Consumer-Driven Banking Terms & Definitions

Avoid: “Provider” or “account” when used alone to describe the organization.

Use “bank” when the context is clear. Use “account provider” when referring broadly to banks and other organizations that provide eligible accounts.

Authentication information means any password or other information that a consumer creates or adopts to be used to authenticate their identity.

Bank means the Bank of Canada.

Complaint means an expression of dissatisfaction, whether justified or not, to a participating entity with respect to any activity that it performs under this Act.

Avoid: Access.

Describe the relationship between an account provider and a service provider as a connection. “Access” can imply account takeover or control.

Avoid: Consents; Agreements.

Call each relationship shown on the dashboard a connection rather than using legal or ambiguous terminology.

Avoid: Financial data; “information” without a clarifying word.

Use a specific term that makes clear what the consumer is sharing. The guidance generally favours “data” over “information” used by itself.

Data Custodian is the technical team, such as IT or database administrators, that stores the data, runs backups, and keeps the supporting servers secure.

Data Owner is the person or group in charge of a dataset. They decide who gets access, establish policies, and are accountable for the data’s overall quality and governing rules.

Data Processor is an outside tool, cloud service, or company that handles or processes data on behalf of the owner.

Data Provider is a system, app, or company that makes data available, such as a weather API sending temperature values.

Data Receiver is a system, app, or person that accepts an incoming data stream or file transfer.

Data Steward is the person who manages day-to-day data quality, ensuring the information is clean, accurate, and handled according to the data owner’s rules.

Avoid: Date access granted.

Describe when the connection began using the same connection language used throughout the customer journey.

Derived data means, subject to the regulations, data about a consumer, product or service that has been enhanced by a participating entity to significantly increase its usefulness or commercial value.

Avoid: Revoke consent; Revoke; Delete account.

Use connection language so customers do not mistake the action for deleting their underlying bank account.

Entity means a corporation, trust, partnership, fund, unincorporated association or organization or federal or provincial Crown corporation.

External complaints body means the corporation designated under subsection 114(1).

Federal financial institution means:

1. a bank that is listed in Schedule I or II to the Bank Act;
2. an authorized foreign bank as defined in section 2 of the Bank Act;
3. a company to which the Trust and Loan Companies Act applies;
4. an association to which the Cooperative Credit Associations Act applies; or
5. a company, fraternal benefit society or foreign company to which the Insurance Companies Act applies.

Government authority includes the Royal Canadian Mounted Police, the Communications Security Establishment and the Canadian Security Intelligence Service.

Governor has the same meaning as in section 2 of the Bank of Canada Act.

Avoid: Last synced; Date refreshed.

Use “updated” to show when data was last obtained and to distinguish the data timestamp from the status of the connection itself.

Minister means the Minister of Finance.

Avoid: Access dashboard; Permissions.

Use a consistent, customer-oriented name for the area where people manage ongoing data-sharing relationships.

Avoid: Consent dashboard.

Name the customer area according to what people manage there—their open banking connections—rather than the legal mechanism behind it.

Participating entity means:

1. a bank that is listed in the schedule;
2. a federal financial institution or provincial financial institution that is accredited under section 15;
3. a registered payment service provider that is accredited under section 17; or
4. an entity that is accredited under section 19.

Avoid: Initiate a payment; Set up a payment.

Use straightforward payment language and clearly identify the point at which the payment will be confirmed.

Avoid: Initiate a payment; Permission to make a payment.

Use the simple action that matches what the customer is doing instead of exposing the technical concept of payment initiation.

Avoid: Trusted beneficiaries.

Use the familiar wording already used by the account provider for saved payment destinations instead of the technical industry term.

Avoid: VRP when the abbreviation has not been explained.

Use the full name during setup and explain how the payment works. “Payment permission” can be clearer in dashboards and management screens.

Avoid: Consent parameters.

Use “payment rules” for the limits and conditions a customer agrees to when establishing a variable recurring payment.

Provincial financial institution means:

1. a cooperative credit society, savings and credit union or caisse populaire that is regulated by a provincial Act;
2. a provincial Crown corporation that offers deposit-taking services; or
3. an insurance company that is regulated by a provincial Act.

Avoid: Reconsent.

Ask customers to review and reconfirm their consent when continued data sharing requires a new confirmation.

Registered payment service provider means a payment service provider, as defined in section 2 of the Retail Payment Activities Act, that is registered, as defined in that section.

Registry means the registry that is maintained under section 44.

Avoid: Redirect.

When moving a customer between a service provider and an account provider, “securely transfer” is clearer and more reassuring than technical redirection language.

Avoid: Third parties.

Use recognizable descriptions for the organizations receiving data. Add “regulated” where additional reassurance is useful and accurate.

Avoid: Access.

Use sharing language to explain how data moves from an account provider to an app, website, or service provider.

Sharing, in respect of consumer data, means the provision or receipt of that data by participating entities.

Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, of business or of professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.

Legislative reference: Consumer-Driven Banking Act, subsection 82(7).

Avoid: Cancel access; Remove access; Remove connection.

When the action ends data flow at the account provider, describe the result directly: the provider will stop sharing data.

Technical standards body means the body designated under subsection 125(1).

Third-party service provider means an individual or entity that is not an employee or an agent or mandatary of a participating entity and that, under a contract, provides the participating entity with a service that is related to the activities that the participating entity performs under this Act.

Avoid: Payee.

Use plain language to identify the payment destination. “Payee” may be too technical without supporting context.

Terms to avoid: None specified.

Use the account provider’s familiar security language where possible. Explain “authenticate” when it may be unfamiliar to customers.

Wrongdoing means a contravention of the Act or the regulations and, with respect to a participating entity, a contravention of a policy or procedure established by the participating entity in relation to its compliance with the Act.

Legislative reference: Consumer-Driven Banking Act, subsection 123(6).