Open Banking Without a Scoreboard

The framework is operationally detailed, but competitively opaque

According to the memo, Canada’s new rules include several design choices associated with stronger open-banking regimes: mandatory participation by the largest banks, reciprocal access as a condition of entry, standardized data sharing without fees, and enforceable service levels. Administrative penalties can reach up to $10 million.

That is a meaningful infrastructure baseline. It reduces some of the usual gatekeeping risk around bank connectivity and data access. In embedded finance terms, it gives accredited participants a more predictable interface into customer-permissioned banking data.

But the criticism is narrower and more damaging: the framework does not require public reporting of competition metrics. It tracks security incidents, accreditation status, financial soundness and supervisory risk. It does not require recurring public disclosure of whether consumers are actually using open-banking services, whether regulated providers are gaining traction, or whether payment volumes are moving through the system.

This distinction matters. Compliance with access rules is not the same as competitive effect. A bank can meet service levels and still retain customers through pricing, inertia or product bundling. A fintech can obtain accreditation and still fail to convert consent into recurring usage. Without outcome data, procedural compliance and market change are hard to separate.

Canada borrowed the benefit case, not the measurement layer

The memo points to a specific asymmetry in Ottawa’s case for open banking. The regulatory impact analysis projects $13.2 billion in benefits over a decade. That estimate, according to the C.D. Howe Institute, is derived from Britain’s measured experience, adjusted for population, exchange rates and an assumed 27-percent participation rate.

Britain’s regime has a public measurement layer. Its open-banking body publishes monthly data, including active users, regulated providers and payment volumes. That does not make the British model automatically transferable, but it does make the benefit case auditable. The claimed effects can be compared with observed adoption.

Canada, by contrast, appears to have imported the results without requiring the same public scoreboard. The memo says the Act requires the Bank of Canada to publish consumer-driven banking information, but leaves the content to regulation. The regulations do not specify the competition data to be disclosed. The government’s position, as cited in the memo, is that specifying what must be published is not necessary for operationalizing the framework and may be considered later after further consultation.

That is a familiar regulatory pattern: the system is made supervisable before it is made assessable. Participating entities will file detailed annual reports on data-sharing performance, availability, security and financial metrics, but those reports flow confidentially to the Bank of Canada for risk-based supervision. The public market signal remains weak.

What fintechs and capital providers should actually watch

The practical implication is simple. Accreditation counts, but it should not be treated as evidence of market opening. For neobanks, payment firms and embedded-finance platforms, the relevant questions are more specific: are active users growing, are regulated providers gaining durable volume, and are consumers returning after the first consent event?

Those metrics are also material for capital allocation. A company can look well positioned under a new access regime while still facing poor conversion economics. For funds and operators working across private equity, venture capital and alternative investments, the absence of public adoption data raises diligence costs. Claims about open-banking-driven growth will need to be tested against proprietary customer and transaction evidence, not just regulatory eligibility.

The C.D. Howe Institute’s proposed fix is direct: require the Bank of Canada to publish, on a recurring basis, categories similar to Britain’s — active users, regulated providers and payment volumes. That would not guarantee competition. It would at least show whether the architecture is producing measurable usage.

Until then, Canada’s framework may be technically strong and still commercially unreadable. The liability is not in the API design alone. It is in the missing reconciliation between regulatory access and actual market movement.