Financial Data Exchange|FAQs
Financial Data Exchange | FAQsEN
Financial Data Exchange | FAQs English Financial Data Exchange | FAQs Français (Canada)

Sign in

Home » About » FAQs

About FDX

Our MissionLeadershipFDX Work StreamsOFX Work GroupUS Tax DataPoliciesFAQ

FAQ

FDX is a nonprofit organization operating in the US and Canada that is dedicated to unifying the financial services ecosystem around a common, interoperable, and royalty-free technical standard for the secure and convenient access of permissioned consumer and business financial data, aptly named the FDX Application Programming Interface (FDX API). FDX is governed by a diverse board of directors from across the financial services ecosystem, and FDX has a global membership that includes financial institutions, financial data aggregators, fintechs, industry utilities, payment networks, consumer groups, financial industry groups and other stakeholders involved user-permissioned financial data sharing.

All FDX members are given the opportunity to participate in the development, growth, and industry adoption of the FDX API and other objectives through FDX working groups and task forces.

The FDX board of directors is comprised of sustaining member financial institutions, financial data aggregators, permissioned parties, and financial industry groups within the user-permissioned financial data sharing ecosystem. Each board group maintains a consistent number of voting seats on the board. The FDX board will oversee and direct all aspects of the development and deployment of the FDX technical standards and will set other objectives as needed.

Tiered membership opportunities are available to any interested parties within the user-permissioned financial data sharing ecosystem. Most FDX members are stakeholders in the financial services arena and include financial institutions, financial data aggregators, fintechs, industry utilities, payment networks, consumer groups and non-profit financial industry groups. Specific information about membership tiers, pricing and enrollment can be found on the FDX Membership page.

FDX supports the FDX API (formerly Durable Data API, or DDA) standard.

The FDX API began under the stewardship of the FS-ISAC and offers secure authentication with a restful API for data access to accommodate existing protocols. Upon the public launch of FDX in October 2018, FS-ISAC assigned the DDA to FDX and renamed it the FDX API. FDX recently released version 5.2 of the FDX API and some of the largest financial institutions in the world have implemented the FDX API standard.

FDX supports broad migration of the industry to a common standard to provide consumers and business a convenient, safe, and reliable method to access their financial records. The Open Financial Exchange (OFX) joined FDX in 2019 as an independent working group, with the goal of aligning all users to a single interoperable standard built on the most cutting-edge data specification, security, and authentication protocols. All existing implementations of OFX will continue to be supported, and users of OFX will have assistance to migrate to the FDX API standard at an appropriate juncture, such as during a technology refresh. FDX understands that this migration will take time and that other records access methods will continue to be used during the migration.

The FDX API standard is fully predicated on user permissioned access to financial data. In other words, no financial records will be accessed or shared through the FDX API standard without a user’s full permission and control.

In addition, FDX is committed to five core principles of user permissioned data sharing which serve both as operating principles for FDX, as well as guidelines for the financial services ecosystem on the essential elements of a secure, transparent, and consumer-first approach to the sharing of financial data. The Five Core Principles of Data Sharing – Control, Access, Transparency, Traceability, and Security – are derived from and influenced by a diverse group of thought leaders in the financial industry as well as regulatory entities and worldwide standards bodies.

The Five Core Principles of Data Sharing are Control, Access, Transparency, Traceability, and Security. They are embodied in the development and adoption of the FDX API standard and empower end users to better understand, leverage, and benefit from their own financial data in a secure, reliable, and user-centric manner.

Control: End Users should be able to permission their financial data for services or applications.
Access: End Users should have access to their data and the ability to determine which entities will have access to their data.
Transparency: Individuals using financial services should know how, when, and for what purpose their data is used. Only data that is required to provide such services should be shared with the organization providing the service.
Traceability: All data transfers should be traceable. Consumers should have a complete view of all entities within the user-permissioned financial data ecosystem that are involved in the data sharing flow.
Security: Financial data parties should follow industry best cybersecurity practices across the whole of their organization for safety and privacy of data during access and transport and when that data is at rest.

User control and permissioning of data is being strengthened by the FDX API standard because the financial data ecosystem is unifying around a common interoperable data standard rather than a patchwork of data access tools that are often plagued by lack of interoperability, inconsistent data connectivity, quality, and governance. In addition, FDX’s User Experience Working Group is further strengthening control and permissioning mechanisms by continuing to develop and enhance focus group-tested user experience guidelines, which make granting, modifying, and revoking data access an intuitive and seamless experience.

Akin to the world before the Bluetooth Core Specification allowed wireless devices to seamlessly connect to one another, data standardization ensures an inclusive and secure environment that empowers consumers to better access data across financial accounts and use that data to better manage their finances and improve their financial health.

The FDX API is available on the FDX website without charge for parties that accept the terms and conditions of the FDX API License Agreement. In addition, FDX membership also allows financial services stakeholders to participate in the FDX consortium, join and vote in over 25 different working groups and task forces, attend FDX’s bi-annual Global Summits and take part in the ever-growing network of financial industry organizations that are adopting and implementing the FDX API.

The FDX API standard provides the tools for secure and reliable financial records access and thus supports best practices for privacy. It is the responsibility of each organization to comply with all government regulations related to privacy. FDX makes no representations that it is GDPR-compliant.

FDX is currently focused on the United States and Canada, but many FDX members are global organizations and FDX is engaged in ongoing dialogue and work with other standards bodies to collaborate on innovation and implementation of best practices.

Developing the FDX API alone will not promote, drive adoption, or guarantee adherence to the standard. Consequently, a qualification and certification program are needed to ensure common implementation and interoperability of any technical standard and further limits the risk of data inaccuracy. Products (i.e., programs, services, and apps for consumer permissioned financial data sharing) can be approved by a certification program to test the technical compatibility/interoperability, prior to being marketed as a compliant product, or getting access to certain intellectual property rights.

FDX is continuing to define and build out this qualification and certification program for implementation of the FDX API standard. FDX recently released foundational requirements covering availability, performance, and security that implementations of the specification must meet and FDX has established a formal Qualification and Certification Working Group to explore the matter further.

FDX technical standards can be tailored to accommodate regulatory requirements at any level of government. FDX is, by charter, neutral on the “what” of regulatory policy in this area and rather seeks to implement technical standards to accomplish the “how” of user-permissioned data sharing in a way that is responsive to market needs as well as any legal or regulatory compliance requirements.

FDX reflects the commitment of its members to provide secure and reliable access to financial records and advocates best practices for consumer transparency and consent (Five Core Principles of Data Sharing). In this, FDX reflects the industry unifying to adopt consumer protection principals that have been advocated by regulators and government agencies to date. In addition, FDX will continue to engage and work with regulators and policymakers to ensure that FDX standards provide the best technical pathway to accommodate any legislative or regulatory requirements in a given jurisdiction.

FDX is the result of years of work among all parties in the financial services ecosystem and has shown that unified commitment to common standards has served to resolve previous conflicts that have existed. All the members of FDX are deeply committed to providing value to the businesses and consumers that interact with all the members of FDX and are committed to building a consumer centric data sharing economy.

Small fintechs and small financial institutions face unique challenges. Limited human, financial and technical resources create barriers to reaching customers and connecting to the broader financial services ecosystem

With this in mind, a non-profit standards body and a common API standard offers many benefits to small entities. First, a common interoperable standard informs the product offerings of technology service providers so that even the smallest financial institutions are able to experience and offer their customers the same common API powered services, tools and protections that are available to larger financial institutions at a fraction of the cost. Secondly, a market-led standard consortium eases the path to market and partnership by bringing the full spectrum of the financial services ecosystem together in one place and making participation and engagement very affordable. Such a model allows small fintech firms to bring innovative ideas forward so that they can be implemented in the marketplace rapidly for consumers to use their own financial data in new ways. Finally, FDX’s open membership structure allows all entities, regardless of size, to benefit and contribute to the FDX API via FDX working groups and task forces in a manner that crowdsources common industry problems and solutions and where every member’s vote is equal.

Architecture

• OpenAPI – (OpenAPI 3.1.x or later), published in standard YAML format.
• REST – RESTful (Representational State Transfer) APIs over HTTPS
• JSON – FDX Schema Objects using JSON Schema 2020-12
• HATEOAS Links – (Hypermedia as the Engine of Application State) for contextually related properties
• Unicode UTF-8 payload in JSON Objects
• REST API Design Best Practices withJSON as the Request Response format

Security and Authentication

• HTTPS –
    • HTTP (as per IETF RFCs 7230 and RFC 7231)
    • HTTP Response, Status, and Error Codes
• TLS over HTTPS – (TLS version 1.2 or higher is mandated)
• FAPI – (FAPI 1.0 Advanced + CIBA and FAPI 1.0 Baseline) from Open ID Foundation
    • OIDC Core (part of FAPI 1.0)
• MTLS Sender Constrained Tokens – (Mutual TLS is part of FAPI 1.0)
• OAuth 2.0 Authorization Framework (IETF RFC 6749)
    • OAuth 2.0 Authorization Framework: Bearer Token Usage (IETF RFC 6750)
    • OAuth 2.0 Dynamic Client Registration (IETF RFC 7591)
    • OAuth 2.0 Step-up Authentication Protocol (IETF draft)
    • OAuth 2.0 Pushed Authorization Requests (IETF RFC 9126)
• JSON security
    • JSON Web Signature (JWS) (IETF RFC 7515)
    • JSON Web Encryption (JWE) (IETF RFC 7516)
    • JSON Web Key (JWK) (IETF RFC 7517)
    • JSON Web Algorithms (JWA) (IETF RFC 7518)
    • JSON Web Token (JWT) (IETF RFC 7519) and Nested JWT for message encryption
    • JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants (IETF RFC 7523)
• FIDO – FDX Control Considerations recommends FIDO for all biometric SCA/MFA
• NIST – FDX Control Considerations is based on the NIST Cyber Security Framework (CSF)

(Disponible en français)

FDX is a nonprofit organization operating in the Canada and the US that is dedicated to unifying the financial services ecosystem around a common, interoperable, and royalty-free technical standard for the secure and convenient access of permissioned consumer and business financial data, aptly named the FDX Application Programming Interface (FDX API). FDX is governed by a diverse board of directors from across the financial services ecosystem, and FDX has a global membership that includes financial institutions, financial data aggregators, fintechs, industry utilities, payment networks, consumer groups, financial industry groups and other stakeholders involved user-permissioned financial data sharing.

All FDX members are given the opportunity to participate in the development, growth, and industry adoption of the FDX API and other objectives through FDX working groups and task forces.

The FDX Canada Working Group includes Canadian financial institutions, fintechs, payment networks and data aggregators who are coming together with the purpose developing and adapting the FDX API financial data sharing standards for the Canadian market. The FDX Canada working group also has two related task forces. The FDX Canada Technical task force is responsible for adapting the FDX technical specifications for application in the Canadian market and the FDX Canada Government and Regulatory Engagement task force helps organize and guide FDX’s educational interactions with Canadian government representatives, policymakers, regulators, and industry stakeholders.

The FDX Canada Working Group is open to all Canadian financial industry participants involved in secure consumer-directed finance and will work within FDX to help ensure that uniquely Canadian market requirements are accurately reflected in the development and maintenance of the FDX API standard.

FDX is developing a secure and interoperable international API standard for consumer data sharing. Consequently, launching the FDX Canada Working Group gives any Canadian market participant involved in consumer-directed finance the opportunity to be engaged in defining this standard and ensuring it is responsive to the needs of Canadian consumers. Further, being a part of FDX offers Canadian financial institutions, fintechs, payment networks, data aggregators, and other interested parties the chance to work together to make consumer data sharing more secure and consumer centric in Canada.

There are currently 70+ FDX member financial services organizations operating in Canada and participating in the FDX Canada working group listed here.

FDX Canada is an industry-led initiative that is complementary to the Canadian Government’s ongoing consultation on open banking and secure consumer-directed finance in Canada. FDX believes the full spectrum of the Canadian financial industry is best positioned to come together to develop and implement the FDX API data standard because the standard itself is flexible and can be tailored to different environments.

In accordance with FDX’s structure of shared leadership between financial institutions and non-financial institutions, the FDX Canada working group is Co-chaired by Equifax Canada and CIBC. In addition, FDX Canada working group members are given the opportunity to participate in the development and growth of the FDX API standard and other objectives through other FDX working groups. Finally, Royal Bank of Canada and Interac Corp. are members of FDX’s Board of Directors as representatives of the FDX Canada working group.

The FDX board of directors is comprised of sustaining member financial institutions, financial data aggregators, permissioned parties, and financial industry groups within the user-permissioned financial data sharing ecosystem. And as mentioned above, Equifax Canada and National Bank of Canada are members of the board as representatives on behalf of the FDX Canada Working Group.

Each board group maintains a consistent number of voting seats on the board. The FDX board will oversee and direct all aspects of the development and deployment of the FDX technical standards and will set other objectives as needed.

In today’s global economy, technical standards must be international in nature and interoperable in a multitude of jurisdictions and regulatory environments. Further, pursuit of an international standard rather than jurisdiction-specific standards ensures that the Canadian financial industry can immediately contribute to and learn from an international consortium rather than seeking to “reinvent the wheel.” The FDX Canada Working Group represents a unique opportunity for the Canadian financial industry to have an influential seat at the table of a global technical standard.

The FDX API (formerly Durable Data API, or DDA) standard began under the stewardship of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and offers secure authentication with a restful API for data access to accommodate existing protocols. At the public launch of FDX in October 2018, FS-ISAC assigned the DDA to FDX and renamed the FDX API.

With the standard now being a made in Canada solution with all of the Canada specific changes now in place, many FDX Canada member firms have already begun implementing the FDX API. Overall implementation timing will be tied to progress of the Department of Finance and the continued development of the FDX API technical standard in Canada and the needs of Canadian consumers.

User control and permissioning of data is being strengthened by the FDX API standard because the financial data ecosystem is unifying around a common interoperable data standard rather than a patchwork of data access tools that are often plagued by lack of interoperability, inconsistent data connectivity, quality, and governance. Specifically, the FDX API allows for users to be securely authenticated without the sharing or storing of their login credentials with third parties. In addition, FDX’s User Experience Working Group is further strengthening control and permissioning mechanisms by continuing to develop and enhance focus group-tested user experience guidelines, which make granting, modifying, and revoking data access an intuitive and seamless experience.

Akin to the world before the Bluetooth Core Specification allowed wireless devices to seamlessly connect to one another, data standardization ensures an inclusive and secure environment that empowers consumers to better access data across financial accounts and use that data to better manage their finances and improve their financial health.

FDX is currently focused on Canada and the United States, but many FDX members are global organizations and FDX is engaged in ongoing dialogue and work with other standards bodies to collaborate on innovation and implementation of best practices.

Small fintechs, financial institutions and credit unions face unique challenges. Limited human, financial and technical resources create barriers to reaching customers and connecting to the broader financial services ecosystem

With this in mind, a non-profit standards body and a common API standard offers many benefits to small entities. First, a common interoperable standard informs the product offerings of technology service providers so that even the smallest financial institutions are able to experience and offer their customers the same common API powered services, tools and protections that are available to larger financial institutions at a fraction of the cost. Secondly, a market-led standard consortium eases the path to market and partnership by bringing the full spectrum of the financial services ecosystem together in one place and making participation and engagement very affordable. Such a model also allows small fintech firms to bring innovative ideas forward so that they can be implemented in the marketplace rapidly for consumers to use their own financial data in new ways. Finally, FDX’s open membership structure allows all entities, regardless of size, to benefit and contribute to the FDX API via FDX working groups and task forces in a manner that crowdsources common industry problems and solutions and where every member’s vote is equal.

Foire aux questions sur FDX Canada

Financial Data Exchange LLC (FDX) est une organisation sans but lucratif qui œuvre pour que le secteur financier se fédère autour d’une norme (FDX API) commune, sécuritaire, interopérable et libre de droits en finances axées sur les clients et autour de la consultation sécuritaire de données financières autorisées des entreprises et des particuliers.

Le groupe de travail de FDX Canada réunit des institutions financières canadiennes, des entreprises de technologie financière, des réseaux de paiement et des agrégateurs de données afin d’évaluer et de développer le potentiel d’utilisation de la norme FDX API au Canada. Ouvert aux intervenants du secteur financier qui travaillent pour des finances sécurisées axées sur les clients, ce groupe de travail collaborera avec FDX pour que les besoins du marché canadien soient bien pris en compte dans la norme FDX API et ses mises à jour.

FDX met au point une norme API sécuritaire, interopérable et internationale sur la transmission sécuritaire de données. Le lancement du groupe de travail FDX Canada donne ainsi aux intervenants du secteur financier qui travaillent pour des finances sécurisées axées sur les clients, la chance de participer à la définition de cette norme et de l’adapter à leurs besoins. De plus, les institutions financières canadiennes, les entreprises de technologie financière, les réseaux de paiement, les agrégateurs de données et les autres parties peuvent collaborer à davantage sécuriser la transmission des données au Canada et à l’orienter vers le client.

À l’heure actuelle, 31 organisations financières participent au lancement de FDX Canada : Blanc Labs, Banque de Montréal, Banque Nationale du Canada, Banque Royale du Canada, Banque TD, Capital One, CIBC, Desjardins, EEI, Envestnet | Yodlee, Equitable Bank, Finicity, FinTech Growth Syndicate (FGS), Flinks, Interac Corp., Intuit Canada, Inverite, KOHO, Mastercard, MX, Ninth Wave, Ozone API, Plaid, SecureKey, Simplii Financial, Tangerine, TrueLayer, TWG, Verify My Banks, Visa et Xero.

FDX Canada est une initiative du secteur privé, complémentaire aux consultations du ministère sur des finances sécuritaires axées sur les clients au Canada. FDX croit important de regrouper l’ensemble du secteur financier canadien pour établir et mettre en œuvre la norme FDX API, puisque celle-ci est flexible et peut être adaptée à différents environnements.

Conformément à la structure d’autorité partagée entre institutions financières et non financières, le groupe de travail de FDX Canada est coprésidé par Interac Corp. et la Banque TD. De plus, les membres du groupe de travail de FDX Canada peuvent participer à définir et à populariser la norme FDX API avec d’autres groupes de travail de FDX. Enfin, la Banque Royale du Canada et Interac Corp. siègent au conseil d’administration de FDX en tant que représentants du groupe de travail de FDX Canada.

Composé de membres de divers milieux et pays, le conseil d’administration réunit institutions financières, agrégateurs de données, entreprises de technologie financière, réseaux de paiement, groupes de protection des consommateurs, groupes du secteur financier et autres parties autorisées de l’écosystème des finances axées sur les clients. Comme mentionné précédemment, la Banque Royale du Canada et Interac Corp. siègeront au conseil d’administration en tant que représentants du groupe de travail de FDX Canada.

Dans une économie mondialisée, les normes techniques doivent être internationales, mais aussi interopérables avec une multitude de systèmes juridiques et de réglementations. De plus, miser sur la création d’une norme internationale plutôt que nationale, c’est donner au secteur financier canadien la chance de collaborer d’emblée avec un consortium international au lieu d’avoir à réinventer la roue.

Le groupe de travail de FDX Canada représente une occasion unique pour le secteur financier canadien d’être un acteur international important dans l’élaboration d’une grande norme technique.

D’abord élaborée sous la conduite du Financial Services Information Sharing and Analysis Center (FS-ISAC), la norme FDX API, précédemment connue sous le nom de Durable Data API ou DDA, propose une authentification sécurisée avec API RESTful pour la consultation de données conformément aux protocoles actuels. Au lancement public de FDX en octobre 2018, FS-ISAC a attribué la DDA à FDX et l’a renommée FDX API.

Son calendrier de mise en œuvre dépendra du développement de la norme technique FDX API au Canada et des besoins des particuliers canadiens.

Le contrôle et l’autorisation des données peut être renforcé par l’adoption de FDX API.
Avec la norme FDX API, les utilisateurs dans les marchés axés sur les clients peuvent être authentifiés en toute sécurité sans transmettre leurs identifiants de connexion à des tiers. Grâce à l’adoption généralisée de la FDX API, il est possible de transmettre les données autorisées par les particuliers entre les institutions financières, les applications d’entreprise de technologie financière, les agrégateurs de données financières et les réseaux de paiement et le crédit en ligne de façon plus sécuritaire et fiable.

Semblable à ce qui se passait avant que Bluetooth autorise la connexion directe entre appareils sans fil, l’uniformisation des données permettra aux Canadiens de mieux consulter leurs comptes financiers et d’avoir une meilleure gestion de leurs finances et de leur santé financière.

FDX concentre d’abord ses efforts aux États-Unis et au Canada, mais beaucoup de ses membres sont des organisations internationales. Elle collabore également avec d’autres organismes de normalisation sur l’innovation, l’interopérabilité et la mise en œuvre de bonnes pratiques.

Les institutions financières de toutes tailles sont les bienvenues. La structure d’adhésion ouverte de FDX permettra à toutes les institutions financières et les fintech, sans égard à leur taille, de bénéficier et de contribuer au développement de FDX API via les groupes de travail de FDX.

If you are involved in enabling consumer financial data sharing (e.g., as a bank, aggregator, fintech, or other firm), then the consensus standard(s) issued by FDX—as a recognized standard-setting body—can help you to comply [and evidence compliance] with certain requirements under the CFPB’s final 1033 rulemaking.

This recognition also reflects FDX’s central role in the ecosystem and its ongoing commitment to being open, balanced, and responsive to diverse stakeholders. If you are not already part of FDX—the preeminent community and technical standards body for Open Banking in North America—consider learning more about how FDX can help your organization.

Under the CFPB’s recently published Open Banking regulation (the Required Rulemaking on Personal Financial Data Rights), a “recognized industry standard-setting body” can issue consensus standards that companies can use to help them comply with certain requirements in the CFPB’s Rulemaking.

FDX remains committed to its core principles and mission. This CFPB recognition will help FDX to better serve members who are subject to 1033 obligations. At the same time, FDX will continue to facilitate standard-setting and collaboration for use cases, account types, and best practices that lie outside of 1033 compliance.

FDX intends to define a consensus standard “data format” as described in the Rule.

FDX will also continue to evaluate other roles it may play in the ecosystem. FDX will continue adapting the full FDX API specification over time, including to meet evolving market needs.

Today, FDX has an API technical standard that is used to facilitate safer data sharing for over 94 million consumer accounts in North America, with adoption continuing to grow.

FDX’s full API specification covers multiple topics, account types, and data elements, some of which extend beyond what will be required under the final 1033 rule.

In the wake of the CFPB’s final Rulemaking in October 2024, FDX is in the process of updating its standards to more fully align and support compliance with relevant portions of the 1033 Rulemaking.

FDX is aiming to issue a consensus standard relevant to 1033 compliance for data formatting in early 2025.

Yes. In June 2024, the CFPB published a list of attributes that standard-setting bodies must demonstrate to be recognized: openness, balanced decision-making, consensus, due process and appeals, and transparency. FDX submitted an application to the CFPB describing how its governance and processes meet these criteria. FDX is committed to maintaining adherence to these attributes going forward so that FDX standards reflect input from diverse stakeholders.

FDX is aligned with meeting the CFPB’s conditions for recognition. The process to implement several revised policies or practices is either complete or well underway.

Use of standardized methods helps companies to build interoperable interfaces more easily. This can help reduce costs, simplify integration with other parties, create more unified and reliable consumer experiences, and—now—aid in regulatory compliance.

Regulatory requirements and compliance deadlines are a key consideration for many FDX members. FDX is committed to remaining adaptable and responsive to member needs. FDX has a track record of evolving to meet changing market forces and will adapt to any regulatory changes that may come in the future.

FDX welcomes organizations and stakeholders across the financial ecosystem to join its member community. Membership is open to individuals and organizations of all sizes and provides the opportunity to collaborate with others who are working to implement safer data sharing, while influencing the standards that will shape the evolution of open banking and open finance in the years ahead. Learn more about membership here.

Any change to the FDX API Specification is packaged up in a Request for Comment (RFC).

This follows the global best practices of standards bodies like the IETF and W3C.

RFC’s can come from a variety of sources. A new feature idea can come from any individual member with an idea. An idea may arise from a member of a task force, work group, committee, or the FDX board. In some cases the Strategic Planning Committee may see an immediate need for a new feature or correction, and will create an RFC that is prioritized.

RFC’s must be thoroughly vetted before being published into the FDX API Specification. The entire process is as follows:

Approval for work > Drafting > Board Advisory Council>Work Group Review > Work Group Vote > TRC Ratification > Implementation > FDX Board Ratification Vote > Released

This ensures that all members get multiple chances to review and comment on any new feature before it is voted on and added to the FDX API.