Sahamati estimated that India’s Account Aggregator (AA) ecosystem facilitated 3.68 crore loans worth ₹3.82 lakh crore in FY26, equivalent to 8.4% of retail and micro, small and medium enterprise lending by value. In the United States, a federal court stayed the compliance dates for the Section 1033 rule. Canada has enacted its consumer-driven banking framework and published proposed regulations, but implementation remains phased.
Quick Answer
Open banking regulations in India, the US, and Canada decide who can access customer bank data, how consent works, and who is liable. India’s framework is live at scale, the US rule is blocked by a court, and Canada’s rules are still in draft. Lenders should keep consent and data rules in configuration so one origination stack can follow all three.
Key Takeaways
- India’s Account Aggregator framework is operational at scale; US compliance dates are stayed while the CFPB reconsiders its rule; Canada is developing implementing regulations.
- A lender needs configurable consent scope, purpose, expiry, revocation and retention records for each market.
- The data layer must convert permissioned account and transaction data into traceable cash-flow features used in underwriting.
- Market rules should sit in configuration so regulatory changes do not require a new lending workflow or code branch.
Three Markets, Three Models
Open banking looks different in each market. India built it as licensed infrastructure. The US wrote a rule that is now on hold. Canada passed a law and is still finalizing the operating rules. The table shows where each stood in early October 2026.
| Market | Status | What it means for lenders |
| India (Account Aggregator framework) | Live since September 2021. The Reserve Bank of India (RBI) licenses the Account Aggregators that manage consent. | Consent-based data pulls already run at scale. |
| United States (Section 1033 rule) | Final rule issued October 2024. A federal court blocked enforcement in late October 2025. The Consumer Financial Protection Bureau (CFPB) is reconsidering the rule. | No federal deadline to build against. Rules on fees for data access are open again. |
| Canada (Consumer-Driven Banking Act) | Royal Assent in March 2026. Draft regulations published June 27, 2026. Start dates not yet fixed. | The Bank of Canada will supervise accredited providers. Access is read-only at first, and lending accounts follow deposit and payment accounts. |
India’s data-protection framework adds a second layer. The Digital Personal Data Protection Rules, 2025 use a phased commencement schedule. Lenders should map the official commencement notifications to each obligation rather than rely on a single implementation date.
What India’s Numbers Show About Lending
Sahamati is the RBI-recognized self-regulatory organization for the AA ecosystem. It published FY26 figures in August 2026. It estimates AA-enabled loans at about $41 billion across 36.8 million loans. That is 8.4% of retail and MSME lending by value and 11.8% by volume.[SOURCE]
Three details matter for lenders:
- Banks accounted for 47.3% of AA-enabled lending by value in the second half of FY26. That nearly matched non-bank finance companies.
- AA-enabled home loans and loans against property reached 109,000 loans worth about $2.2 billion. Sahamati reports that as a 624% year-on-year increase.
- New-to-credit borrowers made up 18.2% of originations by volume among participating institutions.
Sahamati represents the AA ecosystem, and its figures are estimates. They are best read as indicators of direction. Its report expects tax and provident fund data sources to strengthen cash flow-based lending.
The article retains Sahamati’s rupee figures to avoid introducing an exchange-rate assumption into a domestic market statistic.
Where the US and Canada Stand
United States. The CFPB finalized its open banking rule in October 2024. The first compliance date had moved to June 30, 2026. A federal court in Kentucky then blocked enforcement while the CFPB reconsiders the rule.
The CFPB’s August 2025 notice asked how providers should recover the cost of responding to data requests. The 2024 rule had required data to be free. A fee model would change the unit cost of each data pull.
Canada. The Consumer-Driven Banking Act received Royal Assent in March 2026. Draft regulations followed on June 27, 2026. They cover accreditation, security, consent, and liability.
The Bank of Canada will supervise the framework. Data sharing will be phased in, starting with deposit and payment accounts and then moving to lending accounts. The Act also includes a screen scraping ban, which will not take effect until further consultation.
What the Rules Change Inside a Lending Stack
These rules rarely change credit policy. They change the systems around it, starting with the loan origination system (LOS).
- Consent capture: Each regime depends on customer permission. The LOS should record who consented, to what, and until when. Canada’s draft rules limit normal consent to 12 months and require consent records for five years.
- Revocation handling: Indian users can revoke consent through their AA app. Lenders need a way to act when consent ends.
- Data ingestion: AA and bank APIs return account and transaction data. The decisioning layer has to turn it into usable cash flow features.
- Retention and use: The 2024 US rule sets conditions on how third parties collect, use, and retain data.
- Security and liability: Canada’s draft rules address both. Contracts with data providers and aggregators should reflect them.
- Fallback access: Where screen scraping is still used, lenders should plan for restrictions.
Evaluation Checklist: Is Your Lending Stack Ready for Open Banking Rules?
- Does the LOS record consent scope, purpose, and expiry for each applicant?
- Can the system act on withdrawn consent without manual work?
- Are retention periods and data scopes configurable by market?
- Does the decisioning layer turn raw transactions into cash flow features?
- Can one journey support AA consent flows in India and accredited-provider flows in Canada?
- Do aggregator contracts cover security, liability, and breach handling?
- Is there a plan if screen scraping access is restricted?
Bottom Line
Open banking rules are moving at different speeds in India, the United States and Canada. The common infrastructure requirements are consent records, secure data ingestion, revocation handling, purpose and retention controls, and traceable cash-flow features. Keeping market rules in configuration reduces the need to redesign the lending journey when regulations change.
Explore how configurable lending infrastructure can manage consent, market-specific data rules and cash-flow decisioning without hard-coding each regulatory change.
FAQs
Do open banking regulations apply to lenders directly?
It depends on the role. In India, lenders usually act as Financial Information Users that receive customer-permitted data. The US rule sets conditions for authorized third parties. Canada’s draft rules set accreditation pathways by entity type. A lender that also holds accounts has duties on both sides.
Can one consent layer serve all three markets?
The core records can be shared. The flows differ. India runs on licensed Account Aggregators, Canada on accredited providers, and the US rule is unsettled. Storing consent terms and data scopes as rules for each market keeps the differences out of the workflow.
Should lenders wait for the US rule to settle?
Section 1033 of the Dodd-Frank Act still exists, and the CFPB says it is writing a new rule. Consent records and data ingestion are reusable across markets, so that work does not depend on the US outcome.
