurance or Guarantee: The Bank expects professional indemnity and cyber insurance, or equivalent guarantees, without exclusions for privacy, data-related or consumer-driven banking losses. Applicants should develop, document and periodically review a methodology to determine the amount of insurance or guarantee required to cover the risks arising from the applicant’s management of data under the consumer-driven banking framework, and submit the policy or guarantee with a written explanation of its sufficiency.
- Integrity of Individuals with Significant Responsibility: Individual PSP applicants must attest to their good character and provide supporting evidence, while entity applicants must implement an Integrity and Good Character Policy, identify those with significant responsibility, and attest that they have been assessed pursuant to that policy. The policy must require reporting of relevant changes in circumstances and should provide for regular reassessment, recordkeeping and senior-management approval. Assessments should consider serious criminal history or related proceedings, professional discipline, regulatory or government investigations, and insolvency or bankruptcy history, with any implications for suitability assessed and documented.
- National Security: Upon completion of a national security review for an applicant, the Minister of Finance will either issue a directive to the Bank to refuse the application or notifies the Bank that no refusal directive will be issued. The Participating Entity Guideline clarifies that a notification that no directive will be issued does not mean the applicant has been accredited and that the Bank must still complete its review of the application before making a decision about accreditation.
The Participating Entity Guideline also provides further information regarding the streamlined accreditation for federal and provincial financial institutions.
Third-Party Service Provider Accreditation Application Requirements
The TPSP Guideline is significantly pared down as compared to the Participating Entity Guideline and contains information with respect to (i) general application information, and (ii) application and accreditation requirements for prospective accredited third-party service providers. Third-party services providers must be accredited if they obtain or manage consent, and confirm authentication information or manage authentication, or provide or receive consumer data on behalf of a participating entity. The
TPSP Guideline outlines requirements regarding Canadian place of business, integrity and good character of individuals with significant responsibility.
Looking Ahead
The Guidelines are open for public consultation until December 8, 2026, during which time interested stakeholders can provide written feedback to [email protected]. The Bank has stated that it wants to know whether any aspects of the draft Guidelines could be clarified, difficult to implement in practice, discourage voluntary participation, or supported with additional examples or supporting information.
These are the first in a series of supervisory guidelines the Bank plans to issue as the framework is developed and will be followed by consultations on additional draft guidelines.
For more information on the consumer-driven banking framework, please refer to our publications titled Open Banking Milestone: Draft Consumer-Driven Banking Regulations Released and Budget 2025: The Bank of Canada’s Mandate Expands to Stablecoin and Open Banking Supervision.
