About nine million Canadians currently share their online banking passwords with third-party apps to get help with budgeting, financial planning or doing taxes. The practice is called screen scraping and the federal Finance Department has warned it is a security risk. All but one of the country’s Big Six banks formally prohibit sharing passwords, but clients do it anyway because there has been no alternative.
The Consumer-Driven Banking Act, to take effect this year, will provide open banking and make screen scraping illegal. Consumers will be able to direct their bank to share specific financial data with authorized third parties through a secure portal (API). The choice will be stark for every financial technology company (fintech) that currently relies on customers to supply passwords to tap into its product: Become accredited under the new law or stop operating.
Canada’s big banks have a built-in advantage. They hold all their customers’ financial data and, until now, no one else could use it. The idea is to give fintechs secure, authorized access to that same data and more competitive financial products will follow. That is correct as far as it goes, but it doesn’t go far enough. Data access alone isn’t enough if the companies meant to use it can’t afford a way in.
Two countries with different results
A case in point is what happened in Australia, which launched its Consumer Data Right in 2020. Australia’s assistant treasurer subsequently said the idea needed a reset. Industry groups called for going back to the drawing board. The government ordered a strategic review.
The review showed that, by the end of 2023, just 0.31 per cent of bank customers had an active data-sharing arrangement. The banking industry had spent 1.5 billion Australian dollars (C$1.45 billion) since 2018 building the infrastructure, but with minimal consumer benefit to show for it.
Compliance costs were a big problem. Australia’s open banking law included a single standard for accreditation. It was more than twice as burdensome for mid-tier banks as it was for major financial institutions. Early-stage fintechs fared worse still. Australia eventually allowed smaller players to receive data through accredited intermediaries at lower cost — an overhaul that took years and arrived after much of the damage was done.
The United Kingdom tells a more successful story. Open banking launched there in 2018. Last year it reached more than 16.5 million users and generated more than 4 billion pounds (C$7.3 billion) in economic value. The U.K. created a dedicated body, called Open Banking Limited, that developed shared security standards, provided certification services and offered technical assistance to banks and fintechs alike. This reduced the cost of meeting standards and created easier paths to market for the smaller startups the policy was meant to support.
Canada’s open-banking legislation carries the risk of Australia’s initial model without the backstop of the U.K.’s oversight body.Whilethe Consumer-Driven Banking Act streamlines accreditation for already-regulated financial institutions, it rejects tiered accreditation for all other entrants, including small fintechs and technology firms. This means compliance requirements aren’t adjusted for firm size or the level of data access sought. Australia’s comparable single-tier approach choked innovation by smaller players and eventually forced the government to retrofit its legislation.
An engineering problem on top of a financial one
Canada faces the same problem. When the screen-scraping ban takes effect, a startup with 12 engineers will face a higher compliance bar than a regulated bank that qualifies for streamlined accreditation. This compliance moat is real. It gives an advantage to financial institutions and fintechs that already have legal, security and technical infrastructure to meet rigorous standards. They are the very players the policy was designed to challenge.
This matters because building financial products Canadians will use requires more than secure access to a service. It requires engineering expertise to connect software systems securely and reliably. Design capability to make products people trust. Brand recognition in a sector where consumer confidence is everything. Acquiring customers at a cost that makes the economics work. And capital to absorb early losses and survive the years it takes to build a financial brand from scratch.
Canada’s fintech sector is comparatively thin on all of these. In 2025, Canadian fintech investment totalled US$2.4 billion, a fraction of the US$56.6 billion invested in the United States. And most of Canada’s figure came from just three large transactions. The capital available to experiment with and refine a product, absorb compliance costs and compete on quality is not distributed evenly among the participants Ottawa has said it wants to support.
The new law does include some important safeguards. Any company, foreign or domestic, that wants access to Canadians’ financial data must open its own data to them in return. And financial institutions don’t have to share the tools and models they’ve built from that data, which protects their competitive edge.
But these protections don’t solve the core problem of competitiveness. Sharing data in both directions doesn’t give a small Canadian startup the team or money to build something better with it. Shielding in-house insights from competitors mostly benefits the Big Six — who already hold almost 95 per cent of Canadian banking assets — not the challengers the legislation is meant to help make competitive.
A way forward
Two changes would improve the odds of success for Canada’s open-banking law.
The first is meaningful tiered accreditation for new entrants. As shown by Australia’s experience, compliance requirements that are uniform and demanding, prevent smaller fintechs from entering the mix. The competitive diversity promised never materializes.
The second is a Canadian equivalent to the U.K.’s Open Banking Limited to help develop shared technical infrastructure, reduce integration costs and make standards accessible to smaller participants. The Bank of Canada has been designated as the supervisory authority over the Consumer-Driven Banking Act, but the central bank’s mandate is accreditation, compliance oversight and enforcement — not development of the infrastructure itself.
Open banking promises Canadians better financial products, lower fees and real alternatives to the Big Six banks. That promise depends on a domestic fintech sector capable of building products people choose. Ottawa has opened the door. The question now is who can afford to walk through.
