C-151453-4Charles III2025-2026An Act to establish a consumer-driven banking frameworkConsumer-Driven Banking ActConsumer-Driven Banking Act20264
1
20263
26
C-36.783, s. 2242026[Enacted by section 224 of chapter 3 of the Statutes of Canada, 2026.] Short Title
Short titleThis Act may be cited as the Consumer-Driven Banking Act.
Definitions
DefinitionsThe following definitions apply in this Act.authentication information means any password or other information that a consumer creates or adopts to be used to authenticate their identity. (authentifiant)Bank means the Bank of Canada. (Banque)complaint means an expression of dissatisfaction, whether justified or not, to a participating entity with respect to any activity that it performs under this Act. (plainte)derived data means, subject to the regulations, data about a consumer, product or service that has been enhanced by a participating entity to significantly increase its usefulness or commercial value. (données dérivées)entity means a corporation, trust, partnership, fund, unincorporated association or organization or federal or provincial Crown corporation. (entité)external complaints body means the corporation designated under subsection 114(1). (organisme externe de traitement des plaintes)federal financial institution meansa bank that is listed in Schedule I or II to the Bank Act;an authorized foreign bank as defined in section 2 of the Bank Act;a company to which the Trust and Loan Companies Act applies;an association to which the Cooperative Credit Associations Act applies; ora company, fraternal benefit society or foreign company to which the Insurance Companies Act applies. (institution financière fédérale)government authority includes the Royal Canadian Mounted Police, the Communications Security Establishment and the Canadian Security Intelligence Service. (autorité administrative)Governor has the same meaning as in section 2 of the Bank of Canada Act. (gouverneur)Minister means the Minister of Finance. (ministre)participating entity meansa bank that is listed in the schedule;a federal financial institution or provincial financial institution that is accredited under section 15;a registered payment service provider that is accredited under section 17; oran entity that is accredited under section 19. (entité participante)provincial financial institution meansa cooperative credit society, savings and credit union or caisse populaire that is regulated by a provincial Act;a provincial Crown corporation that offers deposit-taking services; oran insurance company that is regulated by a provincial Act. (institution financière provinciale)registered payment service provider means a payment service provider, as defined in section 2 of the Retail Payment Activities Act, that is registered, as defined in that section. (fournisseur de services de paiement enregistré)registry means the registry that is maintained under section 44. (registre)sharing, in respect of consumer data, means the provision or receipt of that data by participating entities. (partage)technical standards body means the body designated under subsection 125(1). (organisme de normalisation technique)third-party service provider means an individual or entity that is not an employee or an agent or mandatary of a participating entity and that, under a contract, provides the participating entity with a service that is related to the activities that the participating entity performs under this Act. (tiers fournisseur de services)
Purpose
PurposeThe purpose of this Act is to establish a framework within which consumers, including businesses, can direct that their data be shared among participating entities of their choice, to ensure that the sharing of data among participating entities is safe and secure and to foster competition in the financial sector.
Objects of the Bank
ObjectsThe Bank’s objects under this Act are tosupervise participating entities, accredited third-party service providers, the external complaints body and the technical standards body to determine whether they are in compliance withthe provisions of this Act and the regulations that are applicable to them, andorders made, undertakings required, compliance agreements entered into and directions made under this Act;monitor and evaluate trends and emerging issues that may have an impact on consumers of consumer-driven banking, including trends and issues in respect of products, services and market developments, and make information on those trends and issues public;foster participation in consumer-driven banking in cooperation with any department, agency or agent corporation of the Government of Canada or any department, agency or agent or mandatary corporation of the government of a province, financial institutions and consumer and other organizations; andfoster competition in the financial sector in the interests of consumers.
Agreements or arrangementsThe Bank may, for the purpose of exercising its powers or performing its duties and functions under this Act, enter into an agreement or arrangement with any government authority or regulatory body.
Guidelines — BankSubject to subsection (2), the Bank may issue guidelines respecting the manner in which this Act is to be applied.Guidelines — MinisterThe Minister may issue guidelines respecting the manner in which any provision of this Act that confers powers, duties or functions on the Minister is to be applied.
Publication of information — regulationsThe Bank must publish, within the time and in the manner provided for in the regulations, the information that is provided for in the regulations respecting consumer-driven banking.Publication of information as appropriateThe Bank may publish any information with respect to consumer-driven banking that the Bank considers appropriate.
Personal informationThe Bank may collect any personal information that the Bank considers necessary for carrying out its objects under this Act.
Delegation of Governor’s powers, duties and functionsThe Governor may delegate to an officer of the Bank any of the Governor’s powers, duties or functions under this Act.
Application
DataThis Act applies in respect of data that relates to the following products and services, including data that is provided by a consumer and data that is provided for in the regulations:deposit accounts;registered investment accounts;non-registered investment accounts;payment products;lines of credit, mortgages or hypothecs and other kinds of loans; andother products or services provided for in the regulations.ExclusionThis Act does not apply in respect of derived data.
Limit — editing dataData that is shared between participating entities in accordance with this Act is to be shared in a manner that does not enable the participating entity that receives the data to edit the data on servers that are used by the participating entity that provides the data.
RestrictionNothing in this Act affects any restriction imposed under the Bank Act on banks with respect to the sharing of information about a consumer with an insurance company, agent or broker for the business of insurance.
Participating EntitiesBanks Listed in Schedule
Adding to scheduleThe Minister may, by order, amend the schedule by adding the name of a bank that is listed in Schedule I to the Bank Act.AmendmentThe Minister may, by order, amend the schedule by amending the name of a bank.DeletionThe Minister may, by order, amend the schedule by deleting the name of a bank if the bank is dissolved or if it is continued, or amalgamated and continued, as a corporation to which another Act of Parliament applies.Order to be publishedAn order made under this section must be published in the Canada Gazette.
Notice to BankThe Minister must, as soon as feasible, notify the Bank of any amendment that is made to the schedule.RegistryAs soon as feasible after being notified of an amendment to the schedule, the Bank mustadd to the registry the name of any bank whose name was added to the schedule, the date on which it was added to the schedule and any other relevant information;amend in the registry the name of any bank whose name was amended in the schedule; ordelete from the registry the name of any bank whose name was deleted from the schedule and all other information about the bank.Notice to bankAs soon as feasible after amending the registry under this section, the Bank must notify the bank to which the amendment relates.
Federal Financial Institutions and Provincial Financial Institutions
AccreditationSubject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit a federal financial institution, other than a bank that is listed in the schedule, or provincial financial institution if the Bank is satisfied that the federal financial institution or provincial financial institution is in compliance with the technical standard referred to in subsection 125(1) and the security safeguards provided for in the regulations.FeeAn applicant must include with the application an accreditation fee determined in accordance with the regulations.InformationAt the Bank’s request and within the time and in the manner specified by the Bank, an applicant must provide the Bank with any information that is relevant to the application.Notice of change to informationAs soon as feasible after an applicant becomes aware that information provided as part of the application has changed or is about to change, the applicant must notify the Bank of the change or anticipated change, and the Bank must then, as soon as feasible, notify the Minister and any designated person or government authority.
Notice and addition to registryAs soon as feasible after deciding to accredit an applicant or refuse an application, the Bank must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
Registered Payment Service Providers
AccreditationSubject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit a registered payment service provider if the Bank is satisfied that it meets the requirements provided for in the regulations.FeeAn applicant must include with the application an accreditation fee determined in accordance with the regulations.InformationAt the Bank’s request and within the time and in the manner specified by the Bank, an applicant must provide the Bank with any information that is relevant to the application.Notice of change to informationAs soon as feasible after an applicant becomes aware that information provided as part of the application has changed or is about to change, the applicant must notify the Bank of the change or anticipated change, and the Bank must then, as soon as feasible, notify the Minister and any designated person or government authority.
Notice and addition to registryAs soon as feasible after deciding to accredit an applicant or refuse an application, the Bank must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
Other Entities
AccreditationSubject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit an entity other than a federal financial institution or provincial financial institution or a registered payment service provider, if the Bank is satisfied that the entity meets the requirements provided for in the regulations.FeeAn applicant must include with the application an accreditation fee determined in accordance with the regulations.InformationAt the Bank’s request and within the time and in the manner specified by the Bank, an applicant must provide the Bank with any information that is relevant to the application.Notice of change to informationAs soon as feasible after an applicant becomes aware that information provided as part of the application has changed or is about to change, the applicant must notify the Bank of the change or anticipated change, and the Bank must then, as soon as feasible, notify the Minister and any designated person or government authority.
Notice and addition to registryAs soon as feasible after deciding to accredit an applicant or refuse an application, the Bank must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
Refusal to Accredit
ReviewAn applicant that has been notified under section 16, 18 or 20 of a decision to refuse its application for accreditation may, within the period provided for in the regulations, make a request to the Governor for a review of the decision.DecisionAfter giving the applicant an opportunity to make representations, the Governor must, within the period provided for in the regulations, confirm the refusal or accredit the applicant.Notice and addition to registryAs soon as feasible after deciding to confirm the refusal or accredit the applicant, the Governor must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
Suspension and Revocation
Request for revocationThe Bank must revoke a participating entity’s accreditation at the request of the participating entity if the Bank is satisfied that the participating entityhas complied with its duties under this Act;has, in accordance with the regulations and at least 30 days before the day on which it makes the request for revocation, notified in writing any consumers that use the services that it provides in accordance with this Act of its intention to request revocation and provided those consumers with any other information that is provided for in the regulations; andin the case of a participating entity that is a provincial financial institution, has, at least 30 days before the day on which it makes the request for revocation, notified in writing the appropriate provincial authority that regulates or supervises the provincial financial institution of its intention to request revocation.Notice of decisionThe Bank must, as soon as feasible, notify the participating entity in writing of the decision with respect to the request and the reasons for the decision.Reference to revocation in registryIf the Bank decides to revoke the participating entity’s accreditation, the Bank must, as soon as feasible, include a reference to the revocation in the registry.
SuspensionThe Bank may suspend a participating entity’s accreditation if the Bank is satisfied that the participating entity has contravened this Act or the regulations.Reference to suspension in registryThe Bank must, as soon as feasible, include a reference to the suspension in the registry.ConditionsThe Bank may impose any conditions that the Bank considers appropriate on a participating entity whose accreditation is suspended and the participating entity must comply with those conditions.NoticeThe Bank must, as soon as feasible, notify the participating entity in writing of the suspension and any conditions imposed.Notice to consumersAs soon as feasible after being notified of the suspension, the participating entity must notify in writing any consumers that use the services that it provides in accordance with this Act of the suspension and any conditions imposed.
End of suspensionIf the Bank is satisfied that the grounds for suspending a participating entity’s accreditation no longer exist, the Bank must end the suspension and must, as soon as feasible, notify the participating entity in writing that the suspension has ended and remove the reference to the suspension from the registry.
Notice of intent to revoke accreditationThe Bank may give a participating entity a notice of intent to revoke the participating entity’s accreditation if the Bank is satisfied that the participating entity has contravened this Act or the regulations. A notice of intent must include reasons.
Review of notice of intentA participating entity that has been given a notice of intent to revoke may, within the period provided for in the regulations, make a request to the Governor for a review of the notice of intent.DecisionAfter giving the participating entity an opportunity to make representations, the Governor must, within the period provided for in the regulations, revoke the participating entity’s accreditation or withdraw the notice of intent.Notice to participating entityThe Governor must, as soon as feasible, notify the participating entity in writing of the decision and the reasons for it.
Review not requestedIf a participating entity that has been given a notice of intent to revoke does not make a request for a review within the period provided for in the regulations, the Bank must revoke the participating entity’s accreditation or withdraw the notice of intent. The Bank must, as soon as feasible, notify the participating entity in writing of the decision and the reasons for it.
Reference to revocation in registryIf the Governor revokes a participating entity’s accreditation under subsection 26(2) or the Bank does so under section 27, the Bank must, as soon as feasible, include a reference to the revocation in the registry.
Duties of former participating entityA participating entity whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection 26(3) or section 27, comply with its duties under this Act and, in accordance with the regulations, notify in writing any consumers that used the services that it provided in accordance with this Act and provide those consumers with any other information that is provided for in the regulations.
Notice to appropriate provincial authorityIf the Bank gives notice under subsection 22(2) or 23(4) or section 24, 25 or 27 to a participating entity that is a provincial financial institution, or the Governor does so under subsection 26(3), the Bank or the Governor, as the case may be, must, as soon as feasible, notify the appropriate provincial authority that regulates or supervises the provincial financial institution.
Accredited Third-Party Service Providers
Accreditation requiredA participating entity must not use a third-party service provider to perform any of the following activities under this Act unless the third-party service provider is accredited under section 32:obtaining or managing consumers’ consent on behalf of the participating entity;confirming consumers’ authentication information or managing the authentication of consumers on behalf of the participating entity;providing or receiving consumer data on behalf of the participating entity.
AccreditationSubject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit an individual or entity to perform one or more of the activities referred to in paragraphs 31(a) to (c) if the Bank is satisfied that the individual or entity meets the requirements provided for in the regulations.FeeAn applicant must include with the application an accreditation fee determined in accordance with the regulations.InformationAt the Bank’s request and within the time and in the manner specified by the Bank, an applicant must provide the Bank with any information that is relevant to the application.Notice of change to informationAs soon as feasible after an applicant becomes aware that information provided as part of the application has changed or is about to change, the applicant must notify the Bank of the change or anticipated change, and the Bank must then, as soon as feasible, notify the Minister and any designated person or government authority.
Notice and addition to registryAs soon as feasible after deciding to accredit an applicant or refuse an application, the Bank must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
ReviewAn applicant that has been notified under section 33 of a decision to refuse its application for accreditation may, within the period provided for in the regulations, make a request to the Governor for a review of the decision.DecisionAfter giving the applicant an opportunity to make representations, the Governor must, within the period provided for in the regulations, confirm the refusal or accredit the applicant.Notice and addition to registryThe Governor must, as soon as feasible, notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
Request for revocationThe Bank must revoke an accredited third-party service provider’s accreditation at the request of the accredited third-party service provider if the Bank is satisfied that the accredited third-party service provider has complied with its duties under this Act.Notice of decisionThe Bank must, as soon as feasible, notify the accredited third-party service provider in writing of the decision with respect to the request and the reasons for the decision.Reference to revocation in registryIf the Bank decides to revoke the accredited third-party service provider’s accreditation, the Bank must, as soon as feasible, include a reference to the revocation in the registry.
SuspensionThe Bank may suspend an accredited third-party service provider’s accreditation if the Bank is satisfied that the accredited third-party service provider has contravened this Act or the regulations.Reference to suspension in registryThe Bank must, as soon as feasible, include a reference to the suspension in the registry.ConditionsThe Bank may impose any conditions that the Bank considers appropriate on an accredited third-party service provider whose accreditation is suspended and the accredited third-party service provider must comply with those conditions.NoticeThe Bank must, as soon as feasible, notify the accredited third-party service provider in writing of the suspension and any conditions imposed.Notice to participating entitiesAs soon as feasible after being notified of the suspension, the accredited third-party service provider must notify in writing any participating entities on whose behalf it is performing any of the activities for which it was accredited of the suspension and any conditions imposed.
End of suspensionIf the Bank is satisfied that the grounds for suspending an accredited third-party service provider’s accreditation no longer exist, the Bank must end the suspension and must, as soon as feasible, notify the accredited third-party service provider in writing that the suspension has ended and remove the reference to the suspension from the registry.
Notice of intent to revoke accreditationThe Bank may give an accredited third-party service provider a notice of intent to revoke the accredited third-party service provider’s accreditation if the Bank is satisfied that the accredited third-party service provider has contravened this Act or the regulations. A notice of intent must include reasons.
Review of notice of intentAn accredited third-party service provider that has been given a notice of intent to revoke may, within the period provided for in the regulations, make a request to the Governor for a review of the notice of intent.DecisionAfter giving the accredited third-party service provider an opportunity to make representations, the Governor must, within the period provided for in the regulations, revoke the accredited third-party service provider’s accreditation or withdraw the notice of intent.Notice to accredited third-party service providerThe Governor must, as soon as feasible, notify the accredited third-party service provider in writing of the decision and the reasons for it.
Review not requestedIf an accredited third-party service provider that has been given a notice of intent to revoke does not make a request for a review within the period provided for in the regulations, the Bank must revoke the accredited third-party service provider’s accreditation or withdraw the notice of intent. The Bank must, as soon as feasible, notify the accredited third-party service provider in writing of the decision and the reasons for it.
Reference to revocation in registryIf the Governor revokes an accredited third-party service provider’s accreditation under subsection 39(2) or the Bank does so under section 40, the Bank must, as soon as feasible, include a reference to the revocation in the registry.
Duties of former accredited third-party service providerA third-party service provider whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection 39(3) or section 40, comply with its duties under this Act and, in accordance with the regulations, notify in writing any participating entities on whose behalf it was performing, at the time of the revocation, any of the activities for which it was accredited and provide those participating entities with any other information that is provided for in the regulations.
Appeal to Federal Court
Right of appealAn applicant that has been notified under subsection 21(3) or 34(3) of a decision to refuse accreditation, a participating entity that has been notified under subsection 26(3) of a decision to revoke its accreditation or an accredited third-party service provider that has been notified under subsection 39(3) of a decision to revoke its accreditation may appeal the decision to the Federal Court within the period provided for in the regulations or any longer period that the Court allows.Powers of Federal CourtThe Federal Court may dismiss the appeal or set aside the decision and refer the matter back to the Governor for redetermination.
Registry
RegistryThe Bank must maintain a public registry that includes the following information:the name and address of each participating entity;in the case of a participating entity that is a bank that is listed in the schedule, the date on which its name was added to the schedule;in the case of a participating entity that is accredited under section 15, 17 or 19, the date on which it was accredited;the status of each participating entity, the date of any change to its status and, if applicable, the reasons for which its accreditation was revoked;any other information provided for in the regulations in relation to a participating entity or the activities that it performs under this Act;the name and address of each accredited third-party service provider and the date on which it was accredited;the status of each accredited third-party service provider, the date of any change to its status and, if applicable, the reasons for which its accreditation was revoked; andany other information provided for in the regulations in relation to an accredited third-party service provider or the activities that it performs under this Act.
National SecurityDesignation
DesignationThe Minister may designate a person or government authority for the purposes of subsections 15(4), 17(4), 19(4) and 32(4), section 46, paragraph 51(e), section 54, paragraph 66(1)(e), sections 71 and 73, subsections 98(3) and 120(3) and sections 132, 137, 139 and 173.
Review of Application for Accreditation
Copy of applicationThe Bank must, as soon as feasible after determining that an application for accreditation is complete, provide the Minister and any designated person or government authority with a copy of the application.
Decision to review applicationThe Minister may, within the period provided for in the regulations, decide to review an application for accreditation if the Minister is of the opinion that it is necessary to do so for reasons related to national security. In that case, the Minister must notify the Bank of the decision and the Bank must then notify the applicant.Extension of periodThe Minister may extend the period for one or more periods provided for in the regulations if the Minister considers it necessary to do so and notifies the Bank. In that case, the Bank must notify the applicant of the extension.
ReviewIf the Minister decides to review an application for accreditation, the Minister must conduct the review within the period provided for in the regulations. After completing the review, the Minister must issue a directive to refuse accreditation to the Bank under section 51 or notify the Bank that the Minister has decided not to issue a directive under that section.Extension of periodThe Minister may extend the period for conducting the review for one or more periods provided for in the regulations if the Minister considers it necessary to do so and notifies the Bank. In that case, the Bank must notify the applicant of the extension.
Notice to applicantIf the Bank is notified that the Minister has decided not to issue a directive under section 51, the Bank must notify the applicant of the decision.
No accreditationThe Bank must not accredit an applicant during a period referred to in subsection 47(1) or (2) unless the Minister notifies the Bank that the Minister has decided not to review the application. If the Minister notifies the Bank that the Minister has decided to review the application, the Bank must not accredit the applicant unless the Minister notifies the Bank that the Minister has decided not to issue a directive under section 51.
Directive to refuse accreditationThe Minister may issue a directive to the Bank to refuse to accredit an applicant ifthere are reasons related to national security;the applicant has failed to provide additional information in accordance with section 54;an order made under section 55, or an undertaking required under that section, that relates to the application for accreditation has not been complied with;a term or condition imposed under section 56 that relates to the application for accreditation has not been complied with; orthe applicant has provided false or misleading information to the Bank, the Minister or a designated person or government authority.
Refusal to accreditThe Bank must refuse to accredit an applicant if the Minister issues a directive to that effect and must, as soon as feasible, notify the applicant in writing that the application has been refused in accordance with a directive issued by the Minister.
Review of directiveAn applicant that has been notified under section 52 may, within the period provided for in the regulations, request a review by the Minister of the directive to refuse accreditation. The request must be submitted to the Bank, which must then, as soon as feasible, transmit it to the Minister.Decision and noticeOn completion of the review and after giving the applicant an opportunity to make representations, the Minister must confirm or revoke the directive. The Minister must notify the Bank of the decision and the Bank must then, as soon as feasible, notify the applicant in writing.
Additional informationAn applicant must provide the Minister and any designated person or government authority with any additional information that the Minister or the designated person or government authority requests, for reasons related to national security, in relation to the applicant or the activities that the applicant plans to perform under this Act.MannerA request for information under subsection (1) must be submitted to the Bank, which must then, as soon as feasible, transmit it to the applicant. The applicant must, within the period provided for in the regulations, provide the requested information to the Bank, which must then, as soon as feasible, provide it to the Minister and any designated person or government authority.
Undertakings and Terms and Conditions
UndertakingsThe Minister may, by order, require any individual or entity to provide an undertaking in relation to an application for accreditation or in relation to a participating entity or accredited third-party service provider if the Minister is of the opinion that it is necessary to do so for reasons related to national security.
Terms and conditionsThe Minister may, by order, impose terms and conditions on any individual or entity in relation to an application for accreditation or in relation to a participating entity or accredited third-party service provider if the Minister is of the opinion that it is necessary to do so for reasons related to national security.
Revocation, suspension or amendmentThe Minister may, by order, revoke or suspend an undertaking required by the Minister or approve its amendment, or revoke, suspend or amend any terms and conditions imposed by the Minister.
Effect on accreditationUnless otherwise expressly provided in this Act, a failure to comply with an order made under section 55, an undertaking required under that section or any terms and conditions imposed under section 56 does not invalidate an accreditation to which the order, undertaking or terms and conditions relate.
Copy to BankThe Minister must provide a copy of each order made under sections 55 to 57 to the Bank, which must then, as soon as feasible, provide a copy to the individual or entity in question.
National security orderThe Minister may, by order, direct a participating entity, an accredited third-party service provider or any director, officer or agent or mandatary of a participating entity or accredited third-party service provider to take or refrain from taking any measures related to the activities that the participating entity or accredited third-party service provider performs under this Act if the Minister is of the opinion that it is necessary to do so for reasons related to national security.RepresentationsSubject to subsection (3), the Minister must not make an order under subsection (1) unless the participating entity, accredited third-party service provider, entity or individual in question is provided with an opportunity to make representations in respect of the matter.Temporary orderIf, in the Minister’s opinion, the length of time required for representations to be made might be prejudicial to the public interest, the Minister may make a temporary order that has the same effect as an order made under subsection (1).End of temporary orderA temporary order ceases to have effect on the earlier ofthe end of the 30-day period after the day on which it is made or of any shorter period that is specified in the temporary order, andthe day on which an order is made under subsection (1).
National security order — revocationThe Minister may, by order, direct a participating entity or third-party service provider whose accreditation is revoked under subsection 69(1), or any director, officer or agent or mandatary of the participating entity or third-party service provider, to take or refrain from taking any measures related to the activities that the participating entity or third-party service provider performed under this Act if the Minister is of the opinion that it is necessary to do so for reasons related to national security.RepresentationsSubject to subsection (3), the Minister must not make an order under subsection (1) unless the participating entity, third-party service provider, entity or individual in question is provided with an opportunity to make representations in respect of the matter.Temporary orderIf, in the Minister’s opinion, the length of time required for representations to be made might be prejudicial to the public interest, the Minister may make a temporary order that has the same effect as an order made under subsection (1).End of temporary orderA temporary order ceases to have effect on the earlier ofthe end of the 30-day period after the day on which it is made or of any shorter period that is specified in the temporary order, andthe day on which an order is made under subsection (1).
Notice — Committee and Review AgencyThe Minister must, within 30 days after the day on which an order is made under subsection 60(1) or (3) or 61(1) or (3), notifythe National Security and Intelligence Committee of Parliamentarians established by section 4 of the National Security and Intelligence Committee of Parliamentarians Act; andthe National Security and Intelligence Review Agency established under section 3 of the National Security and Intelligence Review Agency Act.
Copy to BankThe Minister must provide a copy of each order made under subsection 60(1) or (3) or 61(1) or (3) to the Bank, which must then, as soon as feasible, provide a copy to the individual or entity in question.
Confidential informationThe Minister may specify that information about an undertaking required by an order made under section 55, terms and conditions imposed by an order made under section 56 or an order made under subsection 60(1) or (3) or 61(1) or (3), or information that could reveal the existence of the undertaking, terms and conditions or order, is confidential and must be treated accordingly.ProhibitionDespite anything in this Act, it is prohibited for any individual or entity to disclose any confidential information referred to in subsection (1) except for the purposes of subsection (3) or section 59 or 63 or in accordance with any conditions that the Minister may specify.Notice — Committee and Review AgencyIf the Minister specifies under subsection (1) that information is confidential, the Minister must, within 30 days after the day on which the order in question is made under section 55 or 56 or subsection 60(1) or (3) or 61(1) or (3), notifythe National Security and Intelligence Committee of Parliamentarians established by section 4 of the National Security and Intelligence Committee of Parliamentarians Act; andthe National Security and Intelligence Review Agency established under section 3 of the National Security and Intelligence Review Agency Act.
Court enforcementIf an individual or entity is not complying with an undertaking required by an order made under section 55, terms and conditions imposed by an order made under section 56 or an order made under subsection 60(1) or (3) or 61(1) or (3), the Minister may, in addition to any other action that may be taken under this Act, apply to a superior court for an order requiring the individual or entity to comply with the undertaking, terms and conditions or order.Powers of courtThe court may make the order and any other order that it thinks fit.AppealAn appeal from an order made under subsection (2) lies in the same manner and to the same court as an appeal from any other order of the court.
Suspension and Revocation
Notice of intent — directive to revokeThe Minister may issue to the Bank a notice of the Minister’s intent to issue a directive to the Bank to revoke a participating entity’s or accredited third-party service provider’s accreditation ifthere are reasons related to national security;the participating entity or accredited third-party service provider has failed to provide additional information in accordance with section 71;an order made under section 55, or an undertaking required under that section, that relates to the participating entity or accredited third-party service provider has not been complied with;a term or condition imposed under section 56 that relates to the participating entity or accredited third-party service provider has not been complied with;the participating entity or accredited third-party service provider has provided false or misleading information to the Bank, the Minister or a designated person or government authority; orthe participating entity or accredited third-party service provider or a director, officer or agent or mandatary of the participating entity or accredited third-party service provider has not complied with an order made under subsection 60(1) or (3).NoticeThe Bank must, as soon as feasible, notify in writing the participating entity or accredited third-party service provider in question of the notice of intent.
Review of notice of intentA participating entity or accredited third-party service provider that has been notified under subsection 66(2) may, within the period provided for in the regulations, request a review of the notice of intent by the Minister. The request must be submitted to the Bank, which must then, as soon as feasible, transmit it to the Minister.Temporary suspensionIf, in the Minister’s opinion, the length of time required for a review of the notice of intent might be prejudicial to the public interest, the Minister may issue a directive to the Bank to immediately suspend the participating entity’s or accredited third-party service provider’s accreditation while the review is being undertaken.Suspension and noticeThe Bank must immediately suspend the participating entity’s or accredited third-party service provider’s accreditation if the Minister issues a directive to that effect under subsection (2). The Bank must then, as soon as feasible, notify the participating entity or accredited third-party service provider in writing that its accreditation has been suspended in accordance with a directive issued by the Minister.Reference to suspension in registryThe Bank must immediately include a reference to the suspension in the registry.Effect of suspension — participating entityA participating entity that is notified that its accreditation has been suspended under subsection (3) must immediately cease all consumer-driven banking activities that it performs under this Act.Effect of suspension — accredited third-party service providerAn accredited third-party service provider that is notified that its accreditation has been suspended under subsection (3) must immediately cease all activities for which it is accredited.DecisionOn completion of the review and after giving the participating entity or accredited third-party service provider an opportunity to make representations, the Minister must withdraw the notice of intent or issue a directive to the Bank to revoke the accreditation.NoticeIf the Minister decides to withdraw the notice of intent, the Minister must notify the Bank, which must then immediately notify the participating entity or accredited third-party service provider in writing, end any suspension and remove any reference to the suspension from the registry.
Review not requestedIf a participating entity or accredited third-party service provider that has been notified under subsection 66(2) does not request a review of the notice of intent within the period provided for in the regulations, the Minister must withdraw the notice of intent or issue a directive to the Bank to revoke the accreditation.
Revocation of accreditationThe Bank must revoke a participating entity’s or accredited third-party service provider’s accreditation if the Minister issues a directive to that effect under subsection 67(7) or section 68.Notice of revocationThe Bank must, as soon as feasible, notify the participating entity or accredited third-party service provider in writing that its accreditation has been revoked in accordance with a directive issued by the Minister.Reference to revocation in registryThe Bank must, as soon as feasible, include a reference to the revocation in the registry.Duties of former participating entityA participating entity whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection (2), comply with its duties under this Act and, in accordance with the regulations, notify in writing any consumers that used the services that it provided in accordance with this Act and provide those consumers with any other information that is provided for in the regulations.Duties of former accredited third-party service providerA third-party service provider whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection (2), comply with its duties under this Act and, in accordance with the regulations, notify in writing any participating entities on whose behalf it was performing, at the time of the revocation, any of the activities for which it was accredited and provide those participating entities with any other information that is provided for in the regulations.
Notice — Committee and Review AgencyWithin 30 days after the day on which the Minister issues a directive under subsection 67(2), the Minister must notifythe National Security and Intelligence Committee of Parliamentarians established by section 4 of the National Security and Intelligence Committee of Parliamentarians Act; andthe National Security and Intelligence Review Agency established under section 3 of the National Security and Intelligence Review Agency Act.
Additional informationA participating entity or accredited third-party service provider must provide the Minister and any designated person or government authority with any additional information that the Minister or the designated person or government authority requests, for reasons related to national security, in relation to the participating entity or the activities that it performs under this Act or in relation to the accredited third-party service provider or the activities for which it is accredited.MannerA request for information under subsection (1) must be submitted to the Bank, which must then, as soon as feasible, transmit it to the participating entity or accredited third-party service provider. The participating entity or accredited third-party service provider, as the case may be, must, within the period provided for in the regulations, provide the requested information to the Bank, which must then, as soon as feasible, provide it to the Minister and any designated person or government authority.
Notice to appropriate provincial authorityIf the Bank gives notice under subsection 67(3) or (8) or 69(2) to a participating entity that is a provincial financial institution, the Bank must, as soon as feasible, notify the appropriate provincial authority that regulates or supervises the provincial financial institution.
General
Personal informationThe Minister is not authorized to make a request or an order under section 54, 55, 56, 60, 61 or 71 requiring an individual, a participating entity, an accredited third-party service provider or any other entity to provide the Minister or any designated person or government authority with a consumer’s personal information.
Decisions and orders finalDecisions and orders made by the Minister under this Act are final and binding and, except for judicial review under the Federal Courts Act, are not subject to appeal or to review by any court.
Advice and information to MinisterThe Bank must, at least once every year, provide the Minister with advice and information on matters relating to national security and the integrity or security of the financial system in Canada, as those matters relate to the Minister’s exercise of powers or performance of duties and functions under this Act.Consultation — Superintendent of Financial InstitutionsThe Bank must consult the Superintendent of Financial Institutions before providing the Minister with advice or information that relates to a federal financial institution.
Duties of Participating EntitiesData Sharing
Sharing as directed by consumerUnless otherwise prohibited by law and subject to the regulations, a participating entity must share a consumer’s data with other participating entities as directed by the consumer.Technical standardA participating entity that shares a consumer’s data must do so in compliance with the technical standard referred to in subsection 125(1).No conditionSubject to the regulations, a participating entity must not impose any conditions on another participating entity for the sharing of a consumer’s data in accordance with this Act.Notice to BankUnless otherwise prohibited by law, a participating entity must notify the Bank, within the time and in the manner specified by the Bank, if the participating entity does not share a consumer’s data as required by subsection (1).
No charge for sharingA participating entity must not impose a charge for sharing a consumer’s data in accordance with this Act, including for obtaining or renewing a consumer’s consent or for withdrawing that consent.
Credit or refundIf a participating entity imposes a charge on a consumer for sharing the consumer’s data in accordance with this Act, the participating entity must credit the amount of the charge to the consumer or, if the amount was collected, refund it.InterestThe amount referred to in subsection (1) bears interest beginning on the day on which the charge is imposed, at a rate equal to the Bank’s overnight rate on that day, and ending on the day on which the amount is refunded or credited.
Security
Security safeguardsA participating entity must implement the security safeguards that are provided for in the regulations.Notice to BankA participating entity must notify the Bank, as soon as feasible and in the manner specified by the Bank, of any change that has a significant impact on the participating entity’s compliance with the security safeguards.
Designated officer or employeeA participating entity must designate one of its officers or employees to be responsible for the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act.
Mitigating harmA participating entity must establish policies and procedures to mitigate the harm to consumers that may result from a breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act.
Report to BankA participating entity must report to the Bank any breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act if the breach involves consumer data that is under the participating entity’s control.Report requirementsThe report must contain the information that is provided for in the regulations and must be made, in the form and manner specified by the Bank, immediately after the participating entity determines that a breach of the security safeguards has occurred.Notice to consumerUnless otherwise prohibited by law, a participating entity must notify a consumer of any breach of the security safeguards that involves the consumer’s data that is under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the consumer.Contents of noticeThe notice must contain sufficient information to allow the consumer to understand the significance of the breach to them and to take steps, if any are possible, to reduce the risk of harm that could result from the breach or to mitigate that harm. The notice must contain any other information that is provided for in the regulations.Manner of noticeThe notice must be conspicuous and must be given to the consumer in the manner provided for in the regulations.Timing of noticeThe notice must be given as soon as feasible after the participating entity determines that the breach has occurred.Definition of significant harmFor the purposes of this section, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, of business or of professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.Real risk of significant harm — factorsThe factors that are relevant to determining whether a breach of security safeguards creates a real risk of significant harm to a consumer includethe sensitivity of the consumer data involved;the probability that the consumer data has been, is being or will be misused; andany other factor provided for in the regulations.
Duty to investigateA participating entity must investigate every breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act, for the purposes of identifying any significant, recurring or systemic problems and remedying the problems identified. The participating entity must report the conclusions of every investigation to the Bank in accordance with the regulations.
NoticeIf a participating entity identifies a significant, recurring or systemic problem that may have an impact on the consumer-driven banking system, the participating entity must, as soon as feasible, notify the Bank, which may then notify other participating entities.
Consent
Express consent requiredA participating entity must obtain a consumer’s express consent before requesting that another participating entity provide it with the consumer’s data.Use not consentUse by the consumer of a product or service does not constitute express consent for the purposes of subsection (1).Oral consent — written confirmationIf the express consent is given orally, the participating entity must immediately confirm the consumer’s express consent in writing.Information to consumerThe participating entity must provide a consumer with the following information before obtaining the consumer’s express consent:a description of the data in respect of which it is seeking the consumer’s express consent;a description of how it will use the data;the period during which the consumer’s consent will be valid, which must not exceed the period referred to in section 86; andany other information that is provided for in the regulations.Clear, simple and not misleadingAny communication from a participating entity seeking to obtain a consumer’s express consent to have the participating entity receive the consumer’s data, including for the purposes of providing information under subsection (4), must be made in a manner, and using language, that is clear, simple and not misleading.Consent — use of dataSubject to the regulations, a participating entity must use the data of a consumer that it receives from another participating entity only for the uses described in the information that is provided to the consumer under paragraph (4)(b).Use of data — product or serviceA participating entity must not require a consumer to consent to the sharing of the consumer’s data beyond what is necessary for the participating entity to provide the consumer with a product or service.Record of consentA participating entity must keep a record of each express consent obtained.ClarificationNothing in this section renders ineffective any federal or provincial legislative or regulatory provision requiring a participating entity that provides data to obtain a consumer’s express consent.
Duration of consentA consumer’s express consent may be valid for a period of not more than 12 months after the day on which a participating entity obtains it.
Renewal of consentA participating entity must renew a consumer’s express consent within seven days after the day on which the period for which the consumer’s consent was last obtained or renewed ends or within seven days after the day on which the participating entity becomes aware of any circumstance provided for in the regulations.RequirementsSubsections 85(2) to (9) apply to a renewal of express consent.Suspension of receipt of dataA participating entity that is required to renew a consumer’s express consent under subsection (1) must immediately stop receiving the consumer’s data until it has renewed the consumer’s consent to do so.Notice to consumerIf the participating entity fails to renew the consumer’s consent within the period referred to in subsection (1), it must, immediately after the end of the period,inform the consumer of the consequences of not renewing their consent;inform the consumer that they may request that the participating entity delete the data in respect of which consent was not renewed and of the manner in which that request may be made; andprovide the consumer, in accordance with the regulations, with any information provided for in the regulations.Duty to delete dataUnless otherwise prohibited by law and subject to the regulations, the participating entity must, at the request of the consumer, delete the data in respect of which consent was not renewed.
Consent obtained by deceptionA participating entity must not obtain or renew, or attempt to obtain or renew, a consumer’s express consent by providing false or misleading information or using deceptive or misleading practices.
Undue pressure or coercionA participating entity must not obtain or renew, or attempt to obtain or renew, a consumer’s express consent by imposing undue pressure on the consumer or coercing them.
Withdrawal of consentA consumer may withdraw their consent, in whole or in part, by notifying the participating entity that obtained the consent.InformationIf the consumer notifies the participating entity of their intention to withdraw their consent, the participating entity must immediatelyinform the consumer of the consequences of withdrawing their consent;inform the consumer that they may request that the participating entity delete the data in respect of which consent was withdrawn and of the manner in which that request may be made; andprovide the consumer, in accordance with the regulations, with any information provided for in the regulations.Effect of withdrawalIf the consumer confirms that they withdraw their consent after receiving the information referred to in subsection (2), the participating entity must, immediately or at any later date that is specified by the consumer, stop receiving the data in respect of which consent was withdrawn and notify the participating entity that was providing the data of the withdrawal of consent.Duty to delete dataUnless otherwise prohibited by law and subject to the regulations, the participating entity must, at the request of the consumer, delete the data in respect of which consent was withdrawn.
Request to stop providing dataA consumer may request that a participating entity stop providing their data, in whole or in part, to another participating entity.DutiesIf a consumer requests that a participating entity stop providing their data, the participating entity must immediatelystop providing the consumer’s data in accordance with the request;inform the consumer that there might be consequences for stopping the provision of the data and that the consumer should contact the participating entity that was receiving the data; andinform the participating entity that was receiving the data that it has stopped providing the data at the consumer’s request.
Consumer Authentication
Authentication requirementsBefore providing a consumer’s data to another participating entity, a participating entity must confirmthe consumer’s authentication information;the period for which the consumer’s express consent is valid; andthe products and services in respect of which the data is to be provided.Prohibited conditionsA participating entity must not, as a condition of providing a consumer’s data to another participating entity,require the consumer to consent to being provided with a product or service; orrequire the consumer to consent to the participating entity receiving their data from the other participating entity.
Renewal of consentIn the circumstances and within the period provided for in the regulations, a participating entity that is providing a consumer’s data to another participating entity must request that the other participating entity renew the consumer’s express consent in accordance with section 87.
Consumer Measures
Display of signA participating entity must, in the form specified by the Bank, prominently display a sign indicating that it is a participating entityat each of the locations in Canada at which it offers services in accordance with this Act; andon the home page of each of its websites and on each application through which it offers services in accordance with this Act.
Information in consumer dashboardA participating entity must, in a single location on its website or application,provide a consumer with up-to-date information aboutany other participating entities with which it is sharing the consumer’s data,the period for which the consumer’s consent to the sharing of their data is valid, andthe data that is being shared;provide the consumer with the option to renew their consent, if applicable; andprovide the consumer with the option to withdraw their consent or to request that their data stop being provided, as the case may be.
Clear, simple and not misleadingA participating entity must provide consumers with information in a manner, and using language, that is clear, simple and not misleading.Principles of accessibilityA participating entity must take principles of accessibility into account when providing consumers with information.Policies and proceduresA participating entity must establish policies and procedures respecting the manner in which it provides consumers with information related to the activities that it performs under this Act.Review and evaluationThe Bank must, from time to time, review and evaluate the policies and procedures referred to in subsection (3) to ensure that the participating entity is complying with this section.
False or misleading informationA participating entity must not provide false or misleading information to consumers or the public respecting the activities that it performs under this Act.
Provision of Information
Notice of changeA participating entity must notify the Bank of any change provided for in the regulations that relates to the participating entity or the activities that it performs under this Act.Timing of noticeThe notice must be given as soon as feasible after the participating entity becomes aware of the change but before the change takes effect. However, if a different period is provided for in the regulations, the notice must be given within that period.Notice to MinisterThe Bank must, as soon as feasible, notify the Minister and any designated person or government authority of any notice given under subsection (1).
Request for informationA participating entity must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act.
Annual reportingFollowing the end of its financial year, a participating entity must, within the time and in the form and manner specified by the Bank, submit a report to the Bank that includes the information that is provided for in the regulations.
General
Policies and procedures — integrity or securityA participating entity must establish policies and procedures to protect itself against threats to its integrity or security, including foreign interference, and must adhere to those policies and procedures.
Duty to keep recordsA participating entity must keep all records that are provided for in the regulations.
Liability
Consumer not liableSubject to the regulations, unless a consumer has demonstrated gross negligence or, in Quebec, gross fault, in safeguarding their authentication information, the consumer is not liable for any financial loss that arises directly from a loss of, unauthorized access to or unauthorized use of their data that occurs in relation to the sharing of data in accordance with this Act.ReportIf a consumer reports to a participating entity that their authentication information has been lost or stolen or is otherwise at risk of being used in an unauthorized manner, the consumer is not liable for any financial loss that is incurred, after the participating entity receives the report, as a result of the unauthorized use of their authentication information in relation to the sharing of data in accordance with this Act, unless the participating entity demonstrates, on a balance of probabilities, that the consumer contributed to the unauthorized use.Authentication informationThe unauthorized use of a consumer’s authentication information in relation to the sharing of data in accordance with this Act does not by itself establish that the consumer demonstrated gross negligence or, in Quebec, gross fault, in safeguarding their authentication information.
Responsibility for safeguarding dataA participating entity is responsible for safeguarding consumer data that is within its control in the course of the sharing of data between participating entities in accordance with this Act.Third-party service providerConsumer data continues to be within the control of a participating entity even if the participating entity uses a third-party service provider or an affiliate entity to perform its activities under this Act.Liability to consumerA participating entity is liable to a consumer for any financial loss that arises directly from a loss of, unauthorized access to or unauthorized use of the consumer’s data that results from a breach of the participating entity’s security safeguards that occurs in the course of the sharing of data in accordance with this Act.Third-party service providerA participating entity remains liable to a consumer under subsection (3) even if it uses a third-party service provider or an affiliate entity to perform its activities under this Act.
Complaints ProceduresInternal Complaints Process
Procedures for dealing with complaintsA participating entity mustestablish procedures that are satisfactory to the Bank for dealing with complaints;designate one of its officers or employees in Canada to be responsible for implementing those procedures; anddesignate one or more of its officers or employees in Canada to receive and deal with those complaints.Misleading termsA participating entity must not use any misleading term with respect to its procedures or designated officers or employees, including any term that suggests that the procedures, officers or employees are independent of the participating entity — such as the term “ombudsperson” or any other term with a similar meaning — or any term that is provided for in the regulations.Copy to BankA participating entity must provide the Bank with a copy of its most recent procedures, within the time and in the manner specified by the Bank.Information to complainantA participating entity must provide a person who makes a complaint witha written acknowledgment of the date on which it received the complaint;the information referred to in paragraphs 111(a) to (c); andany information that is necessary to enable the person to meet the requirements of the procedures referred to in paragraph 111(a).
Time for dealing with complaintA participating entity must deal with a complaint within 56 days after the day on which it receives the complaint.
Duty to inform complainantA participating entity must keep the person who made the complaint informed of the progress made in dealing with the complaint.
Record of complaintA participating entity must, with respect to each complaint, make a record that is to be retained for at least five years and that containsin the case of a complaint made in writing, the original version of the complaint;in the case of a complaint made orally,the recording or a transcript of the recording, if the complaint was recorded, orthe details of the complaint, if the complaint was not recorded;the name of the person who made the complaint;the name of the consumer whose data the complaint relates to, if the consumer is not the person who made the complaint;the contact information provided by the person who made the complaint;the date on which the participating entity received the complaint;a description of the nature of the complaint;the date on which the complaint was resolved, if, in the participating entity’s opinion, it was resolved to the satisfaction of the person who made the complaint;a description of any actions that the participating entity took to attempt to resolve the complaint;a description of any compensation provided to the person who made the complaint or to the consumer referred to in paragraph (d);confirmation that the participating entity provided the person who made the complaint with the information referred to in paragraphs 111(a) to (c), if it did so; andany other information provided for in the regulations.
Access to BankA participating entity must ensure that any record retained under section 108 is accessible to the Bank.
Annual informationFollowing the end of each financial year, a participating entity must, within the time and in the form and manner specified by the Bank, provide the Bank with the following information for that year:the number and nature of any complaints that were dealt with by the officer or employee designated by the participating entity to deal with complaints who holds the most senior position identified for that purpose in the procedures established by the participating entity;the average length of time taken to deal with the complaints received by that officer or employee;the number of complaints that, in the participating entity’s opinion, were resolved by that officer or employee to the satisfaction of the persons who made them; andany other information that is provided for in the regulations.
Complaints proceduresA participating entity must disclose to its consumers and the publicits procedures for dealing with complaints established under paragraph 105(1)(a);the name of the external complaints body and the manner in which that body may be contacted; andthe Bank’s mailing address, website address and telephone number.
Disclosure — consumers and publicA participating entity must disclose information to its consumers and the public under section 111 bydisplaying the information prominentlyat each of the locations in Canada at which it offers services in accordance with this Act, andon each of its websites and applications through which it offers services in accordance with this Act; andproviding the information to any person who requests it, in a commonly used format that is acceptable to the person.
External Complaints Process
PurposeThe purpose of sections 114 to 118 is to enhance the process for dealing with complaints by establishing a regime composed of a sole external complaints body that performs its functions and activities in a transparent, effective, timely and fair manner based on the principles of accessibility, accountability, impartiality and independence.
Designation of corporationThe Minister may, on the recommendation of the Bank, designate a corporation incorporated under the Canada Not-for-profit Corporations Act or under a provincial Act equivalent to that Act to be the external complaints body responsible for dealing with complaints referred to in paragraph 105(1)(a) that have not been resolved by its member participating entities to the satisfaction of the persons who made the complaints or that have not been dealt with within the period set out in section 106.Matters for considerationBefore designating a corporation, the Minister must take into account all factors that the Minister considers relevant, including whether the corporation hasthe reputation required under paragraph 115(a); andpolicies and procedures and terms of reference that would enable it to perform its functions and activities in a manner that is consistent with the purpose set out in section 113 and to comply with paragraphs 115(b) to (u).Obligation to be memberEvery participating entity must be a member of the external complaints body.Not agent of His MajestyThe external complaints body is not an agent of His Majesty.Designation to be publishedA designation made under subsection (1) must be published in the Canada Gazette.
RequirementsThe external complaints body mustmaintain a reputation for being operated in a manner that is consistent with the standards of good character and integrity;make its services available across Canada in both official languages and offer those services free of charge to persons who make complaints;establish policies, procedures and terms of reference that are satisfactory to the Bank with respect to, among other things, dealing with complaints and consulting, at least once a year, its member participating entities and consumers to allow them to raise concerns about the external complaints body;establish the manner of calculating, to the satisfaction of the Bank, the fees it charges to each of its member participating entities for its services;make information available to consumers about their rights and responsibilities in relation to the external complaints handling regime, respond to their inquiries and requests for information and offer them assistance in making complaints;inform the parties to a complaint about the external complaints body’s terms of reference and procedures for dealing with complaints and, on request, provide the parties with any additional information and assistance to enable them to understand the requirements of those terms of reference and procedures;deal with complaints in a manner that affects only the parties to the complaints;inform the Bank in writing within 30 days after the day on which the external complaints body determines that a complaint raises a potential systemic issue;if it determines that all or part of a complaint is not within its terms of reference, provide the person who made the complaint with written reasons for that determination and the name of any entity to which the person may make a complaint, within 30 days after the day on which it receives the complaint;obtain confirmation from the member participating entity to which each complaint relates regarding whether the period set out in section 106 has ended, unless the person who made the complaint has provided the external complaints body with the written acknowledgment referred to in paragraph 105(4)(a);impartially deal with complaints referred to in paragraph 105(1)(a) that have not been resolved by its member participating entities to the satisfaction of the persons who made the complaints or that have not been dealt with within the period set out in section 106;no later than 120 days after the day on which it has all of the information that it requires to deal with a complaint, make a final written recommendation to the parties;immediately inform the Bank, in writing, of cases in which a member participating entity does not comply with a final recommendation;within 90 days after making a final recommendation, make available on its website free of charge a summary of the final recommendation that includesa description of the nature of the complaint that is the subject of the final recommendation,the name of the member participating entity that received the complaint,a description of any compensation provided to the person who made the complaint or to the consumer referred to in paragraph 108(d),the reasons for the final recommendation, andany other information that is provided for in the regulations;within 60 days after the end of each quarter, submit to the Bank, in a form satisfactory to the Bank,in relation to all investigations completed during the quarter, a copy of the record of the complaint, andany other information that is provided for in the regulations;within 60 days after the end of each financial year, meet with the Bank to discuss, among other things, complaints, operations and market trends and issues respecting consumer-driven banking that have the potential to impact consumers;within 135 days after the end of each financial year, file with the Bank a written report on the performance of its functions and activities in respect of consumer-driven banking for that year, which report is to includeinformation aboutits constitution, governance and terms of reference and the identity of its member participating entities,all sources of funding for its functions and activities, including the fees charged to each of its member participating entities for its services and the manner in which those fees are calculated, andthe results of the most recent evaluation referred to in paragraph (s),a summary of the results of any consultation with its member participating entities and with persons who made complaints,in respect of each of its member participating entities, the number and nature of complaints that it received, the number of complaints that it determined were within its terms of reference, the number of final recommendations that it made and the number of complaints that, in its opinion, were resolved to the satisfaction of the persons who made them,the average length of time taken to deal with complaints,the number of complaints that it determined were not within its terms of reference and the reasons for that determination,the number of complaints for which a member participating entity did not comply with a final recommendation,the number of final recommendations in which compensation was recommended, andthe average and total compensation provided with respect to complaints that it determined were within its terms of reference;immediately after the report referred to in paragraph (q) is filed with the Bank, make that report available on its website free of charge and provide any person who requests it with a copy;submit, every five years, to an evaluation of the performance of its functions and activities in respect of consumer-driven banking that is conducted, at the discretion of the Bank, by the Bank or a third party in accordance with terms of reference that the external complaints body establishes in consultation with the Bank;accept as a member any participating entity that makes a request to it for membership, other than a participating entity that is exempted or is a member of a class that is exempted under subsection 119(1); andmeet any other requirements that are provided for in the regulations.
Provision of information — external complaints bodyA participating entity must provide the external complaints body with all information in its possession or control that relates to a complaint immediately after the external complaints body notifies it that the complaint has been received.
Clear, simple and not misleadingIf a participating entity or the external complaints body is required under sections 105 to 116 to provide information, it must do so in a manner, and using language, that is clear, simple and not misleading.
Request for informationThe external complaints body must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act.
Exemption
Minister’s orderIf the Minister is of the opinion that a participating entity is a member of or is otherwise supervised by — or that the members of a class of participating entities are members of or are otherwise supervised by — a body that exercises powers and performs duties and functions that are substantially similar to those that are conferred on the external complaints body under this Act, the Minister may, by order, exempt the participating entity or the class of participating entities from the application of subsection 114(3).Effect of orderA participating entity that is exempted or is a member of a class that is exempted under subsection (1) must not be a member of the external complaints body for the purposes of this Act and the provisions of this Act respecting the external complaints body do not apply in respect of the participating entity or class.
Duties of Accredited Third-Party Service Providers
Notice of changeAn accredited third-party service provider must notify the Bank of any change provided for in the regulations that relates to the accredited third-party service provider or the activities for which it is accredited.Timing of noticeThe notice must be given as soon as feasible after the accredited third-party service provider becomes aware of the change but before the change takes effect. However, if a different period is provided for in the regulations, the notice must be given within that period.Notice to MinisterThe Bank must, as soon as feasible, notify the Minister and any designated person or government authority of any notice given under subsection (1).
Request for informationAn accredited third-party service provider must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act.
Duty to keep recordsAn accredited third-party service provider must keep all records that are provided for in the regulations.
Disclosure Protection
Disclosure — employee of participating entityAn employee of a participating entity who has reasonable grounds to believe that the participating entity or any individual or other entity has committed or intends to commit a wrongdoing may report the particulars of the matter to the Bank, a government authority, a regulatory body or a law enforcement agency.Disclosure — employee of technical standards bodyAn employee of the technical standards body who has reasonable grounds to believe that the technical standards body or any individual or other entity has committed or intends to commit a wrongdoing may report the particulars of the matter to the Bank, a government authority, a regulatory body or a law enforcement agency.ConfidentialityThe Bank, government authority, regulatory body or law enforcement agency must keep confidential the identity of the employee and any information that could reasonably be expected to reveal their identity.Exception — investigationDespite subsection (3), the Bank, government authority, regulatory body or law enforcement agency may disclose to one another the employee’s identity and information that could reasonably be expected to reveal the employee’s identity for purposes related to an investigation.NoticeIf the Bank, government authority, regulatory body or law enforcement agency discloses the identity of the employee or information under subsection (4), they must make every reasonable effort to inform the employee of the disclosure.Definition of wrongdoingIn this section, wrongdoing means a contravention of this Act or the regulations and, with respect to a participating entity, a contravention of a policy or procedure established by the participating entity in relation to its compliance with this Act.
Designation — Provincial Authority
DesignationAt the request of a provincial minister who has responsibilities that are similar to those of the Minister, the Minister may, by order, designate a department or agency of a province to, in the place of the Bank, supervise a participating entity that is a provincial financial institution or a class of participating entities that are provincial financial institutions for the purposes of any of sections 79 to 93, 95 to 97 and 103 to 112.Provisions and participating entitiesIn the order, the Minister must specify the provisions, from among those referred to in subsection (1), to which the designation relates and the participating entity or class of participating entities in respect of which it applies.Agreement or arrangementThe Minister may only make an order if the Bank has entered into an agreement or arrangement with the department or agency of a province respecting the sharing of information and the supervision of participating entities.RevocationThe Minister may revoke an order made under subsection (1) and must do so at the request of the provincial minister referred to in that subsection.
Technical Standard
Designation of bodyThe Minister may, by order, designate a body to be the technical standards body that is responsible for establishing the technical standard that is to be used for the sharing of data by participating entities in accordance with this Act.FactorsIn designating the technical standards body, the Minister must take into account the following factors:the need to ensure the safe, secure and efficient sharing of data among participating entities;fairness, accessibility, transparency and good governance;whether the body is incorporated, formed or otherwise organized in Canada;the independence of the body in exercising its powers and performing its duties and functions;the body’s ability to exercise its powers and perform its duties and functions in a manner that is consistent with the purposes of this Act;any other factor that the Minister considers relevant; andany other factor provided for in the regulations.Publication in Canada GazetteThe Minister must publish the order in the Canada Gazette.
ReviewThe Minister must review the designation every three years.
RevocationThe Minister may, by order, revoke the designation, including in the following circumstances:the Bank advises the Minister to do so;the Minister is of the opinion that the designation is no longer consistent with any factor referred to in subsection 125(2);the Minister is of the opinion that the designation poses a risk to national security; orthe Minister is of the opinion that the designation poses a risk to the integrity or security of the financial system in Canada.Publication in Canada GazetteThe Minister must publish the order in the Canada Gazette.
Annual reportThe technical standards body must submit an annual report to the Bank in accordance with the regulations.
Change that has significant impactThe technical standards body must notify the Bank of any change that has a significant impact on the technical standards body or the technical standards, including any change to the operation of the technical standard referred to in subsection 125(1) or the governance, composition or decision making of the technical standards body, as soon as feasible but no later than the seventh day after the day on which the change takes effect.
Request for informationThe technical standards body must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act.
Confidentiality of Information
Information obtained by BankSubject to subsections (2) and (3), information that is obtained under this Act by the Bank, and any information prepared from that information, is confidential and must be treated accordingly.Disclosure permittedThe Bank may disclose information that is obtained under this Act if it is required to make the information public under subsection 7(1) or section 44 or if it does so under subsection 7(2) or section 168.Disclosure permitted — government authority or regulatory bodyThe Bank may disclose information that is obtained under this Act to the Minister or to any government authority or regulatory body that agrees to treat the information as confidential.
Information obtained by MinisterSubject to subsection (2), information that is obtained under this Act by the Minister or by a designated person or government authority, and any information prepared from that information, is confidential and must be treated accordingly.Disclosure permittedThe Minister or the designated person or government authority may disclose information that is obtained under this Act to a government authority or regulatory body that agrees to treat the information as confidential.
Evidentiary privilegeInformation provided for in the regulations that relates to the supervision of participating entities or accredited third-party service providers under this Act must not be used as evidence in any civil proceedings and is privileged for that purpose.No testimony or productionAn individual or entity must not by an order of any court, tribunal or other body be required in any civil proceedings to give oral testimony or to produce any document relating to any information referred to in subsection (1).Exception to subsection (1)Despite subsection (1), the Minister, the Governor, the Bank or the Attorney General of Canada may, in accordance with the regulations, use information referred to in that subsection as evidence in any proceedings.Exception to subsection (1)Despite subsection (1), a participating entity or accredited third-party service provider may, in accordance with the regulations, use information referred to in that subsection as evidence in any proceedings in relation to the administration or enforcement of this Act, the Bankruptcy and Insolvency Act or the Companies’ Creditors Arrangement Act that are commenced by the participating entity, the accredited third-party service provider, the Minister, the Governor, the Bank or the Attorney General of Canada.Exceptions to subsections (1) and (2)Despite subsections (1) and (2), a court, tribunal or other body may, by order, require the Minister, the Governor, the Bank, a participating entity or an accredited third-party service provider to give oral testimony or produce any document relating to any information referred to in subsection (1) in any civil proceedings in relation to the administration or enforcement of this Act that are commenced by the Minister, the Governor, the Bank, the Attorney General of Canada, a participating entity or an accredited third-party service provider.No waiverThe disclosure of any information referred to in subsection (1), other than under subsection (3), (4) or (5), does not constitute a waiver of the privilege referred to in subsection (1).
Advisory and Other Committees
Advisory and other committeesThe Bank may establish advisory and other committees to advise or assist the Bank on matters relating to consumer-driven banking and may provide for their membership, duties, functions and operation.Remuneration and expensesMembers of a committee may be paid for their services the remuneration and expenses that the Bank may determine.
Advisory committeeThere is established an advisory committee to provide advice to the Minister and the Bank on matters relating to consumer-driven banking. The advisory committee consists ofone representative appointed by the Minister;one or two representatives designated by each province; andone representative designated by the Bank.Co-chairperson — MinisterThe representative appointed by the Minister is a co-chairperson of the advisory committee.Co-chairperson — provincial representativeThe other co-chairperson is to be chosen, from among the members who are designated by the provinces, by those members to hold office for a one-year term. That co-chairperson is not authorized to hold that office for consecutive terms.Co-chairperson absent or unable to actIf the co-chairperson chosen under subsection (3) is absent or unable to act, the members who are designated by the provinces may choose another one of those members to act as co-chairperson.Annual reportThe advisory committee must report, at least once every calendar year, to the Minister and the relevant provincial ministers who have responsibilities that are similar to those of the Minister.
No Liability
No liability — BankNo action lies against His Majesty, any officer, employee or director of the Bank or any person acting under the direction of the Governor for anything done or omitted to be done in good faith in the administration or discharge of any powers, duties or functions that under this Act are intended or authorized to be exercised or performed.
No liability — MinisterNo action lies against His Majesty, the Minister, any designated person or government authority or any person acting under the direction of the Minister for anything done or omitted to be done in good faith in the administration or discharge of any powers, duties or functions that under this Act are intended or authorized to be exercised or performed.
Not Compellable
Not compellable — BankAn officer, employee or director of the Bank or any person acting under the instructions of the Governor is not a compellable witness in any civil proceedings in respect of any matter coming to their knowledge as a result of exercising any of their powers or performing any of their duties or functions under this Act.
Not compellable — MinisterThe Minister, a designated person or government authority or any person acting under the instructions of the Minister or the designated person or government authority is not a compellable witness in any civil proceedings in respect of any matter coming to their knowledge as a result of exercising any of their powers or performing any of their duties or functions under this Act.
Assessment of Fees
Bank to ascertain expensesThe Bank must, before September 30 of each year, ascertain the total amount of expenses incurred by it during the immediately preceding calendar year for or in connection with the administration of this Act and deduct from that amount any accreditation fees paid to it in that preceding calendar year.Amount conclusiveThe amount ascertained is final and conclusive for the purposes of this section.AssessmentAs soon as feasible after ascertaining the amount, the Bank must, in the manner and to the extent provided for in the regulations, assess a portion of the total amount of expenses against each participating entity, each accredited third-party service provider and the external complaints body, in accordance with the regulations.Interim assessmentThe Bank may, during each calendar year, prepare an interim assessment against any participating entity, any accredited third-party service provider or the external complaints body.Assessment bindingEvery assessment and interim assessment is final and conclusive and binding on the participating entity or accredited third-party service provider against which it is made or the external complaints body.RecoveryEvery assessment and interim assessment constitutes a debt due to the Bank, is immediately payable and may be recovered as a debt in any court of competent jurisdiction.InterestInterest may be charged on the unpaid amount of an assessment or interim assessment at a rate equal to the rate prescribed under the Income Tax Act for amounts payable by the Minister of National Revenue as refunds of overpayments of tax under that Act in effect from time to time plus 2%.
Request for informationThe Bank may request in writing that a participating entity, an accredited third-party service provider or the external complaints body provide the Bank, within the period provided for in the regulations, with any information that the Bank considers necessary for the purposes of subsection 140(3) or (4).Compliance with requestThe participating entity, accredited third-party service provider or external complaints body must comply with the request.
Administration and EnforcementBank’s Powers
Request for informationThe Bank may request in writing that an individual or entity, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank considers necessary for a purpose related to verifying compliance with an undertaking required under section 55 or terms and conditions imposed under section 56.Compliance with requestThe individual or entity must comply with the request.
Examination and inquiryThe Bank must, from time to time, make or cause to be made any examination and inquiry that the Bank considers necessary for the purposes of satisfying the Bank that participating entities, accredited third-party service providers, the external complaints body and the technical standards body are complying with this Act and, after the conclusion of each examination and inquiry, must report on it to the Minister.Access to recordsFor the purposes of this section, the Bankhas a right of access to any records of a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body; andmay require the directors or officers of a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body to provide information and explanations, to the extent that they are reasonably able to do so, in respect of any matter subject to examination or inquiry under this section.Special auditThe Bank may direct that a special audit of a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body be conducted, in accordance with any conditions that the Bank considers appropriate, if the Bank is of the opinion that the special audit is necessary for a purpose related to verifying compliance with this Act. The Bank may appoint an individual or entity to conduct the special audit.Duty to assistThe participating entity, accredited third-party service provider, external complaints body or technical standards body must give all assistance that is reasonably required to enable the appointed individual or entity to conduct the special audit and must provide any documents or information, and access to any data, that are specified by the individual or entity.Report to BankIf a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body is the subject of a special audit, it must provide the Bank with the results of the audit.Expenses payableThe expenses incurred in respect of any special audit are payable by the participating entity, accredited third-party service provider, external complaints body or technical standards body that is the subject of the audit.Notice to appropriate provincial authorityIf the Bank makes or causes to be made any examination, inquiry or audit in respect of a participating entity that is a provincial financial institution, the Bank must, as soon as feasible, notify the appropriate provincial authority that regulates or supervises the provincial financial institution.
DesignationThe Governor may designate persons or classes of persons as authorized persons for the purposes of sections 145 and 146.
Powers — authorized personAn authorized person may, from time to time, examine the records and inquire into the business and affairs of a participating entity for the purpose of verifying compliance with this Act and for that purpose mayenter any place in which the authorized person has reasonable grounds to believe that there are records relevant to verifying compliance with this Act;use any computer system in the place, or cause it to be used, to examine data contained in or available to it;reproduce any record or cause any record to be reproduced from the data, in the form of a printout or other intelligible output and remove the printout or other output for examination or copying; oruse any copying equipment in the place or cause it to be used.Duty to assistThe owner or person in charge of the place and every person in the place must give all assistance that is reasonably required to enable the authorized person to perform their functions under this section and must provide any documents or information, and access to any data, that are specified by the authorized person.
Warrant to enter dwelling-houseIf the place is a dwelling-house, an authorized person may enter it without the occupant’s consent only under the authority of a warrant issued under subsection (2).Authority to issue warrantOn ex parte application, a justice of the peace may issue a warrant authorizing an authorized person to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice is satisfied by information on oath thatthe dwelling-house is a place referred to in paragraph 145(1)(a);entry to the dwelling-house is necessary for a purpose related to verifying compliance with this Act; andentry was refused by the occupant or there are reasonable grounds to believe that entry will be refused by, or that consent to entry cannot be obtained from, the occupant.
Compliance agreementThe Bank may enter into a compliance agreement with a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body for the purpose of implementing any measure that is designed to further its compliance with this Act.
Directions — participating entityIf, in the Bank’s opinion, a participating entity, or another entity or individual in conducting the business or affairs of the participating entity, fails to comply — or there are reasonable grounds to believe that the participating entity or the entity or individual will fail to comply — with a compliance agreement, the Bank may direct the participating entity or the entity or individual to comply with the compliance agreement and to take any measures that in the Bank’s opinion are necessary to do so.Directions — policies and proceduresIf, in the Bank’s opinion, a participating entity does not have adequate policies and procedures to protect itself against threats to its integrity or security or a participating entity is not adhering to its policies and procedures in that matter, the Bank may direct the participating entity to take any measures that in the Bank’s opinion are necessary to remedy the situation.Directions — accredited third-party service providerIf, in the Bank’s opinion, an accredited third-party service provider, or another entity or individual in conducting the business or affairs of the accredited third-party service provider, fails to comply — or there are reasonable grounds to believe that the accredited third-party service provider or the entity or individual will fail to comply — with a compliance agreement, the Bank may direct the accredited third-party service provider or the entity or individual to comply with the compliance agreement and to take any measures that in the Bank’s opinion are necessary to do so.Directions — external complaints bodyIf, in the Bank’s opinion, the external complaints body fails, or there are reasonable grounds to believe that it will fail, to comply with a compliance agreement or any of paragraphs 115(b) to (u) or to perform its functions and activities in a manner that is consistent with the purpose set out in section 113, the Bank may direct the external complaints body to comply, to so perform its functions and activities and to take any measures that in the Bank’s opinion are necessary to do so.Directions — technical standards bodyIf, in the Bank’s opinion, the technical standards body fails to comply, or there are reasonable grounds to believe that it will fail to comply, with a compliance agreement, the Bank may direct the technical standards body to comply and to take any measures that in the Bank’s opinion are necessary to do so.RepresentationsSubject to subsection (7), the Bank must not make a direction under any of subsections (1) to (5) unless the participating entity, accredited third-party service provider, entity or individual in question or the external complaints body or technical standards body is provided with an opportunity to make representations in respect of the matter.Temporary directionIf, in the Bank’s opinion, the length of time required for representations might be prejudicial to the public interest, the Bank may make a temporary direction with respect to the matters referred to in any of subsections (1) to (5) that has effect for a period of not more than 15 days.Continued effectA temporary direction continues to have effect after the end of the 15-day period if no representations are made to the Bank within that period or, if representations have been made, the Bank notifies the participating entity, accredited third-party service provider, entity or individual, external complaints body or technical standards body that the Bank is not satisfied that there are sufficient grounds for revoking the direction.
Court enforcement — participating entityIf a participating entity, or another entity or individual in conducting the business or affairs of the participating entity, fails to comply with a compliance agreement or a direction made under section 148, contravenes a provision of this Act or the regulations or omits to do any thing that is required to be done under this Act, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the participating entity, entity or individual to comply with the compliance agreement or the direction, cease the contravention or do any thing that is required to be done. The court may make the order and any other order that it thinks fit.Court enforcement — accredited third-party service providerIf an accredited third-party service provider, or another entity or individual in conducting the business or affairs of the accredited third-party service provider, fails to comply with a compliance agreement or a direction made under section 148, contravenes a provision of this Act or the regulations or omits to do any thing that is required to be done under this Act, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the accredited third-party service provider, entity or individual to comply with the compliance agreement or the direction, cease the contravention or do any thing that is required to be done. The court may make the order and any other order that it thinks fit.Court enforcement — external complaints bodyIf the external complaints body fails to comply with a compliance agreement, any of paragraphs 115(b) to (u) or a direction made under section 148, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the external complaints body to comply with the compliance agreement, the paragraph or the direction. The court may make the order and any other order that it thinks fit.Court enforcement — technical standards bodyIf the technical standards body fails to comply with a compliance agreement or a direction made under section 148, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the technical standards body to comply with the compliance agreement or the direction. The court may make the order and any other order that it thinks fit.AppealAn appeal from a decision of a court under this section lies in the same manner and to the same court as an appeal from any other order of the court.
Notice to MinisterIf, in the Bank’s opinion, an individual or entity fails to comply, or there are reasonable grounds to believe that an individual or entity will fail to comply, with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3), the Bank must immediately notify the Minister.
Minister’s Powers
DesignationThe Minister may designate persons or classes of persons as authorized persons for the purposes of sections 152 to 154.
Request for informationAn authorized person may request in writing that an individual or entity, within the time and in the manner specified by the authorized person, provide the authorized person with any information that the authorized person considers necessary for a purpose related to verifying compliance with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3).Compliance with requestThe individual or entity must comply with the request.
Powers — authorized personAn authorized person may, from time to time, examine the records and inquire into the business and affairs of an individual or entity for the purpose of verifying compliance with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3) and for that purpose mayenter any place in which the authorized person has reasonable grounds to believe that there are records relevant to verifying compliance with the undertaking, terms and conditions or order;use any computer system in the place, or cause it to be used, to examine data contained in or available to it;reproduce any record or cause any record to be reproduced from the data, in the form of a printout or other intelligible output and remove the printout or other output for examination or copying; oruse any copying equipment in the place or cause it to be used.Duty to assistThe owner or person in charge of the place and every person in the place must give all assistance that is reasonably required to enable the authorized person to perform their functions under this section and must provide any documents or information, and access to any data, that are specified by the authorized person.
Warrant to enter dwelling-houseIf the place is a dwelling-house, an authorized person may enter it without the occupant’s consent only under the authority of a warrant issued under subsection (2).Authority to issue warrantOn ex parte application, a justice of the peace may issue a warrant authorizing an authorized person to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice is satisfied by information on oath thatthe dwelling-house is a place referred to in paragraph 153(1)(a);entry to the dwelling-house is necessary for a purpose related to verifying compliance with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3); andentry was refused by the occupant or there are reasonable grounds to believe that entry will be refused by, or that consent to entry cannot be obtained from, the occupant.
Administrative Monetary PenaltiesViolations
RegulationsThe Governor in Council may make regulationsdesignating as a violation the contravention of a specified provision of this Act or of the regulations or the non-compliance with orders made, undertakings required, compliance agreements entered into or directions made under this Act;establishing, having regard to subsection (2), a penalty or a range of penalties in respect of a violation;respecting the service of documents under sections 156 to 168, including the manner and proof of service and the circumstances under which documents are considered to be served;providing for the circumstances in which the Bank must not make public, under subsection 168(1), the name of the individual or entity that committed the violation; andgenerally, for carrying out the purposes and provisions of this section and sections 156 to 168.Maximum penaltiesThe maximum penalty for a violation is $1,000,000 if the violation is committed by an individual and $10,000,000 if the violation is committed by a participating entity or accredited third-party service provider.
Criteria for penaltyExcept if a penalty is fixed under paragraph 155(1)(b), the amount of a penalty must, in each case, be determined taking into accountthe degree of intention or negligence on the part of the individual or entity that committed the violation;the harm done by the violation;the duration of the violation;the ability of the individual or entity that committed the violation to pay the penalty;the history of the individual or entity that committed the violation with respect to any prior violation or conviction under this Act within the five-year period immediately before the violation; andany other criteria that may be provided for in the regulations.
Purpose of penaltyThe purpose of a penalty is to promote compliance with this Act and not to punish.
Violation or offenceIf a contravention or non-compliance that is designated under paragraph 155(1)(a) can be proceeded with either as a violation or as an offence, proceeding in one manner precludes proceeding in the other.
Proceedings
Commission of violationEvery contravention or non-compliance that is designated under paragraph 155(1)(a) constitutes a violation and the individual or entity that commits the violation is liable to a penalty determined in accordance with sections 155 and 156.Notice of violationIf the Bank believes on reasonable grounds that an individual or entity has committed a violation, the Bank may issue a notice of violation and, in that case, must cause it to be served on the individual or entity.Contents of noticeA notice of violation must name the individual or entity believed to have committed a violation, identify the violation and set outthe penalty that the Bank proposes to impose;the right of the individual or entity, within 30 days after the day on which the notice is served or within any longer period that the Bank specifies, to pay the penalty or to make representations to the Governor with respect to the violation and the proposed penalty, and the manner for doing so; andthe fact that, if the individual or entity does not pay the penalty or make representations in accordance with the notice, the individual or entity will be deemed to have committed the violation and the Bank may impose a penalty in respect of it.
Determination of Responsibility and Penalty
PaymentIf the individual or entity pays the penalty proposed in the notice of violation, the individual or entity is deemed to have committed the violation and proceedings in respect of it are ended.Representations to GovernorIf the individual or entity makes representations in accordance with the notice, the Governor must decide, on a balance of probabilities, whether the individual or entity committed the violation and, if so, may, subject to any regulations made under paragraph 155(1)(b), impose the penalty proposed in the notice, a lesser penalty or no penalty.Failure to pay or make representationsAn individual or entity that neither pays the penalty nor makes representations in accordance with the notice is deemed to have committed the violation and the Bank may, subject to any regulations made under paragraph 155(1)(b), impose the penalty proposed in the notice, a lesser penalty or no penalty.Notice — decision and right of appealThe Bank must cause notice of any decision made under subsection (2) or (3) to be issued and served on the individual or entity together with notice of the right of appeal under section 161.
Appeal to Federal Court
Right of appealAn individual or entity on which a notice under subsection 160(4) is served may, within 30 days after the day on which the notice is served or within any longer period that the Court allows, appeal the decision to the Federal Court.Court to take precautions against disclosingIn an appeal, the Federal Court must take every reasonable precaution, including, if appropriate, conducting hearings in private, to avoid the disclosure by the Court or any person of confidential information referred to in section 131.Powers of CourtOn an appeal, the Federal Court may confirm, set aside or, subject to any regulations made under paragraph 155(1)(b), vary the decision.
Enforcement
Debts to His MajestyA penalty constitutes a debt due to His Majesty in right of Canada that may be recovered in the Federal Court.Limitation period or prescriptionNo proceedings to recover a debt referred to in subsection (1) may be commenced later than five years after the day on which the debt becomes payable.Receiver GeneralA debt referred to in subsection (1) is payable to and must be remitted to the Receiver General.
Certificate of defaultThe unpaid amount of any debt referred to in subsection 162(1) may be certified by the Governor.Registration in Federal CourtRegistration in the Federal Court of a certificate has the same effect as a judgment of that Court for a debt of the amount specified in the certificate and all related registration costs.
Rules About Violations
Violations not offencesFor greater certainty, a violation is not an offence and, accordingly, section 126 of the Criminal Code does not apply in respect of a violation.
Due diligence availableDue diligence is a defence in a proceeding in relation to a violation.Common law principlesEvery rule and principle of the common law that makes any circumstance a justification or excuse in relation to a charge for an offence applies in respect of a violation to the extent that it is not inconsistent with this Act.
General Provisions
AdmissibilityIn a proceeding in respect of a violation or a prosecution for an offence, a notice purporting to be issued under subsection 159(2) or 160(4) or a certificate purporting to be made under subsection 163(1) is admissible in evidence without proof of the signature or official character of the person appearing to have signed it.
Limitation period or prescriptionNo proceedings in respect of a violation may be commenced later than two years after the day on which the subject matter of the proceedings became known to the Bank.CertificateA document appearing to have been issued by the Bank, certifying the day on which the subject matter of any proceedings became known to the Bank, is admissible in evidence without proof of the signature or official character of the person appearing to have signed the document and is, in the absence of evidence to the contrary, proof of the matter asserted in it.
PublicationSubject to any regulations, the Bank must make public the nature of a violation, the name of the individual or entity that committed it and the amount of the penalty imposed.Publication — reasonsIn making public the nature of a violation, the Bank may include the reasons for the decision, including the relevant facts, analysis and considerations that formed part of the decision.
Authorization — “Consumer-Driven Banking”
Use of phraseA participating entity, an accredited third-party service provider and the technical standards body are authorized to use the phrase “consumer-driven banking” to indicate or describe the activities that they perform under this Act.
Prohibitions
Claiming to be participating entityAn individual or entity, other than a participating entity, must notuse the term “participating entity” or a variation, abbreviation or equivalent of that term, or any words, name or designation — in any language — in a manner that leads to a reasonable belief that the individual or entity is a participating entity for the purposes of this Act; orrepresent themselves, in any way or by any means, to be a participating entity for the purposes of this Act.
Screen scrapingSubject to the regulations, an individual or entity must not, for the purposes of providing a consumer in Canada with a product or service, use an interface or application to gain direct access to the consumer’s data using the consumer’s authentication information.
False or misleading informationAn individual or entity must not knowingly provide false or misleading information in relation to their participation under this Act.
False or misleading informationAn individual or entity must not provide false or misleading information to the Bank, the Minister or a designated person or government authority.
Offences and Punishment
OffenceEvery individual or entity commits an offence thatcontravenes a provision of this Act, other than section 172, or of the regulations;fails to comply with an order made under section 55 or an undertaking required under that section;fails to comply with an order made under section 56 or subsection 60(1) or (3) or 61(1) or (3);fails to comply with a compliance agreement entered into under section 147; orfails to comply with a direction made under section 148.Offence — section 172Every individual or entity that contravenes section 172 commits an offence.PenaltyEvery individual or entity that commits an offence under subsection (1) or (2) is liableon conviction on indictment,in the case of an individual, to a fine of not more than $1,000,000 or to imprisonment for a term of not more than five years, or to both, orin the case of an entity, to a fine of not more than $5,000,000; oron summary conviction,in the case of an individual, to a fine of not more than $100,000 or to imprisonment for a term of not more than one year, or to both, orin the case of an entity, to a fine of not more than $500,000.Due diligence defenceAn individual or entity is not to be found guilty of an offence under subsection (1) if they establish that they exercised due diligence to prevent the commission of the offence.
Order to complyIf an individual or entity is convicted of an offence under this Act, the court may, in addition to any punishment that it may otherwise impose, order the individual or entity to comply with the provisions of this Act or of the regulations in respect of which the individual or entity was convicted.Additional fineIf an individual or entity is convicted of an offence under this Act, the court may, if it is satisfied that as a result of the commission of the offence the convicted individual or entity acquired any monetary benefits or that monetary benefits accrued to the convicted individual or entity or the individual’s spouse, common-law partner or other dependant, order the convicted individual or entity to pay, despite the maximum amount of any fine that may otherwise be imposed under this Act, an additional fine in an amount equal to three times the court’s estimation of the amount of those monetary benefits.
Party to offenceIf an entity commits an offence under this Act, any director, any officer, any agent or mandatary or any principal officer of the entity who directed, authorized, assented to, acquiesced in or participated in the commission of the offence is a party to and guilty of the offence and is liable on summary conviction or on conviction on indictment to the punishment provided for an individual in respect of the offence, whether or not the entity has been prosecuted or convicted.
Limitation periodProceedings by way of summary conviction in respect of an offence under this Act may be commenced at any time within, but not later than, two years after the day on which the subject matter of the proceedings became known to the Bank.CertificateA document appearing to have been issued by the Bank, certifying the day on which the subject matter of any proceedings became known to the Bank, is admissible in evidence without proof of the signature or official character of the person appearing to have signed the document and is, in the absence of evidence to the contrary, proof of the matter asserted in it.
Regulations
RegulationsThe Governor in Council may, on the recommendation of the Minister, make regulations generally for carrying out the purposes and provisions of this Act and, in particular, may make regulationsspecifying the data that is excluded from the definition derived data in section 2;respecting accreditation;respecting fees for accreditation;respecting notifications and the provision of information in the case of the revocation of a participating entity’s or accredited third-party service provider’s accreditation;respecting the registry referred to in section 44;respecting the sharing of data under section 76 and providing for exceptions to the duty to share and to the prohibition on imposing conditions set out in that section;respecting security safeguards to be implemented for the purposes of section 79;respecting designations under section 80;respecting reports made and notices given under section 82;respecting the duty to investigate and report under section 83;respecting the express consent that must be obtained under section 85;respecting the information to be provided under subsection 85(4);respecting exceptions to the duty set out in subsection 85(6);respecting the record that must be kept under subsection 85(8);respecting the renewal of consent under subsection 87(1), providing for the circumstances referred to in that subsection and respecting the information to be provided under paragraph 87(4)(c);exempting participating entities, for the purposes of subsection 87(2), from any requirements under subsection 85(4);respecting exceptions to the duty set out in subsection 87(5);respecting the notice of withdrawal of consent referred to in subsection 90(1) and the information to be provided under paragraph 90(2)(c);respecting exceptions to the duty set out in subsection 90(4);respecting the duty set out in subsection 92(1);respecting the display of a sign under section 94;respecting the duties set out in section 96;respecting the duty to keep records under section 102;respecting the liability of consumers and participating entities under subsection 103(1);respecting the duties set out in subsection 105(4) or section 111;respecting the duty to keep records under section 122;respecting the annual report referred to in section 128, including the information that is to be included in the report and the form and manner in which, and the time within which, it is to be submitted;respecting the circumstances in which information referred to in subsection 133(1) may be used as evidence;respecting exceptions to the prohibition set out in section 171; andproviding for anything that by this Act is to be provided for in the regulations.
Statutory Instruments ActThe Statutory Instruments Act does not apply in respect ofan order made under any of subsections 13(1) to (3);a notice given under section 25;a notice given under section 38;a directive issued under section 51;an order made under any of sections 55 to 57;an order made under subsection 60(1) or (3) or 61(1) or (3);a notice issued under subsection 66(1);a directive issued under subsection 67(2) or (7) or section 68;a designation made under subsection 114(1);an order made under subsection 119(1);an order made under subsection 124(1);an order made under subsection 125(1) or 127(1); ora direction made under section 148.
Review
ReviewNo later than the third anniversary of the day on which this section comes into force, and every five years after that, the Minister must cause a review of this Act and its operation to be commenced.
Coming into Force
Order in councilThe provisions of this Act, other than sections 1 to 9, 13, 14, 74 and 113, subsections 114(1), (2), (4) and (5), paragraph 115(a) and sections 117 to 119, 123 to 132, 136 to 139, 143, 147 to 149, 169, 170 and 172 to 179, come into force on a day or days to be fixed by order of the Governor in Council.[Note: The provisions of this Act, other than sections 1 to 9, 13, 14, 74 and 113, subsections 114(1), (2), (4) and (5), paragraph 115(a) and sections 117 to 119, 123 to 132, 136 to 139, 143, 147 to 149, 169, 170 and 172 to 179, not in force.]
(Section 2, subsections 13(1) to (3), 14(1) and (2) and 15(1) and paragraph 44(b))