Glossary

J‍ump to: ‍

A‍ ‍B‍ ‍C‍ ‍ D‍ ‍E‍ ‍F‍ ‍G‍ ‍H‍ I ‍ ‍ ‍J‍ ‍ K‍ ‍L‍ ‍ M‍ ‍ N‍ ‍O‍ ‍ P‍ ‍ Q‍ ‍R ‍ ‍S‍ ‍T‍ ‍U‍ ‍V‍ ‍W‍‍ ‍ ‍X‍ ‍Y‍ ‍Z

A

A temporary credential issued after authorization that allows an application to securely access specific resources on behalf of a user.
The formal process by which an organization is approved to participate in an Open Banking or Consumer-Driven Banking ecosystem, ensuring it meets defined technical, security and governance requirements.
An organization that has successfully met the accreditation requirements to participate in Canada's Consumer-Driven Banking ecosystem and is authorized to access customer-permissioned financial data or provide services on a customer's behalf.
The process of securely collecting account information from multiple financial institutions and presenting it in a single application or service.
A committee that provides advice and recommendations to support the development, implementation and ongoing evolution of Canada's Consumer-Driven Banking framework.
The process of verifying the identity of an AI agent before allowing it to access systems, data or services.
The process of determining what actions and resources an authenticated AI agent is permitted to access or perform.
Artificial intelligence that can autonomously plan, reason, make decisions and execute tasks to achieve defined goals with minimal human intervention.
A unique digital identity assigned to an AI agent that enables it to be authenticated, authorized and trusted when interacting with systems, applications and other agents.
The secure exchange of information, requests or actions between two or more AI agents, enabling them to collaborate and complete tasks on behalf of users or organizations.
Information relating to a customer's financial accounts, such as account details, balances, transactions and product information, that can be securely shared with authorized third parties with the customer's consent.
An organization or platform that acts as an intermediary between Data Providers and Data Recipients, aggregating financial data from multiple sources into a single access point.
An autonomous software system that can understand goals, make decisions and perform tasks on behalf of a user or organization.
A set of rules and protocols that enables different software applications to communicate and exchange data securely.
A service that manages, secures and monitors API traffic between systems.
An organization that makes APIs available for authorized third parties to access services or data.
The process of verifying the identity of a user, application or system before granting access.
The processes, technologies and controls used to verify the identity of users, applications and organisations before granting access to systems, data or services within an Open Data ecosystem.
The process of determining what an authenticated user or system is permitted to access or do.
The process of determining what an authenticated user or system is permitted to access or do.

B

A model where licensed financial institutions provide banking capabilities to third parties through APIs
A method of verifying a person's identity using unique biological characteristics, such as a fingerprint, facial recognition or voice recognition
The clearly defined reason presented to an end user explaining why their financial data is being requested.

C

A publicly accessible registry that lists Accredited Third-Party Service Providers (ATPSPs) authorized to participate in Canada's Consumer-Driven Banking framework, providing transparency about accredited participants and their status.
A unique identifier assigned to an application when it registers with an authorization server.
A confidential credential used to authenticate an application when communicating with an authorization server.
The shared rules, standards and requirements that govern how participants operate and interact within Canada's Consumer-Driven Banking framework. Common Rules establish consistent expectations for security, consent, liability, operational processes and participant responsibilities.
The process of encouraging innovation, choice and better outcomes by enabling consumers to securely share their financial data with accredited participants, allowing organizations to develop new products, services and experiences within open banking ecosystems.
A standard developed by FDX to support data sharing in a standardized, machine-readable format.
The explicit permission given by a consumer to share their financial data with an authorized third party.
A secure interface that allows consumers to view, manage and revoke the permissions they have granted for sharing their financial data with authorized participants.
The complete user experience through which an end user reviews, authorizes and manages permission to share financial data.
The stages of creating, modifying, synchronizing, revoking, expiring and reauthorizing a consent grant.
The processes and technology used to capture, manage, monitor and revoke consumer consent for data sharing.
The process of changing an existing consent grant, typically implemented by revoking the original consent and issuing a new one.
A notification sent to participants when the status of a consent grant changes.
The request presented to an end user seeking permission to access specific financial data.
The withdrawal of an end user's permission to access their financial data.
The process of ensuring all participating organizations maintain a consistent record of an end user's consent.
The federal legislation that establishes Canada's Consumer-Driven Banking framework. The Act sets out the rules for participation, accreditation, governance, consumer protection and the secure sharing of customer-permissioned financial data between participating entities and Accredited Third-Party Service Providers (ATPSPs).
The policies, standards, governance and technical requirements that enable secure and interoperable data sharing within Canada's Consumer-Driven Banking ecosystem.
A U.S. federal agency responsible for protecting consumers in the financial marketplace. The CFPB develops and enforces regulations relating to consumer financial products and services, including the Personal Financial Data Rights Rule under Section 1033 of the Dodd-Frank Act.
An interface through which a consumer requests, accesses and manages their covered financial data with a Data Provider.
Information about a consumer that identifies or describes them, such as their name, contact details and other personal information associated with their financial accounts, that may be shared with their consent under Canada's Consumer-Driven Banking framework.
The central system used by a financial institution to manage customer accounts, transactions and banking operations.
The categories of customer financial information that a Data Provider is required to make available under the U.S. Personal Financial Data Rights Rule.
The practice of providing online banking usernames and passwords to a third party to access financial data. Credential sharing is commonly associated with screen scraping and is being replaced by more secure, API-based data sharing using customer consent.
The secure exchange of financial data between organizations operating in different countries or jurisdictions, in accordance with applicable legal, regulatory and privacy requirements.
Information relating to a customer's accounts, transactions, products or financial activities.
The overall experience a customer has when interacting with an organization, including the ease, efficiency and quality of products, services and digital interactions.
The practice of protecting systems, networks and data from unauthorized access, attack or damage.

D

An FDX term for a third-party platform that enables customer-permissioned access to financial data, allowing authorized participants to exchange information through APIs in accordance with the rules and standards of data sharing ecosystem.
A logical grouping of related financial data that an end user can authorise to be shared for a specific purpose. This is one of the most important FDX terms and deserves its own guide as well as a glossary entry.
The policies, processes and controls that ensure data is managed securely, consistently and in accordance with legal, regulatory and organizational requirements.
An organization that stores and controls customer financial data and makes it available through authorized data-sharing arrangements.
The principle of collecting, accessing and sharing only the data necessary for a specific purpose.
The ability for customers to securely access and transfer their financial data between organizations and service providers.
An organization that provides authorized access to customer data through secure APIs.
An organization authorized to receive customer-permissioned data from a Data Provider.
The categories and types of customer-permissioned financial data that may be shared under Canada's Consumer-Driven Banking framework
The secure exchange of data between authorized organizations with customer consent.
A network of organizations that securely exchange data, services and capabilities using common standards, governance and customer consent.
A defined format, structure or specification that enables data to be exchanged consistently and interoperable between systems.
The responsibility for managing, protecting and ensuring the quality, security and appropriate use of data throughout its lifecycle.
The Government of Canada department responsible for developing and implementing Canada's Consumer-Driven Banking framework and related financial sector policy.
Information created by processing, analysing or combining customer-permissioned data. Derived data is generated by a participant and is distinct from the original data received from a Data Holder/Provider.
A secure interface, typically an API, through which Authorised Third Parties electronically request and receive covered data from a Data Provider. Required under the U.S. PFDR.
A verified digital representation of an individual or organization used to authenticate identity online.
A digital application that securely stores payment methods, identity credentials or other digital assets.
A point-to-point connection between two organizations that enables secure data sharing without relying on an intermediary or central aggregator.
The provision of the U.S. Dodd-Frank Wall Street Reform and Consumer Protection Act that grants consumers the right to access their financial data in a usable electronic format, forming the legal basis for the CFPB's open banking rule (Regulation 1033/CFPB Rule 1033) and the U.S. equivalent to Canada's Consumer-Driven Banking Act, the UK's Open Banking framework, and Australia's Consumer Data Right.
A process that enables authorized applications to automatically register with an API provider, simplifying secure onboarding within data sharing ecosystems.

E

A connected network of organizations, technology providers and participants that exchange data and services securely.
Any organization or individual that participates in data sharing ecosystems.
The process of converting data into a secure format to prevent unauthorized access.
The individual who owns the financial data and grants permission for it to be shared.

F

A non-profit North American organization that develops the FDX API standard, which enables secure and interoperable financial data sharing across the financial services industry.
A security profile developed by the OpenID Foundation that builds on OAuth 2.0 and OpenID Connect to provide secure, interoperable authentication and authorization for financial-grade APIs and customer-permissioned data sharing.
The standardized API developed by Financial Data Exchange (FDX) that enables secure, interoperable and customer-permissioned financial data sharing between authorized participants.
A common technical standard that defines how financial data is securely shared between participants, promoting interoperability, security and consistency across data sharing ecosystems.
The principles of Control, Access, Transparency, Traceability and Security that underpin financial data sharing within the FDX ecosystem.
A federal agency responsible for protecting the rights and interests of consumers of financial products and services and promoting financial literacy in Canada.
Information relating to a person's or organization's financial accounts, products, transactions or services.
An organization that provides financial products or services, such as a bank or credit union.
A person's ability to confidently manage their finances, meet current and future financial needs, and make informed financial decisions that support their overall financial health.
A company that uses technology to develop or deliver financial products and services.

G

European legislation governing the collection, processing and protection of personal data.
The rules, roles, responsibilities and processes that define how participants operate and interact within data sharing ecosystem.
An approach in which the development, implementation and oversight of a framework or initiative is primarily directed by government through legislation, regulation and public policy.
A consent model that allows consumers to specify exactly which data can be shared, with whom and for what purpose.

H

A cloud-based or managed service that is operated and maintained by a third-party provider on behalf of an organization.

I

The policies, technologies and processes used to manage digital identities and control access to systems, applications and data.
A service that authenticates users and confirms their identity to other systems.
A security token issued by OpenID Connect that contains information about the authenticated user.
The process of confirming that an individual or organization is who they claim to be before providing access to services or information.
The process of planning, configuring and deploying technology, standards and processes to participate in an ecosystem.
An organization that provides technology or services to help connect systems, applications or participants within an ecosystem.
Canada's national payments network, providing debit payment and money transfer services and supporting secure digital payment infrastructure.
The ability of different systems, organizations and technologies to exchange and use data seamlessly.
An international messaging standard for exchanging financial information.

J

An end-to-end user experience representing a complete consent management activity, such as granting or revoking consent.
A lightweight, structured data format commonly used for exchanging information between APIs.
A secure, digitally signed token used to transmit claims and identity information between systems.
A standard format for representing cryptographic keys used to verify digital signatures and encrypt data.
A collection of public keys published by an authorization server for verifying JSON Web Tokens.
A country, province, state or other legal authority with responsibility for establishing and enforcing the laws, regulations and requirements that govern organizations and activities within its area of authority.

K

The processes and controls used to generate, store, distribute, rotate and protect cryptographic keys used to encrypt data and secure communications.
A measurable value used to assess the performance, effectiveness or success of a product, service, process or organization.
The process of verifying the identity, authority and permissions of an AI agent or automated system before allowing it to access data, perform actions or act on behalf of a user or organization.
The process used by financial institutions and regulated organizations to verify the identity, ownership and legal status of a business, helping to prevent fraud, financial crime and regulatory non-compliance.
The process used by financial institutions to verify the identity of customers and assess potential risks, helping to prevent fraud, money laundering and other financial crimes.
The secure process of sharing cryptographic keys between authorised parties to enable encrypted communication.

L

The legal responsibility of a participant for losses, damages or other consequences arising from its actions, omissions or failure to meet its obligations within data sharing ecosystem.
The rules that define how responsibility and liability are allocated between participants in a data sharing ecosystem when issues such as unauthorised access, fraud or operational failures occur.
The process of recording system events, transactions and activities to support monitoring, troubleshooting, auditing and security.
The collection, storage, monitoring and analysis of system logs to support security, compliance and operational performance.
The processes used to manage the creation, maintenance, updating and retirement of systems, applications, APIs or participant credentials throughout their lifecycle.

M

The automated exchange of data between systems or applications without human intervention.
A customer of a credit union who owns a membership share and has access to its financial services.
Financial and personal information relating to a credit union member that may be shared with their consent under a data sharing framework.
The overall experience a member has when interacting with a credit union across its products, services and digital channels.
Information that describes other data, such as its source, format, creation date or permissions.
A security process requiring two or more methods of identity verification before access is granted.
The continuous observation of systems, APIs or services to identify performance issues, security events or operational risks.

N

A digital identity assigned to software, applications, APIs, AI agents, services or devices rather than an individual person.
A security principle that provides evidence that a specific action or transaction occurred, preventing a participant from denying that it took place.
The process of transforming data into a consistent structure or format to improve interoperability and simplify data exchange.

O

A permission that defines the level of access an application is requesting to a user's data.
An authorization framework that enables users to grant third-party applications secure access to their data without sharing their passwords or login credentials.
A framework that enables consumers to securely share banking data with authorized third parties using APIs.
The broader concept of securely sharing data across sectors through agreed standards, governance and customer consent.
A network of organizations that securely exchange data, services and capabilities using common standards and governance.
The technology, standards and governance that enable trusted Open Data ecosystems to operate.
A technology platform that enables organizations to participate in Open Data ecosystems through secure data sharing and interoperability.
The extension of Open Banking to include a wider range of financial products such as investments, pensions and insurance.
An identity layer built on OAuth 2.0 that enables applications to verify a user's identity and securely obtain basic profile information through standardized authentication.
An identity provider that authenticates users and issues OpenID Connect identity tokens.
The secure initiation and management of payments through Open Banking and Open Data technologies.
Agreed technical specifications that enable interoperability between organizations and systems.

P

A payment method that enables consumers to securely make payments directly from their bank account using Open Banking or Open Finance APIs, without using a credit or debit card.
The process of initiating a payment directly from a customer's bank account through an authorized third party.
A regulated third-party provider that enables customers to securely authorize payments directly from their bank account to a merchant or other recipient on their behalf.
A request sent by a merchant or service provider asking a customer to authorize a payment from their bank account.
The open banking rule issued by the U.S. Consumer Financial Protection Bureau (CFPB) under Section 1033 of the Dodd-Frank Act that establishes consumers' rights to access and securely share their personal financial data with authorized third parties.
Information that can identify, relate to or reasonably be linked to a specific individual, either on its own or when combined with other information.
An extension to OAuth 2.0 that protects authorization code flows from interception attacks, particularly in mobile and public client applications.
A model where organizations exchange data directly with one another rather than through a central aggregator.
A documented set of principles, rules or requirements that guides how an organization manages its operations, services, security or compliance.
An organization that enables businesses or consumers to make or receive electronic payments.
An OAuth extension that securely sends authorization request parameters directly to the authorization server before redirecting the user.

Q

R

The permission granted to a user or application to view or retrieve data from a system without the ability to modify, create or delete it.
An API that allows authorized applications to securely retrieve data from another system.
The process of renewing an existing consent grant after it expires or requires confirmation.
A credential used to obtain a new access token without requiring the user to authenticate again.
The process through which a Data Recipient establishes its identity and permissions with a Data Provider before data sharing can occur.
The process of meeting the legal and regulatory requirements that apply to an organization.
The system that hosts protected data and validates access tokens before providing access to resources.
A widely used architectural style for building web APIs using standard HTTP methods.
The process by which a consumer withdraws their permission for an organization or authorized third party to access their financial data, ending future access under that consent.

S

The permissions granted to an application that determine which data or services it can access
A method of collecting data by capturing information displayed on a user's online banking interface, via credential sharing, rather than using secure APIs.
A security requirement that uses two or more independent authentication factors to verify a user's identity before granting access to an account or authorising certain actions. Authentication factors are based on three categories: something the user knows, something they have and something they are.
The authorized exchange of data using agreed standards, security controls and customer consent.
An organization that provides services within an Open Data ecosystem.
An organization that consumes services provided by another participant within a data-sharing ecosystem.
An organization responsible for developing, maintaining and promoting technical standards that enable secure, interoperable and consistent data sharing.

T

Agreed specifications, protocols and requirements that enable systems, applications and organisations to securely exchange data in a consistent, interoperable and reliable manner.
An FDX extension indicating that an API element supports technical implementation requirements rather than customer financial data.
An authorized organization that accesses customer financial data or initiates payments on a customer's behalf.
A digital credential used to authenticate or authorize access to systems, applications or data.
The OAuth endpoint used to exchange authorization credentials for access tokens.
The process of validating an access token and retrieving information about its status, permissions and expiry.
The process of replacing sensitive data with a non-sensitive token to improve security.
A platform with a set of policies, standards and governance that establish trust between participants in an Open Data ecosystem.

U

The permission granted by a user to allow their data to be shared or accessed for a specific purpose.
The overall experience a person has when interacting with a product, service or digital application, including its usability, accessibility and ease of use.
The visual elements and controls through which a user interacts with a digital application or system.
A shared service or infrastructure that provides common capabilities to multiple participants within a data sharing ecosystem.
A value used to uniquely identify a user, organization, account, application or transaction within a system or ecosystem
Information that does not follow a predefined format or data model, such as documents, emails or images.

V

A product or service that enhances or extends the value of existing financial products using customer-permissioned data.
A payment method that enables customers to authorize a series of payments from their bank account within agreed limits, allowing the amount and timing of each payment to vary without requiring separate authorization for every transaction.
The process of confirming that an individual or organisation is who they claim to be.
The practice of managing different versions of an API, standard or software to support updates while maintaining compatibility.
The ongoing process of identifying, assessing, prioritising and remediating security vulnerabilities within systems and applications.

W

An automated method of sending real-time notifications or data between systems when a specific event occurs.
A defined sequence of tasks or processes that automates or supports the exchange of data and services between participants.
The permission to create, update or modify data within a system or application.
An API that allows authorized applications to create, update or delete data within another system.

X

A structured data format used to exchange information between systems. While many modern APIs use JSON, XML is still used in some financial services and legacy systems.

Y

A human-readable data format commonly used for configuration files and API specifications.

Z

A cybersecurity model based on the principle of "never trust, always verify", where every user, device and application must be continuously authenticated and authorised before accessing systems or data.
A security framework that requires continuous verification of identities, devices and access requests to protect systems and sensitive data
A cryptographic method that allows one party to prove information is true without revealing the underlying information itself.