Canada's open banking era is legally underway. Bill C-15, the Budget 2025 Implementation Act, received Royal Assent on March 26, 2026, replacing the original Consumer-Driven Banking Act with a comprehensive new framework.
After years of consultations, two prorogations of Parliament, and more advisory committee reports than most lenders can count, consumer-driven banking in Canada has crossed from policy into law.
However, there is a meaningful gap between the law and what’s live, and that gap is where most of the current confusion lies. As of March 2026, the Bank of Canada had not committed to a launch date and was still in the information-gathering phase, with a 2026 launch widely seen as at risk.
For lenders trying to build a strategy around this framework, the honest answer to the question "what can we do now?" is not a clean one. Some things are available today, while others won't be available until 2027 at the earliest. And one critical use case — serving African newcomers with cross-border financial data — does not depend on either phase going live and is available right now. This article draws those lines clearly.
Let’s explore how.
What Phase 1 Is and What It Is Not
Phase 1 of the consumer-driven banking framework focuses on read access: accredited providers will be able to access data from deposit, investment, credit, and payment accounts with the customer's explicit consent. The customer controls what data is shared, with whom, and for how long, and can revoke that access at any time.
That is the definition, but what it means in practice for a lender is more specific. Phase 1 provides accredited third parties with a secure, standardized API channel to retrieve a customer's existing financial data without requiring the customer to hand over their banking credentials.
It replaces the screen scraping workaround that millions of Canadians currently use, a process that requires users to provide their confidential banking credentials to third parties, exposing them to significant security and privacy risks.
Specifically for underwriting, Phase 1 means that a lender who wants to assess a borrower's cash flow can do so via a consented, compliant API connection rather than a scraped credential. The data that lenders have been using to supplement bureau checks for thin-file borrowers becomes accessible through a governed, liability-clear channel rather than a legal grey zone.
Furthermore, the CDBA expressly excludes derived data — data about a consumer product or service that has been enhanced by a participating entity to significantly increase its usefulness or commercial value.
This matters for lenders building models on top of raw transaction data, which is in scope. Any enriched output a vendor produces from that data, such as a proprietary score, a behavior classification, or a risk attribute, is not a CDBA data asset, and the rules around its use sit outside the framework.
What Phase 1 does not include is anything active. No payment initiation, account switching, or ability to take action on a customer's account through a third-party application. Those capabilities belong to Phase 2.
What Phase 2 Adds and Why It Depends on Infrastructure that Isn't Built Yet
The second phase, targeted for mid-2027, will introduce write access, allowing consumers to initiate payments, switch accounts, and take other actions through participating entities once Canada's Real-Time Rail project is live and in widespread use.
The Real-Time Rail is Canada's new instant payment infrastructure, managed by Payments Canada, enabling 24/7 transfers with settlement in seconds, in line with the ISO 20022 standard. Its launch is planned for Q4 2026 and is a necessary condition for Phase 2 of open banking.
For lenders, Phase 2 is where the commercial landscape changes most significantly. Write access means a customer can switch their primary banking relationship, initiate loan repayments, fund accounts, and manage financial products across institutions through a permissioned API rather than manual processes.
The friction that currently protects incumbent lenders from customer churn declines materially when account switching is a single, consented action. The primary risk for established financial institutions is the erosion of the customer relationship. Open banking effectively lowers these switching costs.
This means that a fintech that can offer a more competitive mortgage or a higher-yield savings product will not need to wait for a customer to manually close accounts and reopen them elsewhere. It will simply pull the data, make the offer, and execute the switch.
The dependence on the Real-Time Rail is significant and not a mere formality. The RTR has been in development for years, and its Q4 2026 target reflects an optimistic reading of where Payments Canada's build program lies.
Phase 2 going live in mid-2027 assumes both the RTR launches on schedule and the regulatory framework for write access is in place and tested. Lenders who are building Phase 2 strategies on that timeline should hold it as a planning assumption, not a commitment.
What Lenders Can Do Right Now, With or Without Phase 1
The practical question for most lenders is not philosophical but operational. Given that Phase 1 has no confirmed launch date and Phase 2 is at least 12 months behind it, what can a lender actually build today?
The answer has two parts.
The first part is preparation that pays off regardless of timing. Most banks need 18 to 24 months to reach Phase 1 readiness, meaning meaningful planning and investment must begin now.
The accreditation process under the CDBA requires demonstrating compliance with technical and security standards, maintaining a public registry, and building the consent management architecture mandated by the framework.
Regulations will address accreditation criteria and requirements, security safeguards, consumer liability protections, consent and data-sharing procedures, complaint handling and reporting obligations, administrative penalties for non-compliance, and technical standards.
This means that lenders who have not yet started mapping their data flows, designing consent dashboards, and assessing their API infrastructure are already behind the timeline required for a confident Phase 1 launch.
The second part is where the newcomer lending use case becomes directly relevant because the data that matters most for underwriting African newcomers does not come from Phase 1 at all.
The Gap Phase 1 Does not Close, and What Does
Phase 1 of consumer-driven banking gives lenders access to a customer's Canadian financial data, including transaction history from their Canadian bank account, balances, and payment patterns. For a borrower who has been in Canada for two or more years and has built up meaningful account history, this is genuinely useful underwriting data.
On the other hand, for a newcomer who arrived six months ago and opened their first Canadian account upon arrival, Phase 1 provides the lender with 180 days of transaction data. This is not enough to establish the income stability, expense consistency, and repayment behavior that give cash flow underwriting its predictive power.
The open banking framework, when it goes live, will improve the underwriting picture for established Canadian residents. It will not solve the structural data gap for African newcomers, whose most valuable financial histories are in their home country, outside the reach of any Canadian API framework.
This is the distinction that matters most for lenders with newcomer portfolios or newcomer growth ambitions. The framework may open new avenues for developing innovative, data-driven products and services, such as budgeting apps, alternative credit-scoring models, and personalized financial advice platforms. However, those models are only as good as the data they run on.
For African newcomers, building an alternative credit model on Canadian transaction data alone is working with a dataset that starts at zero on arrival and takes months to become meaningful.
The data that changes the underwriting picture for this population is cross-border: bureau records from Nigerian CRC and FirstCentral, Kenyan Metropol, Ghanaian XDS, and equivalent sources across other African countries, normalized into Canadian underwriting formats.
Verified at the identity layer before the credit query goes out. Available today, through an API that does not depend on Phase 1 going live or Phase 2 being built.
How Zeeh Fits into The Open Banking Picture
Zeeh's Insight feature is the cash flow and open banking layer built specifically for African newcomer underwriting, designed to work alongside the Canadian CDBA framework rather than waiting for it.
For newcomers who have been in Canada long enough to have a meaningful transaction history, Insights connects to their Canadian banking data via consented open banking connections, generating income stability signals, expense pattern analyses, and account liquidity profiles that supplement the foreign bureau data retrievals.
The consent architecture is designed to meet both Canadian CDBA requirements and the data protection frameworks of the source countries where the foreign data originates, because a cross-border data product that is compliant only on one side of the transfer is not a complete compliance solution.
Furthermore, ZeehID verifies the identity layer first — African identity documents — against primary government and bureau databases, with biometric checks and sanctions screening embedded in the same pipeline. Lastly, Credit History then retrieves and normalizes the bureau data, while the Insights feature adds the real-time cash flow signal.
The result is a complete underwriting picture that a lender can act on through a single API integration, available right now, not contingent on a Phase 1 launch date that the Bank of Canada has declined to commit to.
Bottom Line
Canada's consumer-driven banking framework is one of the most significant structural changes to the country's financial data infrastructure in a generation. Approximately 1,500 payment companies already operate under Bank of Canada supervision through the Retail Payment Activities Act.
The expectation is that fintechs and financial institutions will be able to go through a single national review process to access both the open banking and real-time payments environments. Furthermore, the framework will reshape how lenders access consumer data, how customers move between institutions, and how third-party data products are regulated and accredited.
However, it will not do all of this at once. Phase 1, when it launches, gives lenders read access to Canadian financial data through governed API channels. Phase 2, in 2027, adds the ability to initiate action.
The cross-border data problem — the one that most directly affects thousands of African newcomers arriving in Canada annually — is outside both phases and requires infrastructure built specifically for that gap.
Lenders who understand this distinction will build their open banking strategy on two parallel tracks: preparing for Phase 1 compliance and accreditation on the domestic data side, while deploying cross-border credit infrastructure on the newcomer side now, rather than waiting for a framework that does not cover the data they need.
The law is in place, and the regulations are coming. While the launch date is unknown, what a lender can do today is build, and, for African newcomer underwriting, the infrastructure to do that is already live.
Zeeh provides financial institutions with verified identities, cross-border credit histories, and cash flow analyses for African newcomers through a single API. Our product stack, ZeehID, Credit History, and Insights, works together to give lenders the complete underwriting picture, regardless of where Canada's open banking Phase 1 timeline lands.
Book a demo with our sales team to explore them.
