The Bank of Canada has published two draft guidelines outlining what organisations will need to demonstrate to gain accreditation under Canada’s Consumer-Driven Banking Framework.
The publications provide greater clarity on the application process and expectations around security, governance and the suitability of key individuals.
The guidance covers participating entities, such as financial institutions, and third-party service providers (TPSPs) carrying out certain activities on their behalf.
Titled Participating entity accreditation application requirements under the Consumer-Driven Banking Act and Third-party service provider accreditation application requirements under the Consumer-Driven Banking Act, the documents build on existing regulations by detailing the information applicants must provide.
What organisations need to demonstrate
The guidance for participating entities explains how to apply, how applications will be assessed and what options are available to challenge decisions.
Key requirements include demonstrating an established connection to Canada, appropriate security measures and sufficient insurance coverage.
Applicants must provide evidence of an independent security assessment completed within the previous 12 months. They must also show that their professional indemnity and cyber insurance adequately covers risks involving privacy and consumer data.
The Bank has also emphasised the importance of assessing the suitability of individuals in positions of significant responsibility. Organisations will need policies to monitor their integrity and character, taking into account factors such as criminal history, regulatory investigations and professional disciplinary action.
The guidance also clarifies that national security reviews and accreditation are separate processes. Passing a security review does not guarantee accreditation, as applicants must still meet the Bank’s requirements.
Federal and provincial financial institutions may also qualify for a streamlined accreditation process.
Requirements for third-party service providers
The second guideline focuses on when TPSPs will need accreditation under the framework.
This applies to providers carrying out certain activities on behalf of participating entities, including managing consumer consent, handling authentication information and accessing or sharing consumer data.
The guidance outlines their application requirements, with particular emphasis on having an established presence in Canada and ensuring individuals with significant responsibilities meet the relevant integrity standards.
Supporting Canada’s Consumer-Driven Banking framework
Together, the two publications give prospective participants a clearer understanding of the standards they will need to meet to join Canada’s Consumer-Driven Banking ecosystem.
The guidance marks another step towards establishing a secure and trusted framework for consumer data-sharing.