On January 31, 2020, the Advisory Committee on Open Banking (the Committee) released its report Consumer-directed finance: the future of financial services (the Report). The Report contains findings and recommendations developed based on public consultations that followed the release of the consultation paper, A Review into the Merits of Open Banking. Key elements of the consultation paper were summarized in a previous Financial Services bulletin, "Government Launches Review into Open Banking".
The three questions initially posed to the Committee were the following:
- Can open banking provide meaningful benefits for Canadians?
- How should the risks of open banking be mitigated?
- What is the appropriate role of government?
A New Framework and a New Term:
The Committee acknowledges that data sharing by customers is already happening, including through the prevalence of a practice called "screen scraping". The Committee also emphasizes that it understands consumers' need and desire to be in the driver's seat when it comes to their own financial information.[1]
Accordingly, the Committee urges the development of a framework so that financial data can be shared in a safe and secure manner. The Report describes this framework as "guardrails" that will protect consumers and participants while allowing innovation to flourish.The term that the Committee uses for this framework is "consumer-directed finance" which, in contrast to the term "open banking", reflects the fact that consumer-directed finance is intended to be consumer controlled, secure and to safeguard privacy. In addition, consumer-directed finance more broadly encompasses financial products and financial data, and is not limited to banking.
Consultation Themes
The Committee's consultations resulted in the emergence of the following key themes and takeaways:
- Financial Inclusion - consumer-directed finance can provide greater financial inclusion, but the government must design for inclusion and consider and mitigate for unintended consequences such that vulnerable customers are protected.
- Cybersecurity - stakeholder concerns included risk of increased risk of data breaches, unauthorized payments and defective transactions. Accordingly, cyber security best practices and standards should be core to any considerations.
- Privacy - there was broad recognition that consumer-directed finance may amplify existing privacy-related risks, such as data misuse, re-identification, behavioral targeting and fraud. However, these were not seen was insurmountable risks and could potentially be managed. Accordingly, privacy and data protection should be at the heart of consumer-directed finance implementation.
- Financial Stability - a consumer-directed finance system could amplify risks (many of which are currently existing) to financial stability. Accordingly, any considerations to providing for greater efficiency and utility should not weaken Canada's financial stability and its strength, which is a global competitive advantage for Canada.
- Liability - this was a key discussion point for many stakeholders, the common theme of which was that the status quo approach to liability is not sufficient. Liability in this new framework needs to be clearly attributed with a stronger focus on protecting consumers. Accordingly, generally, liability should rest with the party at fault and all market participants must be responsible for securing and protecting consumer data.
- Technical Standards - the industry has the potential and expertise to develop leading-edge technical standards. Such technical standards should be consistent with government objectives. There was also general agreement among stakeholders that consumer-directed finance, if any, should be implemented in alignment with payments systems modernization.
Answering the Questions
The Report provided the following answers to the initial three questions (re-framed with the proposed change to "consumer-directed finance"):
Are there meaningful benefits for Canadians from consumer-directed finance?
The Committee determined that consumer-directed finance, with the proper protections, will provide several benefits to not only Canadians (both consumers and small businesses) but also to the sector and to the economy. Among those benefits would be the ability of Canadians to better and more efficiently manage their finances and make use of their financial data and providing the marginalized and underbanked with better tools for accessing financial services and products and improving their financial health. The creation of this framework and the tools within it would also drive innovation in the sector, could increase productivity and would boost both the sector and the economy as a whole.
How should risks related to consumer protection, privacy, cyber security and financial stability be managed?
There are risks to consumer-directed finance. With the sharing by consumers of their financial information and an increased number of participants dealing with sensitive financial information there could be more avenues for cyber-attacks and data breaches. There is also concern that consumers be adequately protected and that the system not increase existing inequalities. As noted above, since the sharing of sensitive financial information is already happening including with the prevalence of smart-devices, many of the risks related to consumer-directed finance already exist. The Committee heard that the risks are not insurmountable and in fact, a consumer-directed finance framework could make the current environment safer. Finally, the challenges of navigating through the complexities to enable consumer-directed finance must be balanced against the risk of inaction and the effect of inaction on the global competitiveness of Canada's financial sector.
More specifically, there was also a consensus among stakeholders that an accreditation system to admit service providers into the ecosystem could be an appropriate way to manage and address privacy and cyber security risks. There would also need to be processes in place to authorize and identify consumers. As a result, there is a connection between consumer-directed finance and digital identity initiatives. The creation of a consumer-directed finance framework could also provide an opportunity to improve the current privacy framework by empowering consumers to be more in control and knowledgeable with respect to their personal information.
In this context, the Committee is of the view that the risks in-market today need to be addressed expeditiously and that a framework which sets ground rules and protections could be a useful and appropriate way to do so.
What role and steps are appropriate for the federal government to take in the implementation of a consumer-directed finance framework?
The Committee reported that the majority of the stakeholders believe that government and private industry should work together to develop the framework for consumer-directed finance in Canada, although there is not necessarily consensus about exactly what the government should do. The Report suggests that consumer-directed finance could be used as a first step in a broader transformation involving increased innovation and a move to a data-driven economy. The government could play a role in ensuring this is possible by ensuring consistency with other developments in the financial services sector (such as payments modernization).
Key Recommendations
The Committee ultimately recommends that the Canadian government move forward to enable and promote consumer-directed finance. In doing so, the Report makes some specific recommendations (principles and processes) with respect to how the government should move forward:
Guiding Principles
1. Consumer-directed finance should be focused on enabling consumer choice and meaningful control.
2. Consumer-directed finance should give consumers confidence and engender trust. It should be secure; respect and enhance privacy; and, be an improvement over the status quo.
3. Innovation should guide the development of consumer-directed finance, founded on a safe, secure and standardized data-sharing mechanism.
Guiding Processes
4. There is a role for government to play. The government should set a clear timeline for moving forward, prioritize consumer interests and the development of an ecosystem that is accessible to a broad range of stakeholders.
5. Consumer-directed finance should serve as a blueprint for the Government to enable enhanced data choice and control for Canadians across all sectors of the economy. To that end, it should be done in consultation with regulators across sectors and in alignment with other related initiatives including payments modernization, updates to privacy frameworks, consideration of digital identity and the Department of Innovation, Science and Economic Development's digital and data initiatives.
6. Canada has the opportunity to take advantage of the experience of other jurisdictions that have enabled consumer-directed finance. Canada's approach must also provide for interoperability with international systems.
7. Striking a balance between the imperative to act and the need to mitigate risks is critical.
What Comes Next?
The Report states that while privacy and cyber security concerns are real, equal weight must be given to the growth of a vibrant financial ecosystem and technological innovation. As well, the Report emphasizes that these concerns must be balanced against the risks of inaction; namely, decreased global competitiveness, less innovation and a loss of talent. In fact, the Report specifically states that "If Canada hesitates, or becomes bogged down by the complexities of acting to enable consumer-directed finance, we stand to lose significant ground on innovation and competitiveness."
The Report also states that "with the strength of its financial services sector, ambitious innovators and top talent, Canada has the potential to be a leader in the development of consumer-directed finance – but that it risks falling behind if it does not take timely and concrete action."
Nevertheless, it appears that the government is going to move slowly. The news release from the Department of Finance accompanying the Report emphasizes the importance of protecting the privacy and security of Canadians' financial data, and the Minister of Finance has announced that the Committee will undertake a second phase of work to continue to examine the merits of open banking with a particular focus on data security. This second phase is to address potential solutions and standards to enhance data protection in the financial sector, examining issues such as governance, consumer control of personal data, privacy and security. The results of this further work are to be delivered later this year.
[1] The authors acknowledge the contribution of Sarah Chouinard, student-at-law, in preparing this bulletin.
