Fintech and payments

Consumer-driven banking is almost here

The enactment of the Consumer-Driven Banking Act (the CDBA) earlier this year, and recent publication of the proposed regulations, mark the transition from policy to implementation. The framework, to be overseen by the Bank of Canada, will enable individuals and businesses to securely share their financial data. While a technical standards body has not yet been designated, enough detail is now available for fintechs and financial institutions to begin assessing the impact of the framework.

Participating entities

The list of mandatory participating entities has yet to be finalized, but it is expected to be limited to a small number of large banks. While the prohibition on screen scraping has been deferred, it is expected to come into force in the future, providing non-mandated entities with additional time to evaluate the benefits and costs of participation. Other financial institutions and fintechs will therefore need to determine whether becoming a participating entity aligns with their business objectives, or whether their current arrangements with institutions that become participating entities will require them to become accredited third-party service providers.

Parameters of participation

Financial institutions and fintechs will need to assess

• the extent to which their consumer data would fall within the “in-scope data” prescribed by regulations;
• their readiness to meet security and authentication requirements, including requirements relating to cybersecurity, protection of consumer data, consumer authentication and consent processes, risk management, and liability;
• their ability to satisfy prescribed service-level requirements and various reporting requirements; and
• operational implications of information systems, employees, consent processes, customer communications, and compliance management systems.

Although the CDBA has received Royal Assent, implementation will occur in phases, beginning with accreditation. The full suite of proposed Regulations is intended to be in force within one year of final publication.

Stablecoins, tokenized deposits, and the payments ecosystem

Stablecoins and tokenized deposits are poised to transform Canada’s payments ecosystem, promising faster, cheaper, and programmable payments. As Canada moves to implement these instruments, financial institutions and fintechs should understand their key regulatory, structural, and usage similarities and differences. See our recent bulletin for a comparison between stablecoins and tokenized deposits.

Regulatory differences

Stablecoins live “in the open” as fully reserve-backed digital assets that are subject to a developing, dedicated federal framework—namely, the Stablecoin Act (Canada) and the yet-to-be-released regulations thereunder. Although the Stablecoin Act received Royal Assent on March 26, 2026, its associated regulations and related stablecoin framework are expected to come into force in 2027. See our bulletin for a detailed overview of the Stablecoin Act.

Tokenized deposits, on the other hand, live inside the banking system as deposit liabilities of regulated financial institutions. The Office of the Superintendent of Financial Institutions (OSFI) recently affirmed its support for innovation and competition within Canada’s financial system, and urged financial institutions to engage with OSFI and seek legal advice before launching novel products or services¹. Notably, OSFI has confirmed its view that tokenized deposits are not legally distinct from traditional deposits.

Current developments

The Stablecoin Act, combined with developments in the United States, United Kingdom and European Union, is spurring a surge in institutional interest and regulatory discourse related to fiat-backed stablecoins, tokenized deposits, and tokenized (digital) assets. For example, a group of 21 firms (including Scotiabank, TD Bank, and international banks) announced the formation of a consortium to evaluate the launch of a stablecoin²; and Canada’s six largest banks (BMO, CIBC, TD Bank, NBC, RBC, and Scotiabank) recently announced an initiative to jointly explore tokenized deposit solutions³.

Looking ahead

Stablecoins and tokenized deposits use similar technology stacks that support automation via smart contracts and AI-driven agentic use, enabling instant, low-cost settlement among participants on networks/platforms, which financial institutions and fintech solutions providers will seek to provide to their customers.

These developments are part of a global convergence toward “cash-on-chain” frameworks seen in the European Union, United Kingdom and United States. Canadian fintechs and financial institutions may want to assess how their technology, partnerships, reserve structures, disclosure practices, and settlement mechanics align with these emerging international norms. More broadly, the recent developments signal that digital asset regulation in Canada is entering a more integrated phase, linking banking, payments, securities, and national security considerations.

Retail Payment Activities Act

September 8, 2026, marks the first anniversary of the coming into force of the substantive requirements under the Retail Payment Activities Act (RPAA). With the implementation phase largely behind it, the Bank of Canada has increasingly shifted its focus to supervision and enforcement.

Over the past year, the Bank has continued to remind payment service providers (PSPs) of their ongoing compliance obligations, including requirements to report material incidents, significant changes to their operations or safeguarding-of-funds arrangements, changes to registration information, and certain changes in control that may trigger a requirement to re-register.

One of the more interesting developments has been the Bank’s approach to enforcement. As of September 1, the Bank had published nine notices of violation against PSPs that failed to register as required under the RPAA. While these notices demonstrate the Bank’s willingness to pursue non-compliance, no administrative monetary penalties (AMPs) were imposed. In each case, the PSP mitigated potential harm by submitting a registration application, resulting in a penalty of $0. This approach suggests that, at least for now, the Bank is focused on encouraging compliance rather than imposing punitive sanctions.

The Bank has, however, shown that it is prepared to take stronger action where consumer protection concerns arise. A notable example is XTM Inc. Following concerns that the company had failed to adequately safeguard end-user funds, and that its continued operations could be prejudicial to the public interest, the Bank issued a temporary order on February 17, 2026, requiring XTM to immediately cease performing retail payment activities. Ten days later, the Bank issued a revised order permitting XTM to resume operations under the supervision of a monitor appointed by the Ontario Superior Court of Justice.

Together, these developments provide an early indication of how the Bank intends to exercise its supervisory and enforcement powers under Canada's new retail payments regime.

Regulatory impacts of partnerships

When considering regulatory implications, organizations typically focus on the legislation that directly applies to their activities or, in the case of regulated entities, their governing statutory framework. As highlighted in this article, fintechs are becoming subject to an increasing number of legislative and regulatory regimes, depending on the nature of their activities, including the Retail Payment Activities Act, the Consumer-Driven Banking Act, and forthcoming stablecoin-related legislation.

However, a fintech’s regulatory obligations are not determined solely by the activities it undertakes, but can also arise from the organizations with which it chooses to partner. These partnership-driven requirements can have significant operational and commercial implications. In the financial services sector, fintechs should be aware of the regulatory obligations flowing from the following three frameworks:

• OSFI’s Guideline B-10: Third-Party Risk Management
  Fintechs who regularly partner with federally regulated financial institutions (FIs) are familiar with Guideline B-10, which sets out OSFI’s expectations as to how FIs will manage third-party risk. B-10 requires FIs to take a risk-based approach to managing third-party arrangements, and provides a list of contractual provisions that FIs should include in high-risk and high-criticality third-party arrangements, and should otherwise consider including, depending on the risk and criticality of the arrangement. Among other things, the list touches on pricing, performance measures, use of subcontractors, security of data, incident and material adverse event notification, dispute resolution, business continuity, and default and termination rights. However, the list is non-exhaustive, and fintechs who partner with an FI and who represent a material enough risk to the FI in the event of service disruption or failure for any reason can expect to negotiate extensive legal terms and conditions with the FI.
• Bank Act consumer protection framework
  Fintechs that partner with banks—whether to distribute a bank product or service, or to enable a bank to offer a fintech product or service—must carefully consider the application of the Bank Act’s consumer protection framework. For example, the Bank Act provides that where a third party, such as a fintech, sells or furthers the sale of a bank product or service, the bank must ensure that the third party complies with the applicable consumer protection requirements as though it were the bank itself.
  Banks are expected to oversee the activities of third parties that interact with customers on their behalf, leading banks to impose contractual obligations on fintech partners that require them to adhere to specific Bank Act consumer protection standards, policies, and procedures. These obligations may include requirements relating to disclosures, complaints handling, sales practices, employee training, monitoring, reporting, and audit rights.
• Consumer-Driven Banking Act
  Although the scenarios discussed above generally result in fintechs being required, through contractual arrangements, to comply with regulatory requirements that apply to their partners, the Consumer-Driven Banking Act (CDBA) goes a step further, expressly imposing obligations on certain fintechs that perform key functions on behalf of participating entities.
  Specifically, fintechs that obtain or manage consumer consent, handle authentication information, or otherwise receive, provide, or facilitate access to consumer data on behalf of a participating entity, will be required to become accredited under the CDBA, and themselves be subject to the statutory framework. This means that such fintechs may face direct regulatory obligations, oversight, and potential enforcement consequences, rather than merely being required to comply with contractual requirements imposed by a regulated partner.
  In addition, fintechs providing these services should expect participating entities to seek robust contractual protections. These may include requirements relating to compliance, information security, audit rights, reporting, incident management, data governance, and ongoing accreditation status.

Fintechs entering into partnerships with financial institutions should not limit their regulatory analysis to legislation that directly applies to their own activities. They should also consider the regulatory expectations that may flow indirectly from their banking partners, as these requirements can significantly influence both the structure and operation of the relationship.

What’s new at Payments Canada

Payments Canada, which is responsible for Canada’s clearing and settlement infrastructure, cleared on average $411 billion of transactions daily in 2025. As part of the modernization project for the clearing and settlement systems, the work on Canada’s Real-Time-Rail (RTR) has continued in 2026. The RTR, once launched, will allow Canadians to send and payments in real time on a 24/7/365 basis, and allow for real-time settlement of these payments between participating Payments Canada members. C.D. Howe Institute estimates that the RTR will generate up to $14.5 billion in cost savings and $16 billion in economic gains over the next decade, with total economic gains growing to $27 billion as additional capabilities and use cases are introduced.  

Learning from other jurisdictions, Canada has sequenced the rollout of the RTR starting in Q4 of 2026 through Q3 of 2027. The RTR will significantly improve access to cash flow for Canadian consumers and businesses, as RTR transactions will be processed on a 24/7/365 basis. In addition, as the RTR has been developed using the ISO 20022 financial messaging standard, the payment messages that are generated will be considered to be “data-rich”, and will allow users to send and receive payments accompanied by information that will allow for greater automation, and will streamline accounting and reconciliation processes. Also, RTR payments will be final and irrevocable (except in the circumstances specified in the RTR Rules), providing greater confidence to the sender and receiver in the finality of the underlying transaction.

The RTR will also be one of the few real-time payment exchange, clearing and settlement systems that will have launched with centralized fraud mitigation requirements, which will include (i) verification of the recipient’s name against their account number before payment messages are sent; (ii) generation of risk scores to detect patterns of fraudulent behaviours; and (iii) a shared database of suspected or confirmed fraud indicators. All of these measures are designed to reduce the prevalence of fraud and ensure more secure access to funds.

Amendments were made to the Canadian Payments Act in 2025, which expanded the eligibility for membership with Payments Canada to include payment service providers (PSPs) registered under the Retail Payment Activities Act, and local credit unions and clearing houses designated under the Payment Clearing and Settlement Act. Since such amendments came into force, more than 20 new members have been accepted. Once the RTR goes live, and when the onboarding of initial RTR participants is complete, a greater percentage of Canadians will have access to the benefits it affords.