The Consumer-Driven Banking Act (CDBA) is officially open for your business. Signed into law on March 26, 2026, this law gives Canadians a legal right to control who sees their financial information and where it goes. For the first time in Canadian law, your bank data is now working for you.
What is the Consumer-Driven Banking Act?
The Consumer-Driven Banking Act (CDBA) is a Canadian federal law whose purpose is to create a framework where consumers and businesses can direct their financial data to approved service providers of their choice, with sharing that is safe, secure, and designed to foster competition in the financial sector.
The path to its Royal Assent was long. The federal government launched a review into open banking in Budget 2018, appointed an Advisory Committee on Open Banking, and named Abraham Tachjian as Open Banking Lead in 2022 to bring financial institutions, fintechs, credit unions, and consumer groups to the table. After two budget implementation bills in 2024 and 2025, the CDBA received Royal Assent on March 26, 2026.
Still, many of its provisions are explicitly marked “not in force,” and the proposed Consumer-Driven Banking Regulations (CDB Regulations) were pre-published in the Canada Gazette on June 27, 2026, for a 60-day comment period. The final regulations are expected within one year of that publication.
Learn more about the consumer-driven banking in Canada with this video:
Bookmark our Special Edition on Technology Law for more news and updates on the Consumer-Driven Banking Act, including the leading lawyers in this legal area.
What Consumer-Driven Banking Act the gives you
As Torys LLP partner Brigitte Goulard told Canadian Lawyer in June 2024, open banking or consumer-driven banking lets consumers “have access to the data that is currently sitting in [their] financial institution” and “direct [their] financial institution to send that information to another service provider or app.”
Once operative, the CDBA provides consumers four tools directly from the statute:
- Express consent (s. 85): No entity can request your data from another without your active, explicit permission. Simply using a product or service does not count as consent.
- 12-month limit (s. 86): Consent expires after no more than 12 months and must be actively renewed.
- Consumer dashboard (s. 95): Every participating entity must maintain one location on its website or app showing who holds your data, what is shared, and for how long. You can withdraw or renew consent directly from there.
- Right to delete (s. 90): After withdrawing consent, you may request deletion of your data. The entity must comply unless prohibited by law.
Who is liable when your open banking data is breached?
Under the CDBA, if your data is accessed or misused within the framework, the legal default is that you are not responsible:
- s. 103(1): You are not financially liable for losses from unauthorised access to or use of your data, unless you were grossly negligent in protecting your authentication information. In Quebec, the standard is gross fault, and one lapse does not automatically meet that threshold.
- s. 103(2): If you report stolen or compromised credentials, s. 103(2) extends that protection. From the moment you file that report, any losses that follow are not yours to absorb. The entity must prove on a balance of probabilities that you contributed to the misuse.
- ss. 104(1) and 104(4): Under these provisions, the participating entity is responsible for all consumer data in its control. That responsibility stays with the entity even when a third-party service provider performs the work.
When a breach happens
Under the CDBA, s. 82 requires participating entities to:
- report a breach to the Bank of Canada as soon as they become aware of it
- notify affected consumers directly if the breach creates a real risk of significant harm
The CDBA defines significant harm broadly at s. 82(7). It includes:
- financial loss
- identity theft
- humiliation
- damage to reputation or relationships
- loss of employment
- negative effects on a credit record
The Office of the Privacy Commissioner of Canada flagged in its September 2026 submission to Finance Canada that the draft CDB Regulations’ prescribed list of security safeguards may not adapt well to changing technology risks. This submission is on top of the Privacy Commissioner’s full recommendations on the consumer-driven banking regulations in detail.
Here’s a video that explains more about Canada’s open banking system:
Head over to our list of the best technology transactions in Canada as ranked by Lexpert for the top-ranking lawyers and firms in this practice area.
How do Canada’s banking laws protect you from fraud?
Alongside the Consumer-Driven Banking Act, the federal government has been advancing a separate but connected layer of financial protection.
On July 2, 2026, Ottawa pre-published fraud prevention regulations under Bill C-15, which amends the Bank Act. The government called this the opening step in Canada’s first-ever National Anti-Fraud Strategy.
Under these regulations, banks must:
- obtain your explicit consent before turning on electronic funds transfer capabilities on your account
- allow you to disable those capabilities yourself
- follow set timelines for processing requests to change transaction limits
- report fraud cases to the Financial Consumer Agency of Canada (FCAC)
The FCAC commissioner will be required to publish an annual fraud report to the finance minister, compiled from data provided by banks across Canada.
The numbers driving this push are hard to ignore. According to the Canadian Anti-Fraud Centre, fraud schemes took over $704 million from Canadians in a single year. Reported losses since 2022 have topped $2.4 billion. Only 5 to 10 percent of scams are ever formally reported.
Finance Minister François-Philippe Champagne stated the regulations aim at “strengthening economic resilience, increasing innovation and competition in the financial sector,” as reported in Lexpert’s July 2026 coverage of Canada’s proposed fraud prevention regulations.
What are the $3,000 rule and other cash questions about?
The $3,000 rule and other cash questions fall outside the scope of the CDBA.
The CDBA is a data law, and it does not set thresholds for cash transactions. Rather, it governs the secure electronic sharing of financial records, including transaction history, account balances, and product information, between approved entities.
How the CDBA is different
Cash transaction reporting and suspicious transaction monitoring fall under Canada’s anti-money laundering legislation, administered through a separate federal body. The question behind “is it safe to have $500,000 in one bank?” belongs to the deposit insurance framework, which operates independently of the CDBA.
What the CDBA does say about your money is this: under s. 77, data sharing is free of charge. Participating entities cannot bill you for sharing your data, for collecting your consent, or for cancelling it.
The proposed and pre-published CDB Regulations also require that data-sharing endpoints be available 99.5 percent of the time each month, so access to your financial information stays consistent.
Consumer-Driven Banking Act: still opening for business
The Consumer-Driven Banking Act is now a law, yet Canada’s consumer-driven banking framework is still being built. The final CDB regulations are expected to come into force within one year of publication in the Canada Gazette. That window is the time to understand what the law gives you, see which questions it answers, and recognise which ones belong to a different door.
Subscribe to the free Lexpert newsletter to read more articles on Canadian laws and other exclusive content, such as the Consumer-Driven Banking Act.