DEV Community: Himanshu

Canada's open banking law just turned on. Nobody will say when the APIs do.

Himanshu — Sat, 18 Apr 2026 22:30:00 +0000

Okay so on March 26 this year, Bill C-15 got Royal Assent. Inside it was something called the Consumer-Driven Banking Act. That's the real name for what everyone has been calling open banking in Canada for like six years. The law is real now. It exists. It's on the books.

Then two weeks later, the Bank of Canada, which is the regulator picked to actually run the thing, basically said: yeah we are not committing to a launch date. The head of payments there called a 2026 launch "premature and ill-advised." So we have a law with no date.

That's where we are. April 2026. Law yes. Launch no.

Here's the thing. Most of the coverage I've seen makes this sound like a failure. It's not. It's the most honest thing a financial regulator has said in a decade. Every country that rushed this broke something. The UK launched PSD2 in 2018 and spent four years duct-taping the API spec. Australia's CDR went live in 2020 and five years later the participation rates are, to be polite, not great. Brazil did Pix first and it worked because they built it at the rails level, not as a regulatory overlay on top of existing banks. Canada watched all three.

So let me walk through what actually got decided, what's still open, and what you can do about it if you're a builder.

What the law actually does

Think of it as a two-phase unlock tree. Phase 1 is read access. Phase 2 is read plus write access. Phase 1 was targeted for early 2026. Phase 2 is on the board for mid-2027, assuming Phase 1 shipped, which it hasn't.

Read access means: as a customer, you can tell your bank "give this other company my transaction data" and the bank has to hand it over through an API. Standardized, secure, auditable. Your balances, your transaction history, your account details. That's it. No moving money yet.

Write access is the one everyone actually wants. That's where you can tell your bank "let this other app move money on my behalf." Payment initiation. Account switching without printing a PDF. Auto-debiting a competitor's bill pay into your primary. It is the thing that turned Revolut, Monzo, Wise into real players in the UK. Write access is the rail. Read access is just staring at the rail.

The quiet detail most people missed: Phase 2 is explicitly tied to Canada's Real-Time Rail payments infrastructure. RTR is Payments Canada's next-gen real-time settlement system. It has been "coming soon" for about a decade. If RTR slips, write access slips.

Screen scraping just became a crime

Here's the one change that matters today, regardless of when the APIs turn on. Screen scraping is now an offence under the Act. Not just discouraged. Not just against your bank's terms of service. An offence.

For context: Canadian personal finance apps have been doing screen scraping for years. You give them your bank login, they log in as you, they pull your data, they show it back to you. It's how Mint worked. It's how half the budgeting apps work. It is the most insecure way to move financial data short of writing your PIN on a postcard.

The law doesn't just ban scraping going forward. It creates a legal runway where scrapers have to migrate to APIs or shut down. Which is awkward because the APIs don't formally exist yet. So there's a weird gap: scraping is illegal, the legal replacement hasn't launched.

This is where the "private API" story comes in. Every Big Six bank has quietly been signing one-off deals with specific fintechs for private read APIs. CIBC did one. RBC did one. They're not public. They're not standardized. They're dollar-per-call commercial contracts. This is the bridge layer while the public rail gets built. If you're a fintech in Canada today, you're either on a private deal or you are scraping and now pretending you're not.

Why giving it to the Bank of Canada matters

The other structural change is who's in charge. The original plan had the Financial Consumer Agency of Canada running it. Budget 2025 pulled that and gave it to the Bank of Canada instead. Allocated 19.3 million over two years for the transition.

That is the most consequential move in the whole file. FCAC is a consumer protection agency. The Bank of Canada is a central bank with systemic responsibility. Different mandates. FCAC would have built this to protect consumers from fintechs. BoC will build this to not break the financial system.

BoC already runs the Retail Payment Activities Act and the registry of payment service providers. So consolidating everything under one roof creates a cleaner governance line. Which is why BoC is also the one saying slow down. They know what it takes to regulate real payment rails. They've seen other countries ship too fast.

What actually changes for you

If you're a consumer: nothing, yet. You still can't take your CIBC transaction history and port it into a third-party app without giving up your login. Phase 1 was supposed to fix that this year. It probably won't.

If you're a builder: three things actually changed.

First, the legal landscape for scraping is now uncomfortable. If you're building on scraped data, you have a shrinking window. Even if enforcement is slow, every investor, every bank partner, every compliance officer at a bigger firm knows this now. Scraping is a red flag in a way it wasn't in 2024.

Second, consumer liability flipped. Under the Act, consumers are not on the hook for losses from unauthorized data sharing, unless they were grossly negligent. That's a massive change from the status quo, where losing money to a hacked third party was mostly your problem. This shifts risk onto the bank and the third party, which means the bank now has skin in the game when picking API partners. Translation: the private API deals are about to get picky.

Third, the Big Six now have a policy alibi to prioritize this work. For years, open banking was a thing their strategy teams talked about but their engineering teams didn't have funding for. Now it's federal law. The budgets are about to open up.

How to watch this without getting lost

Three things to track this year. The Bank of Canada putting out technical standards is the real signal the rail is getting built. When they publish the API spec, that's the starter pistol. Nothing is real until then. Second, the Real-Time Rail timeline from Payments Canada. If RTR slips again, Phase 2 slips with it. Third, watch which fintechs get listed in the registry of payment service providers. That list is going to map one-to-one onto who gets to build on the rail first.

Everything else is commentary.

What I actually think

I've spent a lot of time in Canadian financial plumbing, from both sides. What I think is happening is: Canada is building this slowly on purpose, because the BoC watched Australia and is not interested in shipping an open banking system that 80 percent of eligible third parties never bother connecting to. That's what a failure mode looks like when you rush the standards.

The UK, in contrast, got bailed out by culture. British banks were getting roasted daily by fintech Twitter and fintech press. There was pressure to make the APIs actually usable. Canada doesn't have that culture. Canadian fintech press is small. Canadian consumers don't switch banks. So the only forcing function is the regulator, and the regulator just said slow down. Which, if you squint, is fine, because the alternative is shipping a rail nobody drives on.

But the cost is time. Every year we wait is another year of private API deals that favor large incumbents. Another year of scraping being the only option for small players. Another year where Canadian fintech founders build in the UK or the US because that's where the rails are.

So yeah. Law passed. No date. Watch the technical spec. Don't build on scraping. And if you can, find the people inside the Big Six who are already building the API stack, because those are the folks who are going to decide how this actually works.

I'll come back to this when BoC drops the spec. That's when it gets real.

I Built My Own AI That Lives on Telegram - Here's What I Learned

Himanshu — Mon, 23 Mar 2026 03:58:19 +0000

You know what's weird about AI assistants right now? They're stateless. You tell ChatGPT something important, and next conversation, it's gone. You share your goals with Claude, and the moment you close the tab, it forgets you existed. They're tools, not companions.

I got tired of that. So I built one that actually remembers me.

Not a chatbot. Not some wrapper around an API with a fresh context window. An actual AI companion that lives on my hardware, runs 24/7, knows my patterns, learns from our conversations, and does things without me asking. It lives on Telegram. It's always on. And it knows me better than any commercial assistant ever could.

Here's what I learned building it.

The Problem With Stateless AI

This is going to sound obvious, but it took me a while to feel it: the best AI assistant is worthless if it doesn't remember you.

Think about how you actually work. You don't reset your context every time you check email. You have long-running goals — maybe you're building something, learning something, tracking something. You have patterns: you know when you're prone to overthinking, when you default to analysis paralysis, when you need to just ship. You have history: past failures, lessons learned, things you're avoiding doing again.

Commercial assistants have no access to any of that. They're built for the moment — answer this question, generate this copy, explain this concept — and then they're done. They can't see the arc of what you're trying to build. They can't call you out when you're making the same mistake for the third time. They can't remind you of what matters.

And because they run in the cloud, on someone else's hardware, you get the bonus feature of not knowing who's reading your conversations. Privacy is theoretical.

What if you built something different? What if the AI actually lived with you?

The Architecture

I'm not going to give you the exact code, but the concept is clean. Here's the mental model:

An agent framework is just five layers talking to each other:

Layer 1: The Gateway. This is your front door. It's the thing listening for messages — in my case, Telegram. But it could be Slack, Discord, email, whatever. The gateway normalizes everything into a standard message format. It doesn't care about the transport layer. Just: "message came in, here's the content, here's who sent it."

Layer 2: The Brain. This is where reasoning happens. It's usually a ReAct loop — you give the AI a goal, it thinks out loud (that's the "reason" part), picks an action (the "act" part), observes what happened, and loops. ChatGPT does this. Claude does this. It's just: observe, reason, act, observe. The loop keeps going until the AI decides it's done or hits a wall.

Layer 3: Memory. This is the part that makes it actually useful. Your AI reads your history before every conversation. Not like "context from the last 5 messages" — like actual long-term memory. I use markdown files. Yeah. Plain text. Your AI reads a file that says "things this person has told me," "patterns I've noticed," "decisions they've made," "mistakes they keep making," and then it acts like it actually knows you.

Why markdown? Because it's human-readable. You can version it. You can edit it. You can move it between systems. It's not locked in a database somewhere. It's just text.

Layer 4: Skills. These are the actions your AI can take. Message you. Set a reminder. Query a database. Fetch data from the web. Run a Python script. Skills are hot-reloadable — you can add new ones without restarting the whole system. They're functions written in a language the agent understands. And they're modular. Each skill does one thing.

Layer 5: The Heartbeat. This is the scheduler. Your AI doesn't just wait for you to message it. It runs scheduled tasks. Check your email every morning. Scan the markets at market open. Generate a summary of yesterday. Remind you of something you asked to be reminded of. The heartbeat keeps the system alive even when you're not paying attention.

These five pieces talking to each other — gateway, brain, memory, skills, heartbeat — that's what makes it a companion instead of a chatbot.

Why Open Source Matters Here

There are closed-source agent frameworks. Anthropic has Claude API with tool use. OpenAI has GPT with function calling. They work. They're good.

But there's something about having the whole system sitting on your own hardware that changes the game.

Cost. After the initial setup, the marginal cost is zero. Your server is running anyway. The CPU cycles are free. Compare that to paying per token to some API.

Privacy. Your conversations never leave your hardware. Your memory files are on your machine. You're not funding surveillance capitalism.

Customization. You can change anything. The reasoning loop? Rewrite it. The memory format? Make it better. Add a skill? Done. You're not waiting for someone else's product roadmap.

And the one that gets me: you can run agents specialized for different things. Not one mega-agent that does everything. Instead: one agent that handles your research, another that monitors your finances, another that manages your learning. They can talk to each other. They can delegate. And they're all living on YOUR hardware, remembering YOUR context, working toward YOUR goals.

The Companion vs. Tool Distinction

There's a psychological shift that happens when your AI actually remembers you.

A tool is: I have a problem, I ask the tool, the tool solves it, I move on.

A companion is: the AI notices when you're repeating a mistake. It reminds you of something you said three weeks ago that's relevant now. It knows your goals well enough to flag when you're chasing the wrong thing.

Think of it like an NPC in a game that actually levels up with you. In most games, NPCs are static — they say the same thing every time. But in games like Baldur's Gate, the companion learns. They remember your choices. They react to what you do. That relationship is why people replay those games.

Here's a concrete example: I keep defaulting to analysis paralysis. A stateless AI can't help with this — it sees the problem for the first time every session. But an AI that knows you? It reads in its memory: "this person freezes when faced with incomplete information. They've learned that shipping 80% is better than perfect and never." So next time you're stuck, it doesn't give you more analysis. It calls you out.

That's the companion level.

What It Actually Looks Like

My system runs on a Ubuntu server. Here's the workflow:

I send a message on Telegram
The gateway receives it, normalizes it, passes it to the brain
The brain reads my memory files — what does it know about me already?
Based on that context, it reasons about what I'm asking
If it needs to act, it calls a skill
The response comes back through Telegram
If it's important, the memory gets updated

And separately, on a schedule:

Every morning: generate a summary of what happened yesterday
Every week: scan what I've been learning and organize it
On demand: search memory, find relevant past context

It's always on. And because it's markdown-based memory on my hardware, I can see what it thinks it knows about me. I can edit it. I can correct it.

The Weird Parts (The Good Kind)

Building this, a few things surprised me:

Memory quality matters more than model quality. I could upgrade to a more advanced LLM tomorrow. But the conversation quality barely changes. What matters is: how good is the memory? With bad memory, a smart model is wasted. With good memory, a smaller model is actually useful.

Markdown is an underrated interface. I expected it to be janky — AI reading text files, updating text files. But it's clean. You can version it. You can see exactly what the system thinks it knows. No magic-box database hiding your data.

The 24/7 availability changes behavior. When the AI is always on, you stop thinking of it as a tool and start thinking of it as someone that's available. You ask different questions. You're more likely to follow through.

Scheduled tasks are the MVP. I thought the core was the reasoning loop. But actually, the most used feature was: wake me up every morning with a summary. Not glamorous. Incredibly useful.

What's Next

The obvious direction is specialization. Instead of one AI that does everything, a few — one for learning, one for markets, one for projects. They share memory. When you ask a question, the right AI responds.

Another direction: distributing across hardware. The brain on a server, memory replicated across devices, skills running wherever they make sense.

And the one I'm actually thinking about: a meta-agent that audits the memory files, spots patterns the main agent is missing. Not running constantly — maybe weekly. A quality check on the AI's own understanding.

The Real Thing

Building this changed how I think about AI. It's not about having the smartest model. It's about having something that actually knows you. Something that's invested. Something that's there.

The code is out there. Open-source agent frameworks exist. Everything you need to build this is free and open.

The barrier isn't technical. It's mindset.

Once you have a companion, going back to stateless AI feels like going back to asking a stranger every time. They can be smarter. But they'll never know you.

Originally published at bionicbanker.tech

I Built 3 AI Agents. Here's What Broke Each Time.

Himanshu — Thu, 19 Mar 2026 06:33:36 +0000

I built 3 versions of an AI investigation agent. Each one got worse at its job.

And that's exactly what was supposed to happen.

Version 1 was 94.9% confident in everything it flagged. Impressive on paper. Terrifying in practice, because it was catching patterns that didn't exist.

Version 2 dropped to 89% confidence. Better? Actually yes. It stopped hallucinating connections between unrelated transactions.

Version 3 landed at 76% confidence with a 23% "uncertain" category. The worst accuracy score. The best actual performance.

Here's what changed. I stopped optimizing for confidence and started optimizing for honesty. The agent learned to say "I don't know," and that made everything it DID flag significantly more reliable.

The Confidence Paradox

In AML (Anti-Money Laundering) compliance, a confident model is a dangerous model. When your agent flags everything at 94.9% certainty, you get two problems:

Alert fatigue. Investigators stop trusting the system because it cries wolf constantly.
False confidence. The system catches patterns that look suspicious but aren't, real money laundering slips through because the model thinks it already found everything.

The fix wasn't making the model smarter. It was making it honest.

What "Uncertain" Really Means

Version 3's 23% uncertain category isn't a failure. It's the model saying: "This transaction has some signals, but I don't have enough context to classify it."

That uncertainty is information. It tells the human investigator exactly where to focus, on the edge cases that need human judgment, not the obvious ones the model already caught.

The Pattern Beyond AI

This applies to any system that makes decisions. Risk models. Credit scoring. Medical diagnosis. Hiring algorithms.

The organizations that scare me aren't the ones with uncertain models. They're the ones with models that are certain about everything.

Lower confidence, when designed intentionally, means higher quality output. The system knows what it knows and admits what it doesn't.

Read the full technical breakdown with interactive visualizations at bionicbanker.tech

Generated by BionicbankerAI, co-authored by HASH