The Consumer-Driven Banking Act received Royal Assent on March 26, 2026, giving Canadians a statutory right to direct their financial data to approved third parties. That sounds tidy on paper. In practice, though, large portions of the law are still marked "not in force," and the regulations that will actually operationalize it won't be finalized for up to a year.
What the Law Actually Changes
For financial institutions, fintechs, and the credit unions now expected to participate, the CDBA sets hard boundaries around consent. Section 85 requires express, active permission before any entity can pull a consumer's data from another - simply using an app or signing up for a service does not count. Section 86 caps that consent at 12 months, forcing renewal cycles that didn't exist before. Section 95 goes further, requiring every participating entity to maintain a consumer-facing dashboard showing who holds the data, what's shared, and for how long, with the ability to withdraw consent on the spot.
That's a meaningful build for compliance and product teams alike. Dashboards, renewal triggers, and deletion workflows under section 90 aren't small features bolted onto an existing stack - they're structural requirements that touch onboarding, data architecture, and customer service all at once.
Liability Shifts Toward the Institution
Here's the part that should get attention in risk departments: under section 103(1), consumers are not financially liable for losses tied to unauthorized access or use of their data, unless gross negligence is proven. In Quebec, the bar is gross fault, and a single lapse doesn't automatically clear it. Once a consumer reports stolen credentials, section 103(2) shifts the burden further - the entity must prove, on a balance of probabilities, that the consumer contributed to the misuse.
Sections 104(1) and 104(4) close the loop: the participating entity remains responsible for consumer data even when a third-party service provider is doing the actual processing. Outsourcing the technical work does not outsource the liability. For any institution relying on vendors for data-sharing infrastructure, that's a contract-review moment, not a footnote.
Breach Reporting and the Compliance Calendar
Section 82 requires entities to report breaches to the Bank of Canada as soon as they become aware of them, and to notify affected consumers directly when there's real risk of significant harm. The statute defines that harm broadly - financial loss, identity theft, humiliation, damage to reputation, job loss, and credit record impacts all qualify under section 82(7). That's a wide net, and it means breach-response playbooks built around narrower definitions of harm will need revisiting.
The Office of the Privacy Commissioner has already flagged a weakness worth watching: in its September 2026 submission to Finance Canada, it warned that the draft regulations' prescribed list of security safeguards may not keep pace with changing technology risks. A fixed list written today can age poorly against threats that haven't been invented yet.
A Separate Track: Fraud Prevention Rules
Running alongside the CDBA is a second regulatory thread - fraud prevention rules under Bill C-15, pre-published July 2, 2026, as the opening piece of Canada's first National Anti-Fraud Strategy. Banks will need explicit consumer consent before activating electronic funds transfer capabilities, must let consumers disable those capabilities themselves, and will face set timelines for processing transaction-limit changes. Fraud cases get reported to the Financial Consumer Agency of Canada, which will compile an annual public report for the finance minister.
The scale of the problem explains the urgency: the Canadian Anti-Fraud Centre reports over $704 million lost to fraud in a single year, with losses since 2022 topping $2.4 billion - and only 5 to 10 percent of scams ever get formally reported. That underreporting gap is itself a data problem the CDBA's dashboards and consent trails may eventually help close.
- Data sharing must be free - section 77 bars charges for sharing, collecting, or cancelling consent
- Proposed regulations require 99.5 percent monthly uptime for data-sharing endpoints
- Final CDB Regulations expected within one year of the June 27, 2026 Gazette publication
- Cash transaction thresholds and anti-money-laundering reporting remain outside the CDBA's scope entirely
Fair enough to call this a milestone. It isn't a finished system. Institutions building toward compliance are working against draft regulations still open to comment, with a privacy regulator already pushing back on parts of the framework. The smart move for anyone in scope is to treat the current text as a floor, not a ceiling, and build consent, breach-reporting, and liability processes with enough flexibility to absorb whatever the final rules demand.