Bank of Canada accreditation consultation: reply by 8 Dec
The Bank of Canada has opened a consultation on its first draft supervisory guidelines for consumer-driven banking, and it wants to hear from the industry. The drafts set out what organizations will need to show to be accredited: one covers participating entities, and the other the third-party service providers that act on their behalf. The Bank describes them as the first in a series, so the views it hears now will help shape the guidance that follows. Comments are open until 8 December.
If your organization plans to take part in Canada's framework, or works with one that does, this is a good moment to be heard.
What the drafts cover
The drafts answer many of the practical questions prospective participants have been asking. They explain what counts as a place of business in Canada. They set out the national security review process and its timelines. They make clear that professional indemnity and cyber insurance are expected, and ask applicants to document how they've sized that cover against their own risks. And on security, they take a pragmatic line: applicants need confirmation from a qualified, independent third party, and can draw on recognized standards such as ISO 27001, SOC 2 and the NIST Cybersecurity Framework rather than starting from scratch.
The drafts also ask applicants to adopt an Integrity and Good Character Policy for the senior executives and board members responsible for consumer-driven banking. It's a thoughtful design. The policy must include regular reassessment, events that trigger a fresh look, such as a change in role, and a duty on individuals to report changes in their own circumstances. In other words, the Bank has built in the expectation that what was true at application may not stay true.
Questions worth raising
As application guidelines, the drafts focus, rightly, on the evidence an entity provides when it applies. With further guidance to come, there are a few thoughts respondents may want to put to the Bank:
How should evidence stay current once an entity is accredited? The security confirmation, for example, rests on an assessment completed in the 12 months before the application. The Integrity and Good Character Policy offers a model that could extend to the accredited entity itself: regular reassessment, trigger events and a duty to report change, covering its security posture, its ownership and affiliations, and the adequacy of its insurance as its activities grow.
Could continuous, independent evidence help? The Bank already recognizes evidence from established standards at application. Continuous, independent evidence could help show that an entity remains compliant over time, without adding to the burden on smaller participants.
How will participating entities keep a view of the providers acting for them? Third-party service providers can manage consent, handle authentication or provide and receive data on a participating entity's behalf, and their accreditation requirements are deliberately lighter. Respondents may want to ask how participating entities are expected to oversee those providers, and how changes in any participant's status will reach the parties relying on it.
How to respond
The Bank is asking whether any part of the drafts could be clarified, would be difficult to implement in practice, could discourage voluntary participation, or would benefit from more examples. Feedback goes by email, with “Consumer-driven banking draft supervisory guidelines related to accreditation consultation” in the subject line. The Bank asks respondents to identify themselves, to be as specific as possible, and to say which section of the draft each comment relates to. Full details, including the email address, are on the Bank's consultation page. The deadline is 8 December 2026.
The Bank has made a strong start and asked the industry to help shape what comes next. Helping participants keep a current view of the entities they rely on, in support of the framework the Bank is putting in place, is the infrastructure layer Invela is building.
Invela is the infrastructure layer that makes open finance trustworthy - assessing who's in the network, monitoring risk in real time, and ensuring liability lands in the right place.
