New draft guidelines set out accreditation pathways and security requirements for banks, FinTechs and third-party providers.
On November 2, 2026, the Bank of Canada launched a consultation on its first draft supervisory guidelines for consumer driven banking. Under the Consumer Driven Banking Act, the Bank will supervise participants and establish expectations around governance, risk management and operational resilience. The consultation focuses specifically on accreditation, setting out the information and evidence prospective participants would need to provide for the Bank to assess whether they meet the requirements to enter the framework. Comments are open until December 8, 2026.
The consultation covers two draft guidelines: Participating entity accreditation application requirements and Third party service provider accreditation application requirements. Both are draft supervisory guidance rather than legislation or regulations. They are also the first in a planned series of Bank of Canada guidelines, with consultations on additional supervisory areas expected as the framework develops.
Participating Entity Accreditation:
The participating entity guideline establishes three accreditation pathways, reflecting the applicant’s existing regulatory status.
Standard Accreditation: This pathway generally applies to corporations, trusts, partnerships, funds and other eligible organizations that are neither regulated financial institutions nor registered payment service providers.
Registered Payment Service Providers: Payment service providers registered under the Retail Payment Activities Act can use a streamlined accreditation process that recognizes their existing regulatory status.
Federal and Provincial Financial Institutions: Banks, authorized foreign banks, trust and loan companies, cooperative credit associations, credit unions, caisses populaires, insurance companies and certain provincial Crown corporations can apply through a separate streamlined pathway.
Across the pathways, applicants would provide information covering their legal identity, business location, governance, organizational structure, regulatory status, responsible individuals, consumer driven banking activities and national security matters. Depending on the pathway, the Bank would also assess evidence relating to security safeguards, technical standards, insurance or guarantees, complaints arrangements and other accreditation requirements.
Place of Business in Canada
Applicants using the standard pathway and registered payment service providers would need to demonstrate a place of business in Canada. The Bank states that this could include a physical location such as a home office, Canadian incorporation, or employees, agents or mandataries located in Canada.
Security Safeguards:
Standard applicants and registered payment service providers would need confirmation from a sufficiently skilled and independent party that the required security safeguards have been implemented. The underlying assessment should have been completed within the 12 months before the application.
Evidence could include assessments against the regulatory safeguards or relevant cyber security frameworks such as ISO 27001, System and Organization Controls reports and the NIST Cybersecurity Framework, where they provide sufficient evidence of compliance.
Federal and provincial financial institutions would follow a different approach. They would provide a declaration confirming compliance with the required security safeguards, made by the senior officer or employee responsible for those safeguards and dated no more than 90 days before the application.
Technical Standard:
Applicants would need to provide evidence that they comply with the technical standard designated under the Consumer Driven Banking Act. The draft states that, when it was prepared, the Minister of Finance had not yet designated a Technical Standards Body. The Bank therefore plans to provide further supervisory guidance on technical compliance after a body has been designated.
Insurance and Guarantees:
Standard applicants and registered payment service providers would need insurance or comparable guarantees sufficient to cover risks arising from their management of consumer data. The Bank expects professional indemnity insurance and cyber insurance, or guarantees offering equivalent protection. Coverage should reflect factors such as the sensitivity and volume of data, the scale and complexity of activities and the potential financial impact of privacy, cyber security or operational incidents. Applicants would document how they determine appropriate coverage and provide evidence supporting its sufficiency.
Integrity and Good Character:
Standard applicants and registered payment service providers would establish an Integrity and Good Character Policy for individuals with significant responsibility for consumer driven banking activities. The policy would cover assessment and regular reassessment, circumstances that trigger a new assessment and records of decisions. Relevant individuals generally include senior executives, board members and designated individuals responsible for security safeguards and complaints. The assessment would consider factors including criminal history, professional disciplinary history, regulatory or government investigations, and insolvency or bankruptcy history.
Third-Party Service Provider Accreditation:
The second guideline addresses service providers that perform prescribed activities for participating entities. Accreditation would be required where an external provider performs one or more of three functions:
Obtaining or managing consumer consent
Confirming authentication information or managing consumer authentication
Providing or receiving consumer data
This applies to a service provider operating under contract that is separate from the participating entity’s employees, agents or mandataries.
Applicants would provide information on their legal identity, business location, governance, organizational structure, regulatory oversight, planned consumer driven banking activities, arrangements with participating entities and national security matters. They would also need a place of business in Canada.
For an organizational applicant, the Bank would require an Integrity and Good Character Policy covering individuals with significant responsibility. The policy would establish documented assessment and reassessment procedures, reporting of relevant changes in circumstances, record keeping and senior management approval. Individual applicants would instead provide an attestation of good character supported by evidence.
National Security Review and Accreditation Decision
Once the Bank receives a complete accreditation application, a copy would be provided to the Minister of Finance. The Minister would have 60 days to determine whether a national security review is required, with further 60 day extensions available where necessary.
If a review begins, it must generally be completed within 180 days, although additional 180 day extensions are permitted. An applicant asked for further information during the review would have 30 days to provide it. The Bank cannot grant accreditation while the Minister’s national security decision or review remains outstanding.
Submission of an application does not itself result in accreditation. The Bank would assess whether the applicant meets the applicable requirements before approving or refusing the application. An applicant refused accreditation can request a review within 30 days, with the Bank’s delegated decision maker given 120 days to either grant accreditation or confirm the refusal.
What the Bank Is Consulting On
The Bank is asking stakeholders whether elements of the draft guidelines require greater clarification, could be difficult to implement, could discourage voluntary participation, or would benefit from additional examples or supporting information. Feedback is due by December 8, 2026. The Bank may seek further information from respondents and may publish an anonymized summary of consultation feedback.
🚨 What This Signals for the Canadian Financial Sector
The November drafts provide the first detailed view of how the Bank of Canada proposes to assess whether applicants are ready to participate in consumer driven banking. Accreditation is expected to involve documented evidence across governance, security, technical compliance, insurance, organizational structure and senior personnel rather than relying solely on an application form.
The proposed pathways also show how existing regulatory status would influence the accreditation process. Registered payment service providers and regulated financial institutions receive streamlined pathways, while other eligible organizations follow the standard process. Financial institutions would be able to rely on a security declaration from the designated responsible officer, while standard applicants and registered payment service providers would require independent confirmation of their security safeguards.
The separate guideline for third party service providers also places providers performing consent, authentication or data sharing functions within the accreditation framework. This creates a defined supervisory route for external providers carrying out core consumer driven banking activities on behalf of participating entities.
Some implementation details remain under development. The Technical Standards Body had not yet been designated when the drafts were prepared, further guidance on technical compliance is planned, and the Bank states that additional supervisory guidelines will follow. The November consultation therefore provides clearer accreditation expectations while confirming that the broader supervisory framework is still being developed.
