Open banking: Looking ahead to accreditation

This article was prepared with the assistance of summer law student Matthew Douglas.

Financial data can say a lot about a person. Account balances can hint at income levels, transaction records can be suggestive of personal interests — and the list goes on.

Despite the significant potential for teaching businesses about consumers and consumers about themselves, financial data tends to be kept secure under lock and key, and for good reason. Sharing financial data can pose a number of risks to personal assets and personal privacy. However, by keeping financial data locked away, banks, credit unions and consumers also keep financial data out of reach of potentially useful service providers.

These service providers, which include financial technology companies (“fintechs”), leverage financial data to offer services designed to help consumers better manage their personal finances, among other things. But without access to the financial data, these services cannot work. Open banking solves the problem of getting consumer financial data in the hands of value-adding fintechs, while at the same time protecting consumer privacy and security.

Implementing open banking in Canada

The introduction of open banking to the Canadian financial services market is well underway. In 2018, the Government of Canada appointed the Advisory Committee on Open Banking (the “Advisory Committee”) to conduct research with a view to bringing open banking to Canada.

The Advisory Committee produced two interim reports in 2020 following stakeholder consultations, and a final report in 2021 with a series of recommendations for implementing open banking in Canada. In early 2022, the federal government appointed Abraham Tachjian to lead the development and implementation of an open banking framework for Canada.

Four working groups were subsequently established, focusing on matters of (i) accreditation to participate in open banking, (ii) liability and consumer redress, (iii) consumer privacy and consent to data sharing and (iv) security requirements for open banking participants.

In December 2022, the federal government reported that these working groups were making good progress and were showing consensus on a number of core issues as the work on an open banking framework is set to continue throughout the 2023 calendar year.

Participating in open banking

While the open banking framework for Canada remains a work in progress, some points are coming into focus. Accreditation, for example, will be a key consideration for many entities looking to participate in the new open banking system to ensure participants meet basic financial, technical, security and governance standards. What is less clear, however, is which entities will need to be accredited.

The Advisory Committee recommended that federally regulated banks be exempt from accreditation, owing to banks’ experience and track record as stewards of financial data, but did not recommend outright that credit unions be exempt from accreditation requirements. However, the working group on accreditation does not appear to have engaged with the possibility of credit unions being subject to accreditation requirements. How the final version of the open banking framework will address credit unions and accreditation remains to be seen.

For third-party businesses – the fintechs – that want to leverage financial data to provide services to consumers, an accreditation requirement seems a near certainty — but there is uncertainty over how far the accreditation requirements will go. The accreditation working group considered two related ideas: (i) that entities directly accessing and retrieving financial data from banks and credit unions should be accredited and (ii) that entities collecting financial data should be accredited.

Multiple organizations will work alongside each other to provide optimal open banking services to consumers. The entity that retrieves the financial data may not be the same entity that collects the financial data, and there may be other entities involved in the data chain that process the financial data and present the data to the consumer. The activities of one entity in an open banking arrangement may pose more or less risk to consumers, depending on the entity’s role in the data chain. Who, then, should be accredited, and to what extent?

It is important that the accreditation model promotes entry for legitimate open banking participants while maintaining the protection of consumer financial information. The accreditation working group considered different models of accreditation, taking lessons from the United Kingdom and Australia, which already have open banking systems in operation.

These countries have created multiple accreditation models that give fintechs access to consumer financial information. Two such examples are the principal/representative model and the sponsor/affiliate model. These involve fintechs acting as representatives/affiliates providing services directly to consumers, while traditional financial institutions or other accredited data aggregators (e.g., principals/sponsors) provide a technical connection to financial data. This reduces the administrative and regulatory burdens on fintechs while leveraging their innovative financial technology. These models require the accredited entity to remain responsible for the unaccredited entity.

Based on accreditation discussions to date, it seems clear the working group is committed to ensuring accreditation requirements do not create undue administrative and regulatory burdens that exclude legitimate open banking participants from entering the market. Progress to date indicates there will likely be a tiered approach to accreditation in Canada when the framework is ultimately rolled out, and some form of subcontracting with unaccredited entities may be permitted.

Looking ahead

Although the specific details of Canada’s new open banking regime are still being worked out, it is not too early to start considering how open banking may impact your regulatory compliance obligations, contracting strategies and privacy and security regimes. The Innovation, Data & Technology Group at MLT Aikins has extensive experience assisting financial institutions and technology leaders in navigating matters of this nature, and would be pleased to assist your business in planning for Canada’s open banking future. Contact us to learn more.

Note: This article is of a general nature only and is not exhaustive of all possible legal rights or remedies. In addition, laws may change over time and should be interpreted only in the context of particular circumstances such that these materials are not intended to be relied upon or taken as legal advice or opinion. Readers should consult a legal professional for specific advice in any particular situation.