What “connect your bank” is about to mean in Canada
For years, letting an app see your banking data usually meant handing over your online banking password. That arrangement is being replaced, and the replacement has a name, a regulator and a timetable.
The old way, and why it is ending
If you have ever linked a budgeting app, an accounting tool or a lender to your bank account, you may have been asked for your online banking username and password. The service then signed in as you and read the screens. The industry term for this is screen scraping.
Two things are wrong with it. You have handed over credentials that can do far more than read a balance, and your bank cannot tell the difference between you and the software acting as you. If something goes wrong, working out who did what afterwards is difficult.
Canada now has legislation that replaces this. The framework is called consumer-driven banking, and it is what most other countries call open banking.
Where it actually stands
The framework was built in two pieces of legislation. The first established its structure in 2024. The second, Bill C-15, received Royal Assent on 26 March 2026 and completed it, including an express prohibition on screen scraping once the system is operating.
Oversight sits with the Bank of Canada. This is a change worth noting, because earlier plans had placed it with the Financial Consumer Agency of Canada, and older articles still say so.
Draft regulations setting out how data sharing will work in practice were published in the Canada Gazette on 27 June 2026. At the time this article was written, that consultation was open until 26 August 2026, which means the detail was still being settled while the law itself was already final.
A framework can be law and still not be running. Legislation passing is not the same as a system you can use, and the gap between them is filled by regulations, accreditation criteria and technical standards. Expect the phrase “open banking is here” well before anything changes on your screen.
What it is expected to change for you
The first phase covers read access. A provider that has been accredited will be able to see data from deposit, investment, credit and payment accounts, and only with your explicit consent. The stated intention is that consent is specific and revocable rather than a password handed over once and forgotten.
Payment initiation, meaning a third party moving money rather than just reading, is expected later, around the middle of 2027.
The questions worth asking when something asks to connect
- Is the provider accredited under the framework, and can that be checked?
- What specific data is being requested, and for what stated purpose?
- How long does the consent last, and how is it withdrawn?
- Is this read access only, or can the provider also move money?
- If I am still being asked for my banking password, why?
Where to verify this
The Canada Gazette carries the published regulations. The Department of Finance Canada publishes the framework itself, and the Bank of Canada publishes its oversight role. Those are the sources that settle any disagreement about what the rules currently say.
Sources
Nordvern International is not affiliated with, endorsed by, or connected to any organisation listed here. These are the published sources for the statements above.
This article is general educational information. It is not personalized financial advice, and it does not take any individual's circumstances into account. Verify anything that matters through the sources above.
Also worth reading
-
Digital tools
Instant payments are arriving, and instant tends to mean final
Canada is switching on a payment system that settles in seconds, around the clock. Speed is the headline. The part worth understanding is what happens to a payment you wish you had not made.
-
Online safety
A familiar voice is no longer proof of who is calling
Voice cloning has moved from a demonstration to a routine tool in fraud against Canadian families. The defence is not better listening. It is changing what you accept as proof.