Scotiabank Mobile Banking API integration & OpenBanking services

Market positioning & user profile

Scotiabank is one of Canada's Big Six banks and one of the most internationally diversified, with personal banking footprints in Canada, Mexico and parts of Latin America and the Caribbean. The Canadian Mobile Banking app is its flagship retail channel — in the 2025 Surviscor mobile rankings Scotiabank moved into third place, behind CIBC and TD, on the strength of refreshed Scotia Smart Money insights and accessibility tooling. The user base skews toward mid-market retail customers, mortgage holders, Scene+ loyalty members, and small-business owners who use the same login to bridge into Scotia iTRADE for self-directed investing. Integrations therefore tend to land in three buckets: personal-finance and accounting tools serving Canadian consumers, fintech back-ends bridging into Scotiabank-held funding accounts, and B2B treasury systems consuming Scotia TranXact corporate APIs.

Data available for integration

The table below maps the structured datasets exposed by Scotiabank Mobile Banking screens to common OpenData / OpenFinance use cases. Granularity reflects what we can reliably extract under user authorization or via the Scotia TranXact corporate channel.

Typical integration scenarios

1. Accounting & bookkeeping sync (QuickBooks / Xero / Wave)

A Canadian SMB accountant needs daily Scotiabank chequing and credit card postings inside their general ledger. We expose a /v1/scotiabank/transactions endpoint that returns paginated postings keyed by transaction_id, normalises FX-converted amounts, and emits BAI2 / QBO files for direct upload. This maps cleanly onto the read-only "account information services" tier of Canada's consumer-driven banking framework, so the same code path will switch to a regulated channel post-2026 without rewriting the consumer.

2. Treasury dashboard for multi-bank Canadian corporates

A treasury team running RBC, BMO and Scotiabank needs a single intraday position view. We pair Scotia TranXact APIs (EFT, wire, INTERAC e-Transfer for Business, balance inquiry) with parallel adapters for the other banks, then push to a unified /positions endpoint with currency, value-date and counterparty fields. The same plumbing handles forecasting by replaying 13-month transaction history.

3. Personal-finance management (PFM) onboarding

A neobank or Wealthsimple-style PFM wants Scotiabank chequing data to power categorisation. The flow is: user OAuth-style consent → token exchange → backfill 24 months of transactions → subscribe to a webhook for new postings. Categorisation re-uses Scotia Smart Money's category labels when present, falling back to internal MCC heuristics. Consent records are stored with timestamp, scope and revocation handle for audit.

4. Lending pre-qualification with Scotiabank-held funding accounts

A non-bank lender wants to verify income deposits and credit obligations before approving a personal loan. We pull 90-day transaction history, classify recurring payroll inflows, and surface Scotiabank credit card and mortgage liabilities. The TransUnion credit score signal carried inside the app is referenced (with consent) for tier assignment. Output is a single /decision-input JSON document the lender's underwriting engine can consume directly.

5. Loyalty-aware checkout for Scene+ partners

An online grocer that participates in Scene+ wants to show real-time point balance and "burn" points at checkout. We expose /v1/scotiabank/scene-plus/balance and /v1/scotiabank/scene-plus/redeem, both gated by a per-session consent token. Reconciliation is closed by matching the resulting card transaction back to the redemption event nightly.

Technical implementation

We deliver runnable Python and Node.js source plus an OpenAPI 3.1 spec. The snippets below illustrate the auth, statement and webhook patterns we ship by default. Field names mirror what the app actually exposes so downstream code stays close to source-of-truth.

Authorization & session bootstrap

POST /api/v1/scotiabank/auth/token
Content-Type: application/json

{
  "grant_type": "user_consent",
  "consent_id": "c_8f4a...",
  "client_id": "cli_live_...",
  "scopes": ["accounts:read", "transactions:read", "scene_plus:read"]
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 1800,
  "refresh_token": "rt_9c2b...",
  "consent_expires_at": "2026-11-04T00:00:00Z"
}

Statement query — chequing & credit card

POST /api/v1/scotiabank/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "account_id": "acct_chq_001",
  "from_date": "2026-01-01",
  "to_date":   "2026-04-30",
  "include":   ["postings", "running_balance", "scene_plus_events"],
  "format":    "json"
}

200 OK
{
  "account_id": "acct_chq_001",
  "currency":  "CAD",
  "opening_balance": 4321.55,
  "closing_balance": 5102.18,
  "postings": [
    { "id": "tx_001", "posted_at": "2026-04-29",
      "description": "LOBLAWS #1023", "mcc": "5411",
      "amount": -82.41, "running_balance": 5102.18,
      "scene_plus_points_earned": 82 }
  ],
  "next_cursor": "eyJwYWdlIjoyfQ=="
}

Webhook — new posting notification

POST https://your-app.example.com/hooks/scotiabank
X-OFL-Signature: sha256=...
Content-Type: application/json

{
  "event": "transaction.posted",
  "consent_id": "c_8f4a...",
  "account_id": "acct_chq_001",
  "transaction": {
    "id": "tx_002",
    "posted_at": "2026-05-02T14:21:09Z",
    "amount": -1450.00,
    "type": "etransfer.outbound",
    "counterparty": "j****@example.com"
  },
  "delivery_attempt": 1
}

// Verify HMAC, ack with 2xx within 5s; failed deliveries retry 5x
// with exponential backoff, then dead-letter to /retry-queue.

Error handling

We standardise on RFC 7807 problem documents (application/problem+json) with stable type URIs such as /errors/consent-revoked, /errors/scotia-rate-limit and /errors/statement-not-yet-available. The SDK retries idempotent reads with jittered backoff and surfaces consent-revoked events to the consent UI immediately.

Data flow / architecture

The reference pipeline keeps the Scotiabank session boundary on one side and your business systems on the other, with a clearly separated normalisation layer in between. This is how a single transaction reaches your warehouse:

Each hop has a clear responsibility: ingestion holds raw artefacts (PDF eStatements, JSON snapshots), the normaliser lifts them into a stable schema with currency and timezone fixed, and the gateway enforces per-tenant rate limits and consent expiry. Replays are deterministic — re-running the pipeline on archived raw artefacts always yields the same output rows.

Screenshots

Click any thumbnail to view the full-resolution screenshot.

Similar apps & integration landscape

Teams that need Scotiabank data rarely stop at one institution. Below are other Canadian banking and fintech apps where the same OpenData / OpenFinance / OpenBanking patterns apply — listed here as part of the broader integration landscape, not for ranking. Unified exports across several of these are a common ask.