C1OD help organizations participate in Open Data ecosystems and prepare for the future of Open Banking, including emerging frameworks such as Canada's Consumer-Driven Banking framework and the United States' Personal Financial Data Rights framework.

Open banking lets consumers securely share their bank data, such as balances, transactions, and account details with authorized third parties through APIs. It can be government-led, where regulation requires banks to share consumer-permissioned data, or market-led, where banks and fintechs develop services more voluntarily. In both cases, it gives consumers more control over how their banking data is accessed and used.

Open Finance extends the principles of Open Banking beyond traditional banking data to a broader range of financial products, services and data, such as mortgages, or pensions.

Open Data extends beyond financial data, creating opportunities for organizations and sectors to connect, collaborate and develop new products, services and experiences.

Open Banking is the foundation, Open Finance broadens access across financial services, and Open Data unlocks the secure exchange of permissioned data across sectors, enabling connected ecosystems where organizations can collaborate, innovate and deliver more personalized customer experiences.

Consumer-Driven Banking is Canada's open banking framework for enabling consumers to securely share their financial data with accredited third parties through authorized APIs.

Consumer-Driven Banking will allow consumers to give permission for accredited third parties to access specified financial data through secure, standardized connections, subject to the applicable rules and controls.

Consumer-Driven Banking or Open Banking gives consumers greater control over their financial data while creating opportunities for competition, innovation and new financial services. It also moves data sharing away from credential-based screen scraping towards more secure, permissioned API-based access, improving security, control and the overall customer experience.

The implementation timeline is determined by the federal Consumer-Driven Banking framework and its applicable regulatory requirements. Current dates should be confirmed against the latest official guidance.

Open Data gives organizations the ability to securely access and share data across organizational and sector boundaries, creating opportunities for greater collaboration, innovation and new services. It moves beyond simply sharing financial data, enabling organizations to participate in broader ecosystems and connect customers with products, services and information in new ways.

C1OD provides the technology and expertise that enables organizations to participate securely in Open Data ecosystems.

C1OD works with a range of organizations, including financial institutions, fintechs and other third parties, which may participate in Open Data ecosystems in different roles. Depending on the ecosystem and use case, an organization may act as a Data Provider, Data Recipient, Service Provider or Service Recipient, or fulfil multiple roles.

C1OD combines point-to-point technology with deep financial services and Open Data expertise, giving organizations the infrastructure and support to participate in evolving data ecosystems. Unlike black-box aggregator models, our approach provides greater visibility and control across the data-sharing relationship, helping organizations realize value from participation rather than simply meeting the requirements of Open Banking.

No. C1OD was established well ahead of Canada's regulatory implementation because we see Open Banking or Consumer-Driven Banking as the first step towards broader Open Data ecosystems. We don't just help organizations meet regulatory requirements, we help them unlock the long-term value of participating in trusted, customer-permissioned data-sharing ecosystems, where data, services and innovation extend far beyond traditional banking and their channels.

C1OD helps organizations understand the requirements, technology and opportunities associated with Consumer-Driven Banking and build the capabilities needed for future participation.

No. While our current focus today is supporting Canadian credit unions and partners, our solutions are designed for a wide range of organizations participating in Open Data ecosystems. This includes banks, fintechs, technology partners and other organizations looking to securely exchange customer-permissioned data.

No, C1OD has a strong focus on the Canadian market, but our experience and expertise extend across global Open Banking and Open Data ecosystems. Our FDX platform is interoperable with the U.S. market, and we plan to expand our presence there as the market and opportunities develop.

An API, or Application Programming Interface, enables different software systems to communicate and exchange information in a defined and controlled way.

FAPI (Financial-grade API) is a security profile developed by the OpenID Foundation that builds on OAuth 2.0 and OpenID Connect to provide stronger security and interoperability for APIs handling sensitive financial data.

Financial Data Exchange (FDX) is a North American standards organization that develops standards for secure and interoperable financial data sharing.

A Data Access Platform (commonly referred to as aggregators), a term set by the FDX, facilitates secure, permissioned data sharing between Data Providers and Data Recipients through standardized interfaces via APIs.

An aggregator is an organization or service that facilitates access to financial data from one or more Data Providers, while screen scraping typically accesses data using a customer's online banking credentials.

A Data Provider is an organization that holds financial data and makes it available through an authorized data-sharing process, while a Data Recipient receives that data with the appropriate customer consent, authorization and authentication.

Yes. A financial institution can act as either a Data Provider or Data Recipient depending on the data-sharing use case and may fulfil multiple roles within an Open Data ecosystem.

Open Data ecosystems are made up of organizations that fulfil many different roles. While some organizations participate as Data Providers or Data Recipients, others participate by providing or consuming services that enhance the ecosystem.

For example, a technology provider may offer identity, payments, fraud detection or AI services that other participants consume. Likewise, a financial institution may share customer-permissioned data as a Data Provider, consume data as a Data Recipient, use services from other participants to enhance its own products, or provide its own services for others to consume.

This many-to-many model enables organizations to collaborate, extend their reach, deliver new services and create greater value for customers, making Open Data ecosystems far more than simply a mechanism for sharing data.

Data Clusters are logical groupings of related financial data used by FDX to define and communicate the categories of data being requested or shared.

Technical Standards are agreed specifications, protocols and requirements that enable secure, interoperable and consistent data sharing between systems and participants.

API-based data sharing uses secure, defined interfaces and customer permissions to exchange data, while screen scraping typically requires credentials to access and extract information from an online banking interface.

Consent is the explicit permission given by a consumer to allow their financial data to be accessed or shared for a defined purpose.

Consent management covers the processes and technology used to capture, monitor, modify and revoke permissions for financial data sharing. Under most Open Banking regulations both the Data Provider and Data Recipient provide a dashboard to help a consumer manage their consent.

Yes. A customer can withdraw a previously granted consent, preventing further access under that consent

When consent expires, access to the data covered by that consent should no longer continue unless a new or renewed consent is established.

Customer data is protected through controls covering authentication, authorization, security, privacy and the secure transmission and handling of data.

The data that can be shared depends on the applicable framework, standards and the customer's permission, with access limited to the data covered by the consent.

Data Minimization is the principle that only the data necessary for a defined and authorized purpose should be accessed or shared.

Customer-permissioned data is financial information that a customer has explicitly authorized an organization or third party to access or share.

Customer-permissioned data sharing uses security controls such as authentication, authorization, encryption and secure APIs to protect data during access and transmission.

OAuth 2.0 is an authorization framework that enables applications to obtain controlled access to data or services without requiring users to share their passwords with those applications.

Multi-factor Authentication (MFA) requires two or more authentication factors.

Strong Customer Authentication (SCA) is a method of verifying a user's identity using two or more independent authentication factors from three categories including something the customer has, knows or is, for example a customer might be authenticated with their password (know) and biometrics (is).

A Trust Framework, usually a point-to-point connectivity platform which establishes the rules, standards, identities and controls that enable participants in an ecosystem to establish and maintain trust.

Once onboarded into a trust framework organizations and applications can be authenticated using mechanisms their trusted identity.

Canada is developing its open banking, Consumer Driven Banking Framework, much later than the UK, giving it an opportunity to learn from the successes and challenges of more successful markets. The UK has a mature, regulator-led Open Banking ecosystem, while the US has taken a more market-driven approach but with its own mandated framework on the horizon with Section 1033 and the CFPB's Personal Financial Data Rights framework.

Section 1033 of the U.S. Dodd-Frank Act establishes consumers' rights to access information concerning their financial products or services and forms the basis of the CFPB's Personal Financial Data Rights Rule.

The Consumer Financial Protection Bureau (CFPB) is a U.S. federal agency responsible for protecting consumers in the financial marketplace, including through rules governing consumer financial data rights.

FDX, awarded the role of Standards Settings Body under the CFPB’s 1033 ruling, and develops and maintains standards intended to support secure, interoperable and consumer-permissioned financial data sharing. It is speculated they will also be the standards set for Canada and are the ones adopted by C1OD.

The Bank of Canada is Canada's central bank and has responsibilities within the Canadian financial system, but the Consumer-Driven Banking framework is established federally through the Department of Finance and legislation.

Agentic AI refers to AI systems that can plan, make decisions and perform tasks to achieve defined goals with limited human intervention.

Know Your Agent (KYA) is the process of establishing trust in an AI agent by verifying its identity, authority and permissions before allowing it to access data or perform actions.

AI agents could execute permissioned tasks and use permissioned financial data to provide personalized insights, make recommendations and perform authorized tasks on behalf of consumers or organizations.

Open Data can provide AI systems with access to trusted, permissioned and structured information, supporting more useful and context-aware services. As AI evolves towards agentic models, trusted Open Data infrastructure and identity frameworks can provide the foundations for agents to securely access data, establish trust and act on behalf of users and organizations.

Open Data is likely to evolve beyond basic data sharing towards interconnected ecosystems in which organizations, services and AI agents can securely exchange data and act on behalf of users.