Canada Finally Moves: What Budget 2025 Means for Open Banking

Canada has at last committed to legislating Open Banking. Budget 2025 promises a Consumer-Driven Banking Act, oversight by the Bank of Canada, a legal right to data mobility, payment initiation ("write access") after Real-Time Rail, and a federal regime for fiat-backed stablecoins.

Source news: Open Banking Expo - "Canadian government commits to Open Banking in Budget 2025": https://www.openbankingexpo.com/news/canadian-government-commits-to-open-banking-in-budget-2025/

What actually changed

  • Consumer-Driven Banking Act: Government will introduce legislation to complete the consumer-driven banking framework.
  • Regulator realignment: Oversight will shift to the Bank of Canada, leveraging its supervision of payment service providers under the Retail Payment Activities Act; the Bank will retain $19.3m over two years to stand this up.
  • Security funding: $25.7m over five years for CSIS and the RCMP to embed national-security safeguards into the regime.
  • Data mobility right: PIPEDA will be amended to add an economy-wide data portability right that underpins consented data sharing.
  • Write access (payment initiation): Government intends to legislate payment initiation by mid-2027, aligned to Real-Time Rail adoption.
  • Real-Time Rail: RTR is reaffirmed for a 2026 launch.
  • Stablecoins: A new federal framework will regulate fiat-backed stablecoin issuance, with administration by the Bank of Canada and related changes to the Retail Payment Activities Act.

Why this matters

This is the first time Ottawa has moved from consultations to a concrete commitment to legislate Open Banking. The decision to anchor governance at the Bank of Canada signals a tighter coupling of data sharing, payments, and operational resilience - and should reduce fragmentation across agencies.

Practically, the combination of a legal portability right, accreditation and oversight, and eventual write access moves Canada closer to UK-style utility - but with a payments-first cadence via RTR.

Indicative timeline

  1. 2025-2026: Legislation introduced; Bank of Canada builds supervision function; accreditation rulebook emerges; RTR delivery progresses.
  2. 2026: Real-Time Rail goes live; broader access to Payments Canada continues.
  3. By mid-2027: Write access (payment initiation) is legislated and enabled once RTR is in widespread use.

For banks

  • Target architecture: Align consented data sharing and initiation flows to FAPI 1.0 Advanced / FAPI 2.0 security profiles; design with JARM, PAR, and mTLS as defaults.
  • Consent and data minimisation: Map all datasets you will expose; implement fine-grained, purpose-bound consent receipts and revocation.
  • Operational readiness: Treat Bank of Canada oversight as prudential-adjacent: evidence security controls, testing, incident reporting, and vendor governance.
  • Payments convergence: Plan for initiation that settles over RTR rails; ensure aliasing, confirmation-of-payee, and misdirected-payment resolution processes are wired in.

For fintechs

  • Accreditation track: Expect eligibility criteria echoing RPAA supervision standards (governance, safeguarding, risk, capital/insurance, and audits).
  • Data portability UX: Build import/export flows for multi-bank account histories; invest early in consent UX that matches Canadian cultural and regulatory expectations.
  • Initiation products: Roadmap PIS-style use-cases that unlock real value in Canada (account-to-account collections, instant pay-by-bank at checkout, and SME payouts).
  • Stablecoin guardrails: If you touch digital assets, model reserve, redemption, and risk-management obligations now.

For consumers

You will gain a legal right to move your financial data between providers, with accreditation, security safeguards, and the ability to initiate payments directly from your bank account in third-party apps once RTR is mainstream.

Quick answers

Is this finally law?
No - Budget 2025 commits to introducing the legislation and sets out the operating model and funding. The parliamentary process still needs to run.
Why the Bank of Canada?
It already supervises retail payment service providers and will retain funds to implement the open banking framework - creating a single locus for payments and data oversight.
When can we do payment initiation?
Government intends to legislate write access by mid-2027, after Real-Time Rail is live and widely adopted.

What to do next

  • Gap-assess now: Map your posture against FAPI, OAuth 2.1, DCR, JARM, PAR, and mTLS.
  • Design for consent first: Implement user-centric consent, granular scopes, and auditable logs.
  • Build a PIS pilot: Create a thin payment-initiation slice that can ride RTR once available.
  • Plan for audits: Expect accreditation, threat modelling, red-team tests, and third-party risk reviews.

Work with us

If you need a fast, practical plan for Canada's Consumer-Driven Banking - from architecture and accreditation to developer enablement - we can help. Email info@opendataconsult.com.

👋 Enjoyed the article?

Book a Call with Us