When a National Bank customer links their account to an approved fintech app, there’s a small but important difference from what clients of other Canadian banks experience.

Most Canadians who use bookkeeping software, budgeting apps and other platforms get directed to an outside data-collecting firm, which will prompt them to hand over their online banking passwords so the fintech can access their data. National Bank customers, on the other hand, get redirected to the bank’s own website, which checks their identity before providing the data through a secure feed.

Most customers probably don’t notice the difference, and National Bank doesn’t make it a selling point in its marketing. But its secure feed for sharing data with fintechs—called an application programming interface, or API—is the only one offered by a Big Six bank in Canada for retail banking. 

National Bank’s competitors will have to build their own APIs if the federal government institutes open banking, a set of rules that would require banks to securely share certain data with fintechs at a customer’s request. But Natacha Boudrias, open banking lead at National Bank, said the Montreal lender wanted a head start.

“We looked at other jurisdictions and acknowledged that it’s coming our way,” Boudrias said. “We didn’t wait for the government to decide whether we were going to deliver this service.”

Ottawa has committed to launch open banking in 2026, but in the meantime, the practice of sharing banking passwords to power fintech apps has become widespread. An estimated nine million Canadians have granted bots access to their bank accounts through a process known as screen scraping, letting the bots copy their financial data and save it in a spreadsheet, where the software the customer wants to use can access it.

The Canadian Bankers Association, an industry group, supports open banking, but banks have a history of tension with the concept. In the U.S., the future of open banking is in question as a court battle plays out, with banks arguing it’s unfair to force them to give up valuable and sensitive data to fintechs making competing products.

The terms of service of every major Canadian bank except National Bank prohibit their customers from sharing their online banking credentials with anyone, which effectively means customers who use fintech apps are in violation of their banking agreements. The federal Liberals have pledged to ban screen scraping after open banking goes live.

In the meantime, however, banks have three choices. They can crack down on screen scraping by blocking their customers from using popular fintech apps, which would risk losing their business to competitors. They can look the other way, despite the security concerns, as major lenders are doing. Or, they can invest substantial time and resources into building APIs, offering a secure alternative.

In 2021, National Bank chose the latter option. The lender paid $103 million to increase its stake in Flinks, a Montreal-based financial data aggregator, to 80 per cent from 28 per cent.

Under open banking, fintechs will have to go through an accreditation process to gain permission to access banking data. Flinks undertook that role for National Bank, putting fintechs through a security screening before granting about 90 of them access to the lender’s data if its customers want to use their products. Flinks also makes the technology that connects fintechs to National Bank’s API.

Dominique Samson, chief operating officer at Flinks, said other Canadian banks could do the same any time—and in fact, he’d love to sign them up as customers. “This has proved that, from a technical standpoint, there’s nothing needed” for other banks to launch their own APIs, he said. “There’s no secret recipe.”

Since introducing its API, National Bank has reduced screen scraping of its retail customers’ accounts by 90 per cent, Boudrias said. Samson said the experience of using fintech apps is “better in every way” for National Bank customers, in contrast with the multiple frustrating login attempts, slow speeds and error messages that are common when using screen scraping to power the same services.

Boudrias said in her view, the customers should get to decide what to do with their own data. National Bank also collects valuable data by offering the API, she said. Knowing what fintechs the bank’s customers are connecting to can spark ideas about new products to offer and acquisitions to make. “For strategic decision making, they’re interesting insights,” she said.

There are challenges to being first, however. Samson said it wasn’t easy to convince fintechs to put in the resources to get accredited to access National Bank’s API through Flinks, since it would ultimately give them access to just one bank’s data. “That was a slow grind to get people onboarded,” he said.

Eyal Sivan, general manager for North America with the U.K.-based open banking technology firm Ozone API, said building an API is just the beginning. Developers will continuously ask for tweaks and new features, he said—which will be impossible to deliver if the rest of the bank’s technology is out of date. “You need to have a team assigned to this on an ongoing basis, ready to improve it as it goes.”

Rather than mandating that banks put in this work by implementing open banking, governments could opt for a market-based approach, letting banks decide on their own whether the investment is worth it as National Bank has. Abraham Tachjian, head of open banking at PwC Canada and former open banking lead to the government, said that would be a mistake.

“If you have a market-driven approach based on one-off relationships, it is simply not scalable,” he said. “You can’t allow an ecosystem to grow.”

While National Bank has moved ahead without the government’s mandate, Boudrias said she hopes the federal Liberals will move quickly on open banking now that the election is over and they remain in power.

“We should start with what we have and make it grow, rather than wait for everything to be perfect,” she said. “This is a generational opportunity to do it right.”