Consumer-Driven Banking Act (S.C. 2026, c. 3, s. 224)

Marginal note:Request to stop providing data

• The following provision is not in force.

  91 (1) A consumer may request that a participating entity stop providing their data, in whole or in part, to another participating entity.

• The following provision is not in force.

  Marginal note:Duties

  (2) If a consumer requests that a participating entity stop providing their data, the participating entity must immediately

  • The following provision is not in force.

    (a) stop providing the consumer’s data in accordance with the request;

  • The following provision is not in force.

    (b) inform the consumer that there might be consequences for stopping the provision of the data and that the consumer should contact the participating entity that was receiving the data; and

  • The following provision is not in force.

    (c) inform the participating entity that was receiving the data that it has stopped providing the data at the consumer’s request.

Marginal note:Authentication requirements

• The following provision is not in force.

  92 (1) Before providing a consumer’s data to another participating entity, a participating entity must confirm

  • The following provision is not in force.

    (a) the consumer’s authentication information;

  • The following provision is not in force.

    (b) the period for which the consumer’s express consent is valid; and

  • The following provision is not in force.

    (c) the products and services in respect of which the data is to be provided.

• The following provision is not in force.

  Marginal note:Prohibited conditions

  (2) A participating entity must not, as a condition of providing a consumer’s data to another participating entity,

  • The following provision is not in force.

    (a) require the consumer to consent to being provided with a product or service; or

  • The following provision is not in force.

    (b) require the consumer to consent to the participating entity receiving their data from the other participating entity.

Marginal note:Renewal of consent

93 In the circumstances and within the period provided for in the regulations, a participating entity that is providing a consumer’s data to another participating entity must request that the other participating entity renew the consumer’s express consent in accordance with section 87.

Marginal note:Display of sign

94 A participating entity must, in the form specified by the Bank, prominently display a sign indicating that it is a participating entity

• The following provision is not in force.

  (a) at each of the locations in Canada at which it offers services in accordance with this Act; and

• The following provision is not in force.

  (b) on the home page of each of its websites and on each application through which it offers services in accordance with this Act.

Marginal note:Information in consumer dashboard

95 A participating entity must, in a single location on its website or application,

• The following provision is not in force.

  (a) provide a consumer with up-to-date information about

  • (i) any other participating entities with which it is sharing the consumer’s data,

  • (ii) the period for which the consumer’s consent to the sharing of their data is valid, and

  • (iii) the data that is being shared;

• The following provision is not in force.

  (b) provide the consumer with the option to renew their consent, if applicable; and

• The following provision is not in force.

  (c) provide the consumer with the option to withdraw their consent or to request that their data stop being provided, as the case may be.

Marginal note:Clear, simple and not misleading

• The following provision is not in force.

  96 (1) A participating entity must provide consumers with information in a manner, and using language, that is clear, simple and not misleading.

• The following provision is not in force.

  Marginal note:Principles of accessibility

  (2) A participating entity must take principles of accessibility into account when providing consumers with information.

• The following provision is not in force.

  Marginal note:Policies and procedures

  (3) A participating entity must establish policies and procedures respecting the manner in which it provides consumers with information related to the activities that it performs under this Act.

• The following provision is not in force.

  Marginal note:Review and evaluation

  (4) The Bank must, from time to time, review and evaluate the policies and procedures referred to in subsection (3) to ensure that the participating entity is complying with this section.

Marginal note:False or misleading information

97 A participating entity must not provide false or misleading information to consumers or the public respecting the activities that it performs under this Act.

Marginal note:Notice of change

• The following provision is not in force.

  98 (1) A participating entity must notify the Bank of any change provided for in the regulations that relates to the participating entity or the activities that it performs under this Act.

• The following provision is not in force.

  Marginal note:Timing of notice

  (2) The notice must be given as soon as feasible after the participating entity becomes aware of the change but before the change takes effect. However, if a different period is provided for in the regulations, the notice must be given within that period.

• The following provision is not in force.

  Marginal note:Notice to Minister

  (3) The Bank must, as soon as feasible, notify the Minister and any designated person or government authority of any notice given under subsection (1).

Marginal note:Request for information

99 A participating entity must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act.

Marginal note:Annual reporting

100 Following the end of its financial year, a participating entity must, within the time and in the form and manner specified by the Bank, submit a report to the Bank that includes the information that is provided for in the regulations.

Marginal note:Policies and procedures — integrity or security

101 A participating entity must establish policies and procedures to protect itself against threats to its integrity or security, including foreign interference, and must adhere to those policies and procedures.

Marginal note:Duty to keep records

102 A participating entity must keep all records that are provided for in the regulations.

Marginal note:Consumer not liable

• The following provision is not in force.

  103 (1) Subject to the regulations, unless a consumer has demonstrated gross negligence or, in Quebec, gross fault, in safeguarding their authentication information, the consumer is not liable for any financial loss that arises directly from a loss of, unauthorized access to or unauthorized use of their data that occurs in relation to the sharing of data in accordance with this Act.

• The following provision is not in force.

  Marginal note:Report

  (2) If a consumer reports to a participating entity that their authentication information has been lost or stolen or is otherwise at risk of being used in an unauthorized manner, the consumer is not liable for any financial loss that is incurred, after the participating entity receives the report, as a result of the unauthorized use of their authentication information in relation to the sharing of data in accordance with this Act, unless the participating entity demonstrates, on a balance of probabilities, that the consumer contributed to the unauthorized use.

• The following provision is not in force.

  Marginal note:Authentication information

  (3) The unauthorized use of a consumer’s authentication information in relation to the sharing of data in accordance with this Act does not by itself establish that the consumer demonstrated gross negligence or, in Quebec, gross fault, in safeguarding their authentication information.

Marginal note:Responsibility for safeguarding data

• The following provision is not in force.

  104 (1) A participating entity is responsible for safeguarding consumer data that is within its control in the course of the sharing of data between participating entities in accordance with this Act.

• The following provision is not in force.

  Marginal note:Third-party service provider

  (2) Consumer data continues to be within the control of a participating entity even if the participating entity uses a third-party service provider or an affiliate entity to perform its activities under this Act.

• The following provision is not in force.

  Marginal note:Liability to consumer

  (3) A participating entity is liable to a consumer for any financial loss that arises directly from a loss of, unauthorized access to or unauthorized use of the consumer’s data that results from a breach of the participating entity’s security safeguards that occurs in the course of the sharing of data in accordance with this Act.

• The following provision is not in force.

  Marginal note:Third-party service provider

  (4) A participating entity remains liable to a consumer under subsection (3) even if it uses a third-party service provider or an affiliate entity to perform its activities under this Act.

Marginal note:Procedures for dealing with complaints

• The following provision is not in force.

  105 (1) A participating entity must

  • The following provision is not in force.

    (a) establish procedures that are satisfactory to the Bank for dealing with complaints;

  • The following provision is not in force.

    (b) designate one of its officers or employees in Canada to be responsible for implementing those procedures; and

  • The following provision is not in force.

    (c) designate one or more of its officers or employees in Canada to receive and deal with those complaints.

• The following provision is not in force.

  Marginal note:Misleading terms

  (2) A participating entity must not use any misleading term with respect to its procedures or designated officers or employees, including any term that suggests that the procedures, officers or employees are independent of the participating entity — such as the term “ombudsperson” or any other term with a similar meaning — or any term that is provided for in the regulations.

• The following provision is not in force.

  Marginal note:Copy to Bank

  (3) A participating entity must provide the Bank with a copy of its most recent procedures, within the time and in the manner specified by the Bank.

• The following provision is not in force.

  Marginal note:Information to complainant

  (4) A participating entity must provide a person who makes a complaint with

  • The following provision is not in force.

    (a) a written acknowledgment of the date on which it received the complaint;

  • The following provision is not in force.

    (b) the information referred to in paragraphs 111(a) to (c); and

  • The following provision is not in force.

    (c) any information that is necessary to enable the person to meet the requirements of the procedures referred to in paragraph 111(a).

Marginal note:Time for dealing with complaint

106 A participating entity must deal with a complaint within 56 days after the day on which it receives the complaint.

Marginal note:Duty to inform complainant

107 A participating entity must keep the person who made the complaint informed of the progress made in dealing with the complaint.

Marginal note:Record of complaint

108 A participating entity must, with respect to each complaint, make a record that is to be retained for at least five years and that contains

• The following provision is not in force.

  (a) in the case of a complaint made in writing, the original version of the complaint;

• The following provision is not in force.

  (b) in the case of a complaint made orally,

  • (i) the recording or a transcript of the recording, if the complaint was recorded, or

  • (ii) the details of the complaint, if the complaint was not recorded;

• The following provision is not in force.

  (c) the name of the person who made the complaint;

• The following provision is not in force.

  (d) the name of the consumer whose data the complaint relates to, if the consumer is not the person who made the complaint;

• The following provision is not in force.

  (e) the contact information provided by the person who made the complaint;

• The following provision is not in force.

  (f) the date on which the participating entity received the complaint;

• The following provision is not in force.

  (g) a description of the nature of the complaint;

• The following provision is not in force.

  (h) the date on which the complaint was resolved, if, in the participating entity’s opinion, it was resolved to the satisfaction of the person who made the complaint;

• The following provision is not in force.

  (i) a description of any actions that the participating entity took to attempt to resolve the complaint;

• The following provision is not in force.

  (j) a description of any compensation provided to the person who made the complaint or to the consumer referred to in paragraph (d);

• The following provision is not in force.

  (k) confirmation that the participating entity provided the person who made the complaint with the information referred to in paragraphs 111(a) to (c), if it did so; and

• The following provision is not in force.

  (l) any other information provided for in the regulations.