Glossary

A temporary credential issued after authorization that allows an application to securely access specific resources on behalf of a user.

The formal process by which an organization is approved to participate in an Open Banking or Consumer-Driven Banking ecosystem, ensuring it meets defined technical, security and governance requirements.

An organization that has successfully met the accreditation requirements to participate in Canada's Consumer-Driven Banking ecosystem and is authorized to access customer-permissioned financial data or provide services on a customer's behalf.

The process of securely collecting account information from multiple financial institutions and presenting it in a single application or service.

A committee that provides advice and recommendations to support the development, implementation and ongoing evolution of Canada's Consumer-Driven Banking framework.

The process of verifying the identity of an AI agent before allowing it to access systems, data or services.

The process of determining what actions and resources an authenticated AI agent is permitted to access or perform.

Artificial intelligence that can autonomously plan, reason, make decisions and execute tasks to achieve defined goals with minimal human intervention.

A unique digital identity assigned to an AI agent that enables it to be authenticated, authorized and trusted when interacting with systems, applications and other agents.

The secure exchange of information, requests or actions between two or more AI agents, enabling them to collaborate and complete tasks on behalf of users or organizations.

Information relating to a customer's financial accounts, such as account details, balances, transactions and product information, that can be securely shared with authorized third parties with the customer's consent.

An organization or platform that acts as an intermediary between Data Providers and Data Recipients, aggregating financial data from multiple sources into a single access point.

An autonomous software system that can understand goals, make decisions and perform tasks on behalf of a user or organization.

A set of rules and protocols that enables different software applications to communicate and exchange data securely.

A service that manages, secures and monitors API traffic between systems.

An organization that makes APIs available for authorized third parties to access services or data.

The process of verifying the identity of a user, application or system before granting access.

The processes, technologies and controls used to verify the identity of users, applications and organisations before granting access to systems, data or services within an Open Data ecosystem.

The process of determining what an authenticated user or system is permitted to access or do.

The process of determining what an authenticated user or system is permitted to access or do.

A publicly accessible registry that lists Accredited Third-Party Service Providers (ATPSPs) authorized to participate in Canada's Consumer-Driven Banking framework, providing transparency about accredited participants and their status.

A unique identifier assigned to an application when it registers with an authorization server.

A confidential credential used to authenticate an application when communicating with an authorization server.

The shared rules, standards and requirements that govern how participants operate and interact within Canada's Consumer-Driven Banking framework. Common Rules establish consistent expectations for security, consent, liability, operational processes and participant responsibilities.

The process of encouraging innovation, choice and better outcomes by enabling consumers to securely share their financial data with accredited participants, allowing organizations to develop new products, services and experiences within open banking ecosystems.

A standard developed by FDX to support data sharing in a standardized, machine-readable format.

The explicit permission given by a consumer to share their financial data with an authorized third party.

A secure interface that allows consumers to view, manage and revoke the permissions they have granted for sharing their financial data with authorized participants.

The complete user experience through which an end user reviews, authorizes and manages permission to share financial data.

The stages of creating, modifying, synchronizing, revoking, expiring and reauthorizing a consent grant.

The processes and technology used to capture, manage, monitor and revoke consumer consent for data sharing.

The process of changing an existing consent grant, typically implemented by revoking the original consent and issuing a new one.

A notification sent to participants when the status of a consent grant changes.

The request presented to an end user seeking permission to access specific financial data.

The withdrawal of an end user's permission to access their financial data.

The process of ensuring all participating organizations maintain a consistent record of an end user's consent.

The federal legislation that establishes Canada's Consumer-Driven Banking framework. The Act sets out the rules for participation, accreditation, governance, consumer protection and the secure sharing of customer-permissioned financial data between participating entities and Accredited Third-Party Service Providers (ATPSPs).

The policies, standards, governance and technical requirements that enable secure and interoperable data sharing within Canada's Consumer-Driven Banking ecosystem.

A U.S. federal agency responsible for protecting consumers in the financial marketplace. The CFPB develops and enforces regulations relating to consumer financial products and services, including the Personal Financial Data Rights Rule under Section 1033 of the Dodd-Frank Act.

An interface through which a consumer requests, accesses and manages their covered financial data with a Data Provider.

Information about a consumer that identifies or describes them, such as their name, contact details and other personal information associated with their financial accounts, that may be shared with their consent under Canada's Consumer-Driven Banking framework.

The central system used by a financial institution to manage customer accounts, transactions and banking operations.

The categories of customer financial information that a Data Provider is required to make available under the U.S. Personal Financial Data Rights Rule.

The practice of providing online banking usernames and passwords to a third party to access financial data. Credential sharing is commonly associated with screen scraping and is being replaced by more secure, API-based data sharing using customer consent.

The secure exchange of financial data between organizations operating in different countries or jurisdictions, in accordance with applicable legal, regulatory and privacy requirements.

Information relating to a customer's accounts, transactions, products or financial activities.

The overall experience a customer has when interacting with an organization, including the ease, efficiency and quality of products, services and digital interactions.

The practice of protecting systems, networks and data from unauthorized access, attack or damage.

A connected network of organizations, technology providers and participants that exchange data and services securely.

Any organization or individual that participates in data sharing ecosystems.

The process of converting data into a secure format to prevent unauthorized access.

The individual who owns the financial data and grants permission for it to be shared.

European legislation governing the collection, processing and protection of personal data.

The rules, roles, responsibilities and processes that define how participants operate and interact within data sharing ecosystem.

An approach in which the development, implementation and oversight of a framework or initiative is primarily directed by government through legislation, regulation and public policy.

A consent model that allows consumers to specify exactly which data can be shared, with whom and for what purpose.

The policies, technologies and processes used to manage digital identities and control access to systems, applications and data.

A service that authenticates users and confirms their identity to other systems.

A security token issued by OpenID Connect that contains information about the authenticated user.

The process of confirming that an individual or organization is who they claim to be before providing access to services or information.

The process of planning, configuring and deploying technology, standards and processes to participate in an ecosystem.

An organization that provides technology or services to help connect systems, applications or participants within an ecosystem.

Canada's national payments network, providing debit payment and money transfer services and supporting secure digital payment infrastructure.

The ability of different systems, organizations and technologies to exchange and use data seamlessly.

An international messaging standard for exchanging financial information.

The processes and controls used to generate, store, distribute, rotate and protect cryptographic keys used to encrypt data and secure communications.

A measurable value used to assess the performance, effectiveness or success of a product, service, process or organization.

The process of verifying the identity, authority and permissions of an AI agent or automated system before allowing it to access data, perform actions or act on behalf of a user or organization.

The process used by financial institutions and regulated organizations to verify the identity, ownership and legal status of a business, helping to prevent fraud, financial crime and regulatory non-compliance.

The process used by financial institutions to verify the identity of customers and assess potential risks, helping to prevent fraud, money laundering and other financial crimes.

The secure process of sharing cryptographic keys between authorised parties to enable encrypted communication.

The automated exchange of data between systems or applications without human intervention.

A customer of a credit union who owns a membership share and has access to its financial services.

Financial and personal information relating to a credit union member that may be shared with their consent under a data sharing framework.

The overall experience a member has when interacting with a credit union across its products, services and digital channels.

Information that describes other data, such as its source, format, creation date or permissions.

A security process requiring two or more methods of identity verification before access is granted.

The continuous observation of systems, APIs or services to identify performance issues, security events or operational risks.

A permission that defines the level of access an application is requesting to a user's data.

An authorization framework that enables users to grant third-party applications secure access to their data without sharing their passwords or login credentials.

A framework that enables consumers to securely share banking data with authorized third parties using APIs.

The broader concept of securely sharing data across sectors through agreed standards, governance and customer consent.

A network of organizations that securely exchange data, services and capabilities using common standards and governance.

The technology, standards and governance that enable trusted Open Data ecosystems to operate.

A technology platform that enables organizations to participate in Open Data ecosystems through secure data sharing and interoperability.

The extension of Open Banking to include a wider range of financial products such as investments, pensions and insurance.

An identity layer built on OAuth 2.0 that enables applications to verify a user's identity and securely obtain basic profile information through standardized authentication.

An identity provider that authenticates users and issues OpenID Connect identity tokens.

The secure initiation and management of payments through Open Banking and Open Data technologies.

Agreed technical specifications that enable interoperability between organizations and systems.

The permissions granted to an application that determine which data or services it can access

A method of collecting data by capturing information displayed on a user's online banking interface, via credential sharing, rather than using secure APIs.

A security requirement that uses two or more independent authentication factors to verify a user's identity before granting access to an account or authorising certain actions. Authentication factors are based on three categories: something the user knows, something they have and something they are.

The authorized exchange of data using agreed standards, security controls and customer consent.

An organization that provides services within an Open Data ecosystem.

An organization that consumes services provided by another participant within a data-sharing ecosystem.

An organization responsible for developing, maintaining and promoting technical standards that enable secure, interoperable and consistent data sharing.

The permission granted by a user to allow their data to be shared or accessed for a specific purpose.

The overall experience a person has when interacting with a product, service or digital application, including its usability, accessibility and ease of use.

The visual elements and controls through which a user interacts with a digital application or system.

A shared service or infrastructure that provides common capabilities to multiple participants within a data sharing ecosystem.

A value used to uniquely identify a user, organization, account, application or transaction within a system or ecosystem

Information that does not follow a predefined format or data model, such as documents, emails or images.

An automated method of sending real-time notifications or data between systems when a specific event occurs.

A defined sequence of tasks or processes that automates or supports the exchange of data and services between participants.

The permission to create, update or modify data within a system or application.

An API that allows authorized applications to create, update or delete data within another system.

A human-readable data format commonly used for configuration files and API specifications.