The State of Bank Refresh Tokens in Canada — and What Changes When the Consumer-Driven Banking Act Lands
Published July 30, 2026
Series: News — Research Notes Published: 2026-07-30 Author: Victor Salmon Method: Plaid Sandbox API scan + primary-source web research
Read this first
This post relays the results of an experiment I ran to answer a practical question: if a Canadian small business connects their bank to an app through Plaid, how long can they expect that connection to last before they have to re-authenticate? I'm sharing what I found as per my best information, but this is not financial advice and may contain errors. I did my best to re-confirm, disprove, and otherwise challenge my own assumptions to collect the most accurate data possible — including catching and resolving a contradiction between a live fintech's marketing and Plaid's own documentation. Where the data conflicts, I say so. Where I can't get data, I say that too.
Specific bank reauthentication frequencies are not published by Plaid or by the banks. The numbers below are observational, drawn from live integrators and user reports, and they conflict with each other in places. Treat them as a rough map of the terrain, not a guarantee about your specific account.
The question that started it
Currents Books — the bookkeeping product we build — deliberately uses uploaded bank statements instead of live bank feeds, because live feeds through Plaid disconnect, produce duplicates on reconnect, and create support load. But clients ask: can't we just connect our bank automatically? So I wanted to know whether there's a subset of Canadian banks that stay connected reliably — the ones that use OAuth (bank-managed consent, long-lived tokens) instead of credential-scraping (Plaid stores your password and logs in on your behalf). If the OAuth banks were the major ones, we could offer live feeds for just those and avoid the churn.
The short answer turned out to be: there are no OAuth-native major Canadian banks on Plaid. The longer answer is below, plus what changes when Canada's new open-banking law becomes operational.
How I ran the experiment
Two phases, designed to cross-check each other:
- Plaid Sandbox API scan. I paged through Plaid's
/institutions/getendpoint forcountry_codes: ['CA']and recorded theoauthboolean, supported products, and status for every Canadian institution Plaid knows about. This is ground truth from Plaid's own API — not a third-party list. - Primary-source web research. I read Plaid's own documentation (institutions API, OAuth, item-status errors, duplicate-items, transactions/sync), Plaid's consumer help center (which distinguishes OAuth, API, and credential-scraping connections), the FDX (Financial Data Exchange) press releases and member list, the Consumer-Driven Banking Act itself, the proposed regulations in the Canada Gazette, and a live Canadian fintech (Mozaic Finance) that publishes per-bank connection notes — specifically to cross-check claims against the API scan.
The cross-check is where it got interesting. More on that below.
What the scan found
Plaid knows about 198 Canadian institutions. Of those, only 2 are flagged oauth: true — and neither is a bank a real Canadian small business would use as their primary account:
| Institution | OAuth | Transactions product | Notes |
|---|---|---|---|
| Loop Financial (CA) | yes | yes | Small Canadian fintech |
| Wise (CA) | yes | yes | Money-transfer / multi-currency service |
Every Big-5 bank — RBC, TD, BMO, CIBC, Scotiabank — plus Tangerine, National Bank, Desjardins, EQ Bank, Wealthsimple, Laurentian, and ~190 credit unions and smaller institutions are credential-scraping on Plaid. That means Plaid stores the user's online-banking username and password, and logs in to the bank's website on a schedule (Plaid's docs say "between one and four times per day, depending on the institution") to scrape transactions.
This is the connection type that disconnects. Plaid's own docs list the triggers: the user changed their password, the user changed their MFA settings or an MFA token expired, the bank changed its login page, the bank's web session expired, or the bank detected unusual login patterns. None of these are scheduled — they're events. So "how long does a connection last" is really "how long until one of these events happens," which varies by bank, by user security settings, and by luck.
Reauthentication frequencies — what the data actually says
Here's where I have to be careful, because the published numbers conflict. I found three observational sources and they disagree with each other:
| Source | Claim | Confidence |
|---|---|---|
| Mozaic Finance (RBC page) | RBC ~90 days; "major Canadian banks converged on ~90 days" | Low — same source mislabels credential-scraping as "OAuth" (see below) |
| Mozaic Finance (supported-institutions page) | CIBC disconnects DAILY; Amex Canada disconnects DAILY | Medium — specific, from a live integrator, contradicts their own "90 days" generalization |
| OntarioLandlord docs | Re-auth "every 30-90 days" across banks | Medium — general range, no per-bank breakdown |
| Waypoint budget review | TD/BMO/Scotiabank/Tangerine = "rarely requires reauth"; RBC/CIBC = "occasional"; National/Desjardins/credit unions = "frequent" | Medium — contradicts Mozaic's "RBC = 90 days reliable" |
| Stack Overflow (real users, Plaid staff confirmed) | Some users get ITEM_LOGIN_REQUIRED hourly with perpetual-OTP 2FA enabled | High for the worst case |
The Mozaic-vs-Waypoint conflict on RBC is the telling one: Mozaic says RBC is a clean 90-day cycle; Waypoint puts RBC in the "occasional reauth" tier, below TD/BMO/Scotia. They can't both be right, which means real RBC behavior is variable enough that different observers experience it differently — exactly what you'd expect from event-driven reauth.
The Big 5, synthesized honestly
Synthesizing all sources with their conflicts, here's a defensible characterization — but note these are reliability tiers, not guaranteed day counts:
| Bank | Best characterization | Source agreement |
|---|---|---|
| TD Canada Trust | Most reliable tier; weeks-to-months between reauths typically | Mozaic (~90d) + Waypoint ("rarely") agree |
| BMO | Most reliable tier; weeks-to-months | Waypoint ("rarely"); no contradicting data |
| Scotiabank | Most reliable tier; weeks-to-months | Waypoint ("rarely"); no contradicting data |
| RBC Royal Bank | Middle tier; ~90 days typical but 2FA is a hard blocker | Mozaic (~90d) vs Waypoint ("occasional") conflict; Mozaic separately admits RBC 2FA breaks the connection entirely |
| CIBC | Outlier — daily disconnects reported | Mozaic ("disconnects daily"); Waypoint says "occasional" — conflict, but the daily claim is specific and concerning |
CIBC is the outlier you'd want to drop from any "median," and it's a Big-5 bank. That's a problem for client communication, because you can't quietly exclude one of the five most common banks.
Median range for institutions outside the Big 5
For the other ~190 institutions (credit unions, National Bank, Desjardins, EQ Bank, Wealthsimple, Tangerine, Laurentian, etc.): dropping the daily-disconnect outliers (CIBC, Amex) and the perpetual-OTP worst case, the defensible median range is roughly 30-90 days, with credit unions and smaller institutions trending toward the shorter end. But "median" is misleading here because the distribution is bimodal: most institutions cluster around 60-90 days, with a long tail of institutions that disconnect weekly or daily.
The contradiction I had to resolve
Mozaic Finance — a live Canadian net-worth tracker — claims on their website that RBC, TD, Scotiabank, BMO, CIBC, and National Bank all connect "through Plaid's modern OAuth flow" with ~90-day reauth. This contradicted both Plaid's own docs and my Sandbox scan, which showed zero Big-5 banks flagged as OAuth.
So I dug in. Mozaic is mislabeling credential-scraping as "OAuth" in their marketing. Evidence from Mozaic's own RBC page:
- "You enter your RBC client card number and password there, the same credentials you use on RBC online banking" — this is credential entry, not OAuth. Real OAuth redirects you to
rbcroyalbank.comto log in; you never enter credentials in a Plaid-hosted form. - "If your RBC profile uses two-step verification, Plaid Link prompts you for the one-time code during setup" — Plaid is handling the 2FA challenge, which means Plaid is driving the login (credential-scraping), not RBC (OAuth).
- "Canadian bank connections re-confirm access every few months (roughly ninety days)" — this is consistent with credential-session expiry, not OAuth refresh-token rotation. OAuth refresh tokens typically last months to years; 90-day reauth is the signature of a scraped session that the bank expires.
Plaid's own consumer help center is unambiguous about the distinction. They define three connection types: OAuth ("you will be redirected to your financial institution's website... Plaid does not store account credentials"), API (a variant where Plaid connects without storing credentials), and Non-OAuth ("you may be asked to authenticate... by providing your bank account login credentials directly to Plaid. We store those credentials"). Every major Canadian bank on Plaid is the third type.
And Plaid's OAuth documentation page states it directly: "OAuth connections are used universally by financial institutions in the UK and EU, are used by a number of financial institutions, especially larger ones, in the United States, and are not currently used by financial institutions in Canada."
This matters because it means the 90-day reauth churn Mozaic describes is the credential-scraping churn — not a sign that Canadian banks have stable OAuth connections. Mozaic's own documentation is evidence for the thesis that Canadian Plaid connections are unreliable, not against it.
What changes when the Consumer-Driven Banking Act lands
Here's the part that actually changes the answer — and it's recent. Canada's Consumer-Driven Banking Act received royal assent on March 26, 2026, as part of Bill C-15 (the Budget 2025 Implementation Act). It establishes a federal framework, overseen by the Bank of Canada, that lets consumers and businesses direct that their financial data be shared with accredited service providers of their choice.
The Act's stated purpose is explicitly to address the risks of screen scraping — the same credential-scraping mechanism every Canadian bank on Plaid uses today. The legislative text says the framework is meant "to promote financial sector competition, establish secure and efficient financial data sharing, and address the risks posed by screen scraping."
But the Act is legislated, not yet operational. The proposed Consumer-Driven Banking Regulations were published in the Canada Gazette on June 27, 2026, with a 60-day public comment period ending August 26, 2026. The regulations prescribe the accreditation process (a C$2,500 accreditation fee plus ongoing annual assessment fees), security requirements, consent rules, liability framework, and technical standards. Once the comment period closes and the regulations are finalized, the Bank of Canada has to accredit participants and banks have to expose endpoints.
Realistic operational timeline: late 2026 to 2027, optimistically. The framework doesn't turn on the day the regulations are finalized — accreditation, endpoint rollout, and onboarding all take time.
What the CDB Act actually changes
When the framework goes live, three things change for anyone connecting a Canadian bank to an app:
- Screen scraping gets replaced by API access. Accredited participants (banks, fintechs, aggregators) will be required to expose and consume API-based data access — likely aligned with the FDX (Financial Data Exchange) API standard, which is already the de facto Canadian technical standard with 130M+ consumer accounts connected via it as of early 2026. The credential-scraping era, where Plaid stores your bank password, should end for participating institutions.
- Consent becomes time-bounded and revocable through a standard mechanism. The Act requires participating entities to renew a consumer's express consent within seven days of the consent period ending — meaning reauthentication becomes a regulated, predictable event rather than an unpredictable session expiry. You'll know when reauth is coming because the framework requires it to be surfaced and renewed, not discovered when the connection silently breaks.
- Accreditation becomes a gate. A fintech or aggregator can't just connect to a bank — it has to be accredited by the Bank of Canada, pay the fees, and meet security and reporting requirements. This is a higher bar than today's "sign up for Plaid and go," but it's also a trust signal: an accredited participant has been vetted.
What it doesn't automatically change: whether Plaid specifically is the path. Plaid is an FDX founding member and will likely seek accreditation, but the framework also enables direct bank-to-fintech API access without an aggregator in the middle. For a small bookkeeping product, the right integration path post-CDB might be a CDB-accredited aggregator (Plaid, Flinks, Yodlee) or direct FDX endpoints — that decision depends on accreditation costs and per-bank coverage, which won't be clear until the framework is live.
So what does this mean for connecting a Canadian bank today?
If you're a small business (or you build software for one) and you want to connect a Canadian bank account to an app through Plaid today:
- Expect to reauthenticate every 1-3 months for most banks. TD, BMO, and Scotiabank trend toward the longer end; RBC is in the middle; CIBC and some smaller institutions can be much worse. This is a rough range, not a guarantee — a password change or a 2FA reset will trigger reauth immediately regardless of the bank.
- Two-factor authentication makes things worse, not better, for connection stability. You should still keep 2FA on for your bank account (it protects you from account takeover). But know that it increases reauth frequency, and some banks' 2FA implementations break Plaid connections entirely (Mozaic reports this for RBC). The CDB framework's standardized consent-renewal should fix this; today's credential-scraping doesn't handle it cleanly.
- The connection is not a replacement for your statements. Because reauth is event-driven and disconnects can last until you notice and re-authenticate, a Plaid feed can silently go stale. For bookkeeping — where missing a transaction means wrong books — the reliable path is still uploading your statements. A live feed is a convenience layer on top, not the source of truth.
- This all changes when the CDB framework goes live. Late 2026 to 2027, Canadian banks will be required to expose API-based, consent-driven access. At that point, reauthentication becomes a predictable, regulated event instead of an unpredictable session expiry, and the credential-scraping churn should end for participating institutions.
Caveats and what I couldn't verify
- Sandbox vs. Production. My API scan was against Plaid Sandbox, not Production. Plaid's docs strongly suggest Production matches (no Canadian OAuth institutions), and Plaid's own published statement about Canada supports this, but a Production scan would be definitive. The scan script is open and re-runnable with Production credentials if anyone wants to confirm.
- The landscape changes. Plaid could add a Canadian OAuth institution next month, or a bank could migrate. The scan has a timestamp; re-run it quarterly if this matters to your product.
- CDB timeline is uncertain. The comment period ends August 26, 2026, but finalization and Bank of Canada accreditation could take longer than the optimistic "late 2026" estimate. Don't build to a CDB timeline until the regulations are finalized.
- Per-bank reauth numbers are observational, not official. No bank publishes "we disconnect Plaid every X days." The numbers here are from live integrators and user reports, and they conflict. I've flagged the conflicts rather than picking a number.
- Mozaic's marketing is misleading but not unique. Other Canadian fintechs may also describe credential-scraping as "OAuth." When evaluating any Canadian fintech's bank-connection claims, check whether they describe redirect-to-bank-domain (real OAuth) or enter-credentials-in-our-form (credential-scraping). The
oauthflag on Plaid's institution record is the ground truth.
Research artifacts (raw institution scan, full writeup, re-runnable scan script) are in the docs/research/ directory of the currentsbk.ca repository. This post is a summary; the full methodology and source links are there.