Canada is moving toward a consumer-driven banking framework, often called open banking, that could change how borrowers share financial information when applying for, renewing, or refinancing a mortgage.

The proposed Consumer-Driven Banking Regulations are not yet in force. As of September 14, 2026, the consultation period has closed, but final regulations have not been published. The proposal nevertheless provides a useful indication of how mortgage applications may change.

The basic concept is simple. Consumers could direct participating financial institutions to securely share certain financial information with other accredited participants through standardized digital connections. This could reduce the need for screen scraping, emailed bank statements, and repeated document uploads.

For borrowers, the system may make it easier to compare mortgage options and provide financial information to a lender. For brokers, it may change lender portals, application workflows, data-handling practices, and technology relationships. It will not create a right to mortgage approval or replace existing underwriting, privacy, fraud-prevention, or anti-money-laundering obligations.

What Is Consumer-Driven Banking?

Under the proposed framework, a consumer, including an individual or business, could expressly authorize one participating entity to share prescribed financial data with another.

The proposed data scope includes mortgages and other loans. Depending on the final rules and the products involved, shareable data may include:

• identity and profile information;
• account and mortgage identifiers;
• loan terms, interest rates, fees, and authorizations;
• current and historical balances;
• completed, pending, and pre-authorized transactions; and
• product-offering information.

The model is intended to use secure application programming interfaces, commonly called APIs. An API is a controlled digital connection between systems. The policy objective is to reduce reliance on screen scraping, where consumers provide a third party with online-banking credentials so it can access account information.

The first phase would be read-only. It would allow authorized access to information, but would not permit a third party to move money, alter an account, open or close a mortgage, or change information held by a financial institution.

What It Could Mean for Mortgage Borrowers

The main benefit for borrowers may be greater control over their financial information.

Instead of downloading months of statements, redacting documents, and sending them to several parties, a borrower could authorize a participating lender or service provider to obtain relevant information directly from the borrower’s financial institution.

This may be particularly useful for borrowers who:

• are refinancing or switching lenders;
• maintain accounts with more than one institution;
• have income from several sources;
• are self-employed or operate a small business;
• have a limited conventional credit history but a consistent record of rent, savings, or repayment activity; or
• want to compare mortgage products more efficiently.

A borrower could authorize sharing for a limited period, withdraw consent, and in specified circumstances request deletion of shared information. Under the proposal, consent would need to be express, clear, and limited to the information and purpose identified. Consent could not remain valid for more than 12 months without renewal.

Participants could not charge a borrower simply for sharing data, giving or renewing consent, or withdrawing consent.

It Will Not Create a Right to Mortgage Approval

Consumer-driven banking may make financial information easier to collect and verify. It does not change a lender’s right to decide whether to approve a mortgage.

Lenders will continue to apply their own underwriting standards, including income verification, debt-service analysis, down-payment review, credit assessment, property valuation, and fraud controls. Federally regulated lenders will remain subject to OSFI’s residential mortgage underwriting expectations.

Better access to bank-account data may make an application more complete or efficient, but it will not eliminate qualification requirements, stress testing, due diligence, or lender discretion.

The most immediate use may be refinancing. A borrower seeking to switch lenders may be able to share current account and mortgage information more quickly with a prospective lender. The borrower will still need to qualify, and the new lender will still need to complete its own underwriting.

Borrowers Should Be Careful About Consent

The proposed rules are intended to improve consumer control, but borrowers should still read consent language carefully.

Before authorizing data sharing, borrowers should understand:

• which organization is requesting their data;
• what information will be shared;
• why it is being requested;
• how long the consent will remain active;
• whether the organization is an accredited participant;
• whether the data will be shared with a broker, lender, technology provider, or another service provider;
• how to withdraw consent; and
• how the organization will store, use, and protect the information.

The framework is not yet operational. Borrowers should not assume that a current request for online-banking credentials is part of Canada’s consumer-driven banking system. Until the regulations take effect and accredited participants are operating within the framework, consumers should be cautious about providing online-banking login credentials to third-party platforms.

What It Could Mean for Mortgage Brokers

Mortgage brokers and brokerages will likely be affected first through lender processes rather than direct regulation.

A brokerage that advises a borrower, collects an application, and submits it to a participating lender would not automatically become a participant in the consumer-driven banking framework. Direct obligations would generally arise only if the brokerage:

1. becomes an accredited participating entity that receives or provides consumer data for its own consumer-driven banking service; or
2. performs consent, authentication, or data-transfer functions for a participating entity as an accredited third-party service provider.

Even without accreditation, brokers should expect participating lenders to update their application portals, consent processes, and data-submission requirements. A broker may increasingly provide a borrower with a lender link for secure authentication instead of collecting and uploading bank statements manually.

Brokerages should begin planning for:

• confirming the source and authorized use of borrower financial data;
• handling a borrower’s withdrawal of consent during an application;
• updating privacy notices and internal data-handling practices;
• reviewing technology vendors and data-security controls;
• clarifying responsibility in contracts with lenders and aggregators;
• maintaining provincial mortgage-client files; and
• keeping consumer-driven banking records distinct from FINTRAC compliance records.

Open Banking Does Not Replace Existing Broker Duties

A borrower’s consent to share financial data is not a substitute for a broker’s professional obligations.

In Ontario, licensing, suitability, disclosure, supervision, conduct, privacy, and recordkeeping obligations will continue to apply to brokerages, brokers, and agents. Consumer-driven banking is a federal framework for sharing prescribed financial data. It does not regulate the underlying mortgage transaction or replace provincial mortgage regulation.

It also does not replace AML obligations. A broker, lender, or administrator that is a FINTRAC reporting entity must maintain its own compliance program, client-identification processes, records, and reporting controls. Data received through a consumer-driven banking channel may assist with a file, but it does not allow a mortgage professional to treat another entity’s AML program as its own.

Which Lenders Will Participate?

Not every mortgage lender will be required to participate.

The proposed framework would apply differently depending on the institution:

• Certain Schedule I banks may eventually be required to participate once named by ministerial order.
• Other banks and federal trust and loan companies may be able to seek accreditation.
• Provincial credit unions and caisses may be able to opt in through accreditation.
• Mortgage investment corporations, private lenders, fintech lenders, and mortgage brokerages are not automatically included simply because they lend or arrange mortgages.

For a private lender, MIC, or brokerage, participation would require a business case for investment in API technology, cybersecurity, insurance or financial guarantees, recordkeeping, reporting, and supervisory compliance.

The early practical benefits may therefore be concentrated among borrowers dealing with larger banks and other participating institutions. Borrowers whose accounts, lenders, or brokers are outside the framework may continue to use ordinary document-based processes.

A Gradual Rollout Is Likely

Mortgage-account data is not expected to be the first category available. The proposal contemplates a phased approach, beginning with accreditation and deposit and payment accounts before expanding to lending accounts, registered accounts, and investment accounts.

Important details remain unresolved, including:

• which banks will be required to participate;
• when mortgage data must be made available;
• the final technical standards;
• the registry and counterparty-verification process;
• the boundary between shareable raw data and proprietary derived data, such as internal lender risk ratings or credit scores; and
• the final cost-recovery and supervisory arrangements.

The Government has indicated that it intends the framework to come into force within one year after final publication. The timing remains uncertain until the final regulations are released.

The Practical Takeaway

For borrowers, consumer-driven banking could mean less paperwork, easier comparison shopping, and faster sharing of financial information, particularly for refinancing and lender switching. It may help some borrowers present a more complete financial picture, but it will not guarantee access to credit or eliminate lender underwriting requirements.

For brokers, the framework is likely to change how financial information is collected, received, verified, stored, and sent to lenders. Brokerages should monitor the final regulations and begin reviewing their privacy, cybersecurity, vendor-management, lender-contract, and application-workflow practices.

The proposed framework may make mortgage applications more efficient and secure. Its success will depend on whether the final rules give borrowers meaningful control while providing brokers and lenders with practical processes and maintaining strong safeguards for privacy, fraud prevention, and financial-system integrity.