Canada Gazette | Outlier Compliance Group

Background

On March 26, 2025 final amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations and creation of a new regulation were officially published in the Canada Gazette (SOR/2025-67 and SOR/2025-68). This round of anticipated changes introduces three company types that will become reporting entities. Additionally, the amendments bring in changes related to reporting of goods, information sharing, and beneficial ownership discrepancy reporting.

In traditional fashion, to make reading these changes a little easier, we (thanks Rodney) have created a redlined version of the regulations, with new content showing as tracked changes, which can be found in a combined document here.

While there are no substantial changes to the requirements from the draft amendments published on November 30, 2025 in the Canada Gazette, one noteworthy change is that the in-force date of most requirements was moved from October 1, 2025, to April 1, 2025, which will likely leave companies scrambling.

The incoming requirements are meant to improve Canada’s anti-money laundering (AML), anti-Terrorist Financing (ATF) and sanctions regime, and implement measures announced in Budget 2022, Budget 2023, Budget 2024, the 2023 Fall Economic Statement, and Canada’s last Parliamentary Review. On February 4, 2025, the Prime Minister issued the Directive on Transnational Crime and Border Security, which stated the urgent need to disrupt profits laundered by organized crime in connection with illegal trade in drugs such as fentanyl. The amendments provided in the finalized regulations were identified as key measures to support this Directive.

The regulatory impact analysis statement (RIAS) accompanying the finalized regulations indicates that these amendments are also needed for Canada to align to Financial Action Task Force (FATF) standards ahead of Canada’s next mutual examination by the FATF later in 2025. The RIAS states that FINTRAC is committed to working with reporting entities to ease the implementation process along this accelerated and exceptional timeline, and will put emphasis on engagement, outreach and guidance activities related to new regulatory obligations.

What’s Changed?

Trade Based Money Laundering (TBML)

The regulatory amendments introduce a new Proceeds of Crime (Money Laundering) and Terrorist Financing Reporting of Goods Regulation.

Under the new regulation, anyone who is importing or exporting goods into or out of Canada needs to file a declaration with the Canada Border Services Agency (CBSA) as follows:

whether the goods are proceeds of crime as defined by subsection 462.3(1) of the Criminal Code or are goods related to money laundering, to the financing of terrorist activities or to sanctions evasion; and
that the goods are actually being imported or exported, as the case may be.

The amendments will also include seizure and forfeiture rules. Under the framework, the CBSA will have powers to seize and forfeit goods when they have reasonable grounds to believe that the goods are proceeds of crime or related to money laundering, terrorist financing, or sanctions evasion.

As part of the new requirements, there are substantial record-keeping obligations, including details such as the origin, making, purchase, importation, costs, and value of the goods, as well as records related to payments for the goods.

This change comes into force April 1, 2025.

Information Sharing

The regulatory amendments introduce measures to allow for reporting entities to share information with each other to detect and deter money laundering, terrorist financing, and sanctions evasion, while maintaining privacy protections for personal information.

Reporting entities that wish to share information (it’s voluntary) would be required to establish and implement a code of practice for disclosing, collecting and using personal information without consent. The code must:

describe the personal information of an individual that may be disclosed, collected or used without their knowledge or consent;
describe the purposes for which an individual’s personal information may be disclosed, collected or used without their knowledge or consent;
describe the manner in which an individual’s personal information may be disclosed, collected or used without their knowledge or consent;
describe the measures to be taken to ensure the protection of personal information, including measures concerning the retention of such information and the keeping of records; and
include information demonstrating that the code complies with the requirements of the Act.

The Code must be provided to the Office of the Privacy Commissioner of Canada (OPC) for approval, as well as to FINTRAC for comment in advance of use. The OPC must approve the code within 120 calendar days (an increase from the proposed 90 days in the draft amendments). The OPC will continue to have the ability to extend the deadline by an additional 15 days, provided it notifies the reporting entity. Reporting entities would be required to resubmit their Codes to the OPC and FINTRAC every five years regardless of changes or not. The OPC has published guidance on how to submit Codes for review and approval.

This change comes into force immediately.

Discrepancy Reporting

The amendments introduce a requirement for reporting entities dealing with a Canada Business Corporations Act (CBCA) corporation to report any material discrepancies found while obtaining and verifying the accuracy of beneficial ownership information under current AML requirements. The reporting requirement will not apply if the material discrepancy is resolved within 30 days (originally 15 days in the draft amendments) from the date it is identified. Currently, what is deemed to be material is not well defined (outside of missing beneficial owners). There are examples of what is considered not material.

The information with respect to the discrepancy includes:

Name of reported company and identifying number on its certificate of incorporation, amalgamation or continuance;
Date on which discrepancy was identified; and
Description of discrepancy.

This comes into force October 1, 2025.

New Reporting Entities

The regulatory amendments outline the inclusion of three new regulated entities, as announced in Budget 2024, which were highlighted as concerns during Canada’s last FATF mutual evaluation: factoring companies (referred to as “factors”), cheque cashing companies, and financing and leasing companies. These entities will be subject to the PCMLTFA as of April 1, 2025, and must implement compliance programs.

We have created a separate blog post for each of the newly regulated company types (factoring companies, cheque cashing companies, and financing and leasing companies) to make it easier to digest the requirements that apply to each of the new reporting entities.

What Next?

FINTRAC will be issuing and updating guidance related to the changes. While we await guidance, entities should start updating their compliance program and processes to reflect the new requirements as they apply to their business. New reporting entities should start working on developing their compliance program immediately if they have not already done so.

Background

On January 1, 2025 final amendments to regulations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act were published in the Canada Gazette (SOR 2024-266 and SOR 2024-267). The most noteworthy changes fall under the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations. The final amendments include changes or new requirements related to:

MSB registration framework;
Sanctioned property reporting;
White-label ATMs;
Real estate (title insurance and unrepresented third-parties); and
Casino disbursements.

The regulatory impact statement states that these amendments implement measures announced in previous budgets, the 2023 Fall Economic Statement, our Parliamentary Review and Cullen Commission report ahead of Canada’s upcoming mutual evaluation by the Financial Action Task Force (FATF).

To make reading these changes a little easier, as we always do, (thanks Rodney) a redlined version of the regulations, with new content showing as tracked changes, is attached here.

What’s Changing?

From the draft regulations published back in July 2024, there have not been significant changes to the final publication. Some changes were made to address potential gaps, inconsistencies, and business realities in the context of application, and to provide greater flexibility in the coming-into-force dates. The most notable change from the draft relates to obligations for title insurers.

Below is a summary of what we feel are the most noteworthy changes and incoming requirements:

MSB Registration Framework

Money Services Businesses (MSBs) must register with FINTRAC. As part of registration, it will now be required to submit the following documentation as part of the application.

If the applicant is a corporation:

a certificate of incorporation or the most recent version of any other record that confirms its existence as a corporation and contains its name and address and the names of its directors; and
a document that sets out the ownership, control and structure of the corporation.

If the applicant is an entity other than a corporation:

the partnership agreement, articles of association or the most recent version of any other record that confirms its existence and contains its name and address; and
a document that sets out the ownership, control and structure of the entity.

Additionally, domestic MSBs will have to submit criminal record checks covering the CEO, President and directors, as well as every person who owns or controls 20% or more of the MSB. These criminal record checks must also be updated every two years as part of the renewal process. Where an MSB uses an agent or mandatary, criminal record checks are also required on those individuals. It should be noted that the 20% threshold does not align with reporting entity requirements for beneficial owners, which is at 25%. While industry asked for these numbers to align, Finance did not accept the change.

Sanctioned Property Reporting

The final amendments expand the definition of a listed person or entity to capture individuals and entities listed under all Canadian sanctions legislation including Special Economic Measures Act, the United Nations Act and the Justice for Victims of Corrupt Foreign Officials Act.

These changes also result in a new sanctioned property report. The report includes information fields such as:

how the reporting entity came to know that property in question is owned, held or controlled by or on behalf of listed person or entity;
the name of any person or entity that owns, holds or controls property on behalf of listed person or entity;
the name of any person or entity that has an interest or right in or is authorized to deal with property; and
a description of transactions involving property within previous six months.

White-Label ATMs

Final amendments will require those that provide acquiring services to white-label ATMs (WLATMs) to register with FINTRAC as MSBs and implement a full AML compliance regime. Similar to that of other regulated entities, a compliance regime will have to be in place which includes the following:

Appointment of a Compliance Officer;
Development of a documented compliance program (policies, procedures, risk assessment, ongoing training);
Conducting compliance effectiveness reviews;
Reporting certain transactions;
Identifying customers;
Keeping records;
Risk ranking customers and business relationships;
Conducting transaction monitoring and watchlist screening;
Conducting enhanced due diligence and transaction monitoring for high-risk customers and business relationships; and
Follow Ministerial Directives, sanctions, and other relevant transaction restrictions.

In addition to the records that must be retained as an MSB, WLATM operators will need to keep the following records:

Information on who owns, leases or operates a private automated banking machine in respect of which they provide acquirer services;
Information on the source of the cash that is loaded into a private automated banking machine in respect of which they provide acquirer services;
Information on account holder of a settlement account for a private automated banking machine in respect of which they provide acquirer services; and
The source and method used to transport cash loaded into a private automated banking machine.

Real Estate – Title Insurance

Final amendments will make title insurers reporting entities under Canada’s AML/ATF Regime. Title insurers are defined as a person or entity that is engaged in the business of providing title insurance, as defined in the schedule to the Insurance Companies Act when they provide a title insurance policy to the purchaser of real property or an immovable.

Specifically, title insurers will be required to develop a compliance program, meet certain identity verification requirements, submit required reporting to FINTRAC, keep certain records, and follow application Ministerial Directives.

It should be noted that changes were made to remove certain record-keeping obligations noted in the draft regulations. Title insurers will only be required to keep records of information that is obtained for the sale of title insurance. The following are the specific records that must be kept for every title insurance policy provided to a purchaser of real property or an immovable:

the name and address of the purchaser and, in the case of a person, their date of birth;
the legal description and address of the real property or immovable;
the closing date of the purchase;
the purchase price;
the amount of any loan secured by a mortgage on the real property or a hypothec on the immovable and the name of the lender;
if known, the name of the vendor; and
any title information respecting the real property or immovable that is found in the land registry in which the title to the real property or immovable is recorded.

Given title insurers’ business model, wherein they do not have direct contact with the purchasers of title insurance, final amendments have been updated to remove beneficial ownership requirements as well as exempt third-party determination and PEP requirements for title insurers.

Real Estate – Unrepresented Parties

Final amendments will require real estate brokers and sales representatives to identify the party or parties (including third parties) not represented in real estate transactions. This is a change from the current requirement where real estate brokers and sales representatives are only required to take “reasonable measures” to identify unrepresented parties.

What Next?

The requirements summarized above come into force October 1, 2025. In the meantime, FINTRAC will have to issue guidance which has been promised before the noted in-force date.

While we await guidance, newly regulated entities should start working on developing their compliance program in anticipation of the respective in-force dates noted above. Other Reporting Entity types should take note of MSB framework changes and changes related to sanction property as it relates to their business model.

Background

On November 30, 2025 draft amendments to the regulations under the Proceeds of Crime Money Laundering and Terrorist Financing Act (PCMLTFA) were published in the Canada Gazette.

In the interest of time, we have published this blog summarizing what we feel to be the most noteworthy amendments but will follow up with a redlined version of the regulations, with new content showing as tracked changes, at a later date.

The noted changes are meant to improve Canada’s anti-money laundering (AML) and anti-Terrorist Financing (ATF) regime and implement measures announced in Budget 2022, Budget 2023, Budget 2024, the 2023 Fall Economic Statement and Canada’s last Parliamentary Review. This is addressed through six separate measures including the introduction of new regulated entities.

Measure 1: Trade Based Money Laundering (TBML)

The draft amendments include a new Proceeds of Crime (Money Laundering) and Terrorist Financing Reporting of Goods Regulation.

Currently, the Canada Border Services Agency (CBSA) can require receipts and invoices for the purposes of determining compliance with import laws, but they cannot request these documents for the purposes of detecting money laundering or terrorist financing.

Under the proposed regulations, anyone who is importing or exporting goods into or out of Canada needs to file a declaration with the CBSA as follows:

whether the goods are proceeds of crime as defined by subsection 462.3(1) of the Criminal Code or are goods related to money laundering, to the financing of terrorist activities or to sanctions evasion; and
that the goods are actually being imported or exported, as the case may be.

The latter is meant to address “phantom shipments” that are used in trade-based money laundering (TBML) which was identified as a primary money laundering concern in Canada’s last Financial Action Task Force (FATF) evaluation.

The new regulations also bring about substantial record keeping requirements which include information such as the origin, marking, purchase, importation, costs and value of the goods, and records relating to payment for the goods. It’s noteworthy that FINTRAC’s 2023-24 Annual Report lists customs and excise related offences as being in the top five predicate offences related to case disclosures during the period.

Measure 2: Information Sharing

Information sharing between private entities has been recognized by the FATF as an important tool for disrupting money laundering and terrorist financing. Budget 2024 introduced legislative amendments to the Criminal Code and the PCMLTFA to enhance the ability of reporting entities to share information with each other as it relates to the detection of money laundering and terrorist financing.

The draft amendments introduce measures to allow for reporting entities to share information with each other to detect and deter money laundering, terrorist financing, and sanctions evasion, while maintaining privacy protections for personal information.

describe the purposes for which an individual’s personal information may be disclosed, collected or used without their knowledge or consent;
describe the manner in which an individual’s personal information may be disclosed, collected or used without their knowledge or consent;
describe the measures to be taken to ensure the protection of personal information, including measures concerning the retention of such information and the keeping of records;
include information demonstrating that the code complies with the requirements of the Act.

The Code must be provided to the Office of the Privacy Commissioner of Canada (OPC) for approval and to FINTRAC for comment in advance of use. The OPC would have a prescribed period of 90 days to approve a Code. The proposed amendments also include procedures for reporting entities to modify the Code, which would need the OPC’s approval if the changes are material. Reporting entities would be required to resubmit their Codes every five years regardless of changes or not.

Measure 3: Discrepancy Reporting

The draft amendments will require reporting entities who are dealing with a Canada Business Corporations Act (CBCA) corporation to report any material discrepancy it finds as part of obtaining and verify the accuracy of beneficial ownership information under current AML requirements. The reporting requirement will not apply if the material discrepancy is resolved within 15 days after the day on which it is identified. Currently, what is deemed to be material is not well defined (outside of missing beneficial owners).

The Information with respect to the discrepancy includes:

Name of reported company and identifying number on its certificate of incorporation, amalgamation or continuance,
Date on which discrepancy was identified, and
Description of discrepancy.

In case you missed it, the federal government launched a public, searchable beneficial ownership registry of federal corporations in early 2024.

Measure 4, 5 and 6: New Reporting Entities

The draft amendments outline the inclusion of three new regulated entities which were announced in Budget 2024 and where noted as concerns during Canada’s last FATF mutual evaluation: factoring companies (referred to as “factors”), cheque cashing companies, and financing and leasing companies.

Similar to that of other regulated entities, a compliance regime will have to be in place which includes the following:

Appointment of a Compliance Officer;
Development of a documented compliance program (policies, procedures, risk assessment, ongoing training);
Conducting compliance effectiveness reviews;
Reporting certain transactions;
Identifying customers;
Keeping records;
Risk ranking customers and business relationships;
Conducting transaction monitoring and watchlist screening;
Conducting enhanced due diligence and transaction monitoring for high-risk customers and business relationships; and
Follow Ministerial Directives, sanctions, and other relevant transaction restrictions.

4. Factoring Companies

Factoring companies supply liquidity to a customer in exchange for the cash value of a certain amount of the customer’s accounts receivable (i.e. invoices) to be collected later by the factoring company. A factor is defined as a person or entity that is engaged in the business of factoring, with or without recourse against the assignor.

The draft amendments require factoring companies to keep certain records which include:

an information record in respect of the person or entity with whom it enters into the agreement;
if the information record is in respect of an entity, a record of the name, address and date of birth of every person who enters into the agreement on behalf of the entity and the nature of the person’s principal business or their occupation;
if the information record is in respect of a corporation, a copy of the part of official corporate records that contains any provision relating to the power to bind the corporation in respect of transactions with the factor;
a record of the financial capacity of the person or entity with which it enters into the agreement and the terms of the agreement;
for any payment it makes, a record of:
- the date of the payment,
- if the payment is in funds, the type and amount of each type of funds involved,
- if the payment is not in funds, the type of payment and its value,
- the method by which the payment is made,
- the name of every person or entity involved in the payment, and
- every account number or other equivalent reference number connected to the payment; and
a receipt of funds record in respect of every amount of $3,000 or more that it receives, unless the amount is received from a financial entity or public body or from a person who is acting on behalf of a client that is a financial entity or public body.

5. Cheque Cashing

Cheque cashing is a financial service that offers clients the ability to cash a cheque immediately and hold free, for a fee.

Cheque cashing where cheques are not payable to a named person or entity is not currently captured under the PCMLTFA, but draft amendments would introduce such as regulated activity.

In addition to current money services business (MSB) requirements, the draft amendments require keeping certain records in respect to where an MSB cashes a cheque for more than CAD 3,000, including:

the date when each cheque is cashed,
the person’s or entity’s name and address, the nature of their principal business or their occupation and, in the case of a person, their date of birth,
the total amount of the cheque or cheques,
the name of the issuer of each cheque,
the number of every account that is affected by the cashing of the cheque or cheques, the type of account and the name of each account holder,
every reference number that is connected to the cashing of the cheque or cheques and that has a function equivalent to that of an account number, and
if the cashing of the cheque or cheques involves virtual currency, every transaction identifier, including the sending and receiving addresses.

6. Finance and Leasing Entities

The draft amendments define a financing or leasing entity as a person or entity that is engaged in the business of financing or leasing of:

property, other than real property or immovables, for business purposes;
passenger vehicles in Canada; or
property, other than real property or immovables, that is valued at $100,000 or more. (entité de financement ou de bail)

The draft amendments require financing or leasing entities to keep certain records in respect of every financing or leasing arrangement which include:

an information record in respect of the person or entity with which it enters into the arrangement;
if the information record is in respect of an entity, a record of the name, address and date of birth of every person who enters into the arrangement on behalf of the entity and the nature of the person’s principal business or their occupation;
if the information record is in respect of a corporation, a copy of the part of official corporate records that contains any provision relating to the power to bind the corporation in respect of transactions with the financial leasing entity;
a record of the financial capacity of the person or entity with which it enters into the arrangement and the terms of the arrangement; and
in respect of every payment that it receives under the arrangement, other than a payment received from a financial entity or public body or from a person who is acting on behalf of a client that is a financial entity or public body, a record of
- the date of the payment,
- the name of the person or entity that makes the payment,
- the amount of the payment and of any part of it that is made in cash, and
- the method by which the payment is made.

What Next?

The proposed changes related to measures 1, 3, 4, 5 and 6 would come into force on October 1, 2025, and the proposed amendments related to information sharing would come into force immediately on final publication in the Canada Gazette.

There is a 30 day comment period ending December 30, 2024 for the proposed regulations. It is strongly recommended that industry, and potentially impacted companies, review carefully and provide feedback. Comments can be submitted online via the commenting feature after each section of the proposed changes, or via email directly to Erin Hunt, Director General, Financial Crimes and Security Division, Financial Sector Policy Branch, Department of Finance, 90 Elgin Street, Ottawa, Ontario, K1A 0G5.

Background

On October 11, 2023, final amendments to regulations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act were published in the Canada Gazette. The most noteworthy changes fall under the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations and the addition of a new regulation. This round of anticipated changes introduces the compliance requirements for armoured car companies and mortgage lending entities. Additionally, FINTRAC will now be able to charge businesses and individuals for the annual cost of its compliance program as part of its assessment of expenses funding model.

Other changes include the new requirements for correspondent banking relationships, and additional requirements related to the Money Services Business (MSB) registration.

To make reading these changes a little easier, we (thanks Rodney) have created a redlined version of the regulations, with new content showing as tracked changes, which can be found in a combined document here.

What’s Changed?

From the draft regulations published back in February of this year, there have not been significant changes to the final publication. As expected, entities that collect currency, money orders, traveller’s cheques, or other similar negotiable instruments (except for cheques payable to a named person or entity) will be treated as a new category of MSB. With these changes, such providers will be subject to existing money services businesses requirements.

With respect to mortgage lenders (brokers responsible for mortgage origination, lenders responsible for underwriting the loan or supplying the funds, and administrators responsible for servicing the loan), they will now have to comply with AML compliance requirements imposed on reporting entities. Note the definition of a mortgage lender was changed slightly from the draft regulations, narrowing the scope of who is captured.

As part of the assessment of expenses funding model, the new Financial Transactions and Reports Analysis Centre of Canada Assessment of Expenses Regulations will allow FINTRAC to pass on expenses, to reporting entities, that it incurs in the administration of the PCMLTFA. Note there have been some changes to the formula that will be used for assessment amounts. The base assessment amount for federally regulated banks, trust and loan companies, and life insurance companies will be based on their value of consolidated Canadian assets that excludes its subsidiary’s reported value of Canadian assets. Guidance related to how reporting entities will be charged has been issued and can be found here.

Please refer to our previous blog post that outlines details on the changes and the exact requirements that will come into force.

What Next?

Requirements for armoured car companies come into force on July 1, 2024, and October 1, 2024 for mortgage lending entities. Effective April 1, 2024, FINTRAC will commence recovering costs from the 2024–25 fiscal year.

In the meantime, FINTRAC will have to issue guidance related to cash transport and mortgage lending. Additionally, there may be FINTRAC policy interpretations that will no longer be able to be relied upon, as it relates to cash transport and mortgage lending.

While we await guidance, armoured car and mortgage lending entities should start working on developing their compliance program in anticipation of the respective in-force dates noted above.

Background

On February 11, 2023, the proposed Retail Payment Activities Regulations were published in the Canada Gazette. This is to support the Retail Payment Activities Act (RPAA) which was released under Bill C-30 and received royal assent in June 2021. The Retail Payment Activities Regulations are required to bring the RPAA into force.

A Payment Service Provider (PSP) is defined as an individual or entity who performs payment functions as a service or business activity that is not incidental to another service or business activity. Certain entities, such as financial institutions, are exempt as they are regulated under other federal obligations (i.e., Office of the Superintendent of Financial Institutions’ Operational Risk and Enterprise Risk management guidelines.)

The current lack of requirements and supervision increases risks, such as the risk of financial loss in instances of business insolvency, and threats to the security of sensitive personal information. The Regulations aim to address gaps in the supervision of unregulated PSPs and are meant to align with other jurisdictions which already have regimes for PSPs.

The principles that guide the Regulations are:

Necessity — supervision should address risks that lead to significant harm to end users and avoid duplication of existing rules;
Proportionality — level of supervision should be commensurate with the level of risk posed by the payment activity;
Consistency — similar risks should be subject to a similar level of supervision; and
Effectiveness — requirements should be clear, accessible and easy to integrate within different payment services.

PSPs will be required to apply and register with The Bank of Canada (no date for this yet). There is a proposed registration fee of CAD 2500. Additionally, an annual assessment fee will be required.

In the following sections, we have summarized what we feel are the most important requirements to note.

Operational Risk Management

PSPs will have to implement and maintain an Operational Risk Framework consisting of the following:

Identify its operational risks (i.e., business continuity, cybersecurity, fraud, data management, information technology, human resources, process and product design and implementation, change management, physical security and third parties);
Protect its retail payment activities from those risks;
Detect incidents and control breakdowns;
Respond to and recover from incidents;
Review, test and audit its Risk Management Framework;
Establish roles and responsibilities for the management of operational risk;
Have access to sufficient human and financial resources; and
Manage risks from third-party service providers, agents and mandataries.

PSP must ensure that the above are proportional to the impact that a reduction, deterioration, or breakdown of its payment activities could have on end users.

Incident Response

Under the proposed Regulations, PSPs must develop a comprehensive plan for investigating, responding to and recovering from incidents that have a material impact on an end user. An incident is defined as an event or series of related events that is unplanned and that results in or could reasonably be expected to result in the reduction, deterioration or breakdown of any payment activity performed by a PSP.

The incident would be reported to the Bank of Canada and would include the following at a minimum:

A description of the incident;
The impact on individuals or entities listed in the Act; and
Actions taken by the PSP to respond to the incident.

There would also need to be a notice to impacted end users and other impacted parties.

PSPs can only resume operations after an incident once they have verified the integrity and confidentiality of all systems, data and information have been restored, and that it is able to perform retail payment activities without reduction, deterioration or breakdown.

Audit, Testing and Training

Under the proposed Regulations, PSP’s will have to complete various types of testing related to the Framework and have training in place.

All staff who have a role in establishing, implementing or maintaining the PSP’s Risk Management Framework must be provided with the information and training that are necessary to carry out that role.

Framework Review

On at least an annual basis, PSP’s must evaluate its compliance with regulatory requirements. Such a review is also required before any significant changes are made to the PSP’s operations or controls after an incident (defined in the section above). The findings of the review must be reported to a senior officer.

Testing

PSPs must also establish and implement a testing methodology to determine the effectiveness of its Risk Management Framework. This must be tested at least once every three years and findings must also be provided to a senior officer.

Independent Review

In addition to the above, a PSP must have their Framework independently reviewed at least every three years. The review must be documented and describe the scope, methodology use and findings. Findings of the review must be reported to a senior officer.

Biennial Independent Review

PSPs must have requirements related to safeguarding of funds tested at least once every two years by a sufficiently skilled individual who has had no role in the establishment, implementation, or maintenance of the safeguarding requirements under a PSPs Framework. We discuss what safeguards requirements are below.

Safeguards

PSPs will be required to hold customer funds in a trust account or a segregated account, with insurance or a guarantee to safeguard end-user funds against financial losses due to insolvency.

For consumer protection, the Regulations contain requirements to protect the end user from loss. These requirements include:

End-user funds must be held at prudentially regulated financial institutions;
Insurance or guarantee cannot be from an affiliate of the PSP;
The proceeds from the insurance or guarantee cannot form part of the PSP’s estate;
The Bank of Canada must be notified at least 30 days in advance of the cancellation of the insurance or guarantee;
PSPs must implement and maintain a written fund safeguarding framework to ensure that end-users have reliable access to their funds without delay; and
PSPs must keep a ledger with the names of their end-users and the amount of funds held.

This will require detailed flow of funds documentation.

Reporting

Under the proposed Regulations , PSPs will have to complete various types of reports.

Annual Report

PSPs will need to provide an annual report to the Bank of Canada, no later than March 31 of each year. Some of the information that must be contained in the report is:

A description of any changes made to the payment service provider’s risk management and incident response framework;
A description of the human and financial resources for implementing and maintaining the risk management and incident response framework;
A description of the PSP’s operational risks in respect of the reporting year, their potential causes and the manner in which they were identified;
A description of the systems, policies, procedures, processes, controls, including any approvals required;
A description of training;
A description of all reviews, and independent reviews; and
A description of any incidents that the payment service provider experienced during the reporting year.

Also, the report will need to contain certain volume and value statistics related to the services a PSP is providing.

Significant Change Report

PSPs will be required to notify the Bank of Canada, at least five days in advance, before making a significant change that could materially impact operational risks or the safeguarding of end user funds.

The information that must be contained in the report is:

The name and contact information of the individual who may be contacted regarding the significant change;
A description of the change or new activity to be performed;
The reason for the change or new activity;
The date on which the change is to be made;
The PSP’s assessment of the effect that the change or new activity will have on its operational risks; and
A copy of all documentation in relation to the PSP’s Risk Management Framework, that has been amended to reflect the change or new activity, including any necessary approvals.

If a PSP has senior officers, the change or new activity must be approved and receive formal sign off by senior management before submission of a report. This should be taken into account from a planning perspective, as it can take some time to obtain such internal approvals.

Incident Report

PSPs must report incidents that have a material impact on an end user, other PSPs, or designated financial market infrastructures, to the Bank of Canada and other impacted individuals and entities.

The information that must be contained in the report is:

A description of the incident;
What impact does the incident have on individuals and entities; and
What actions have been taken by the PSP to respond and remediate.

The Regulations do not make it clear what timeframe is required for reporting such incidents, however they do state the standard time to respond to a request from the Bank of Canada is 15 days. Failure to report an incident can result in an administrative monetary penalty classified as very serious.

What Does This Mean?

From the highlights, it’s evident that these Regulations will create a substantial burden for PSPs, especially ones that are smaller or just starting. A significant amount of time, resources and cost are going to be needed to manage the compliance requirements that PSPs will need to follow. If a PSP does not comply or there is partial compliance, they may be subject to administrative monetary penalties that range from CAD 1,000,000 per each serious violation, up to CAD 10,000,000 per each very serious violation. The draft Regulations did not make clear what a dispute process would like.

It should be noted that most PSPs captured under the RPAA are also considered money services businesses (MSBs), and as such must also comply with anti-money laundering (AML) compliance obligations. Check out our blog related to that here.

What Next?

Due to these changes not being final, we wait. There is no set date for when we can expect final legislation or when they will come into force, but it is a good time to start budgeting and align resources.

Also, as there is a 45-day comment period for the proposed Regulations which closes on March 28, 2023, PSPs should review the Regulations carefully and provide feedback. Comments can be submitted online via the commenting feature after each section of the proposed Regulations, via email, or via regular mail to Nicolas Marion, Senior Director, Payments Policy, Department of Finance, 90 Elgin Street, Ottawa, Ontario K1A 0G5.

Anti-Money Laundering
Consulting Services & Strategies

New Year – New Regs. Final Amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and Regulations – January 2025

Background