Contents
- Short Title
- Definitions
- Purpose
- Objects of the Bank
- Application
- Participating Entities
- Accredited Third-Party Service Providers
- Appeal to Federal Court
- Registry
- National Security
- Duties of Participating Entities
- Liability
- Complaints Procedures
- Duties of Accredited Third-Party Service Providers
- Disclosure Protection
- Designation — Provincial Authority
- Technical Standard
- Confidentiality of Information
- Advisory and Other Committees
- No Liability
- Not Compellable
- Assessment of Fees
- Administration and Enforcement
- Authorization — “Consumer-Driven Banking”
- Prohibitions
- Offences and Punishment
- Regulations
- Review
- Coming into Force
- (Section 2, subsections 13(1) to (3), 14(1) and (2) and 15(1) and paragraph 44(b))
- Amendments not in force
Short Title
1Short title#
This Act may be cited as the Consumer-Driven Banking Act.
Definitions
2Definitions#
The following definitions apply in this Act.
authentication information means any password or other information that a consumer creates or adopts to be used to authenticate their identity. (authentifiant)
complaint means an expression of dissatisfaction, whether justified or not, to a participating entity with respect to any activity that it performs under this Act. (plainte)
derived data means, subject to the regulations, data about a consumer, product or service that has been enhanced by a participating entity to significantly increase its usefulness or commercial value. (données dérivées)
entity means a corporation, trust, partnership, fund, unincorporated association or organization or federal or provincial Crown corporation. (entité)
external complaints body means the corporation designated under subsection 114(1). (organisme externe de traitement des plaintes)
(c)a company to which the Trust and Loan Companies Act applies;
(d)an association to which the Cooperative Credit Associations Act applies; or
(e)a company, fraternal benefit society or foreign company to which the Insurance Companies Act applies. (institution financière fédérale)
Governor has the same meaning as in section 2 of the Bank of Canada Act. (gouverneur)
participating entity means
(a)a bank that is listed in the schedule;
(b)a federal financial institution or provincial financial institution that is accredited under section 15;
(c)a registered payment service provider that is accredited under section 17; or
(d)an entity that is accredited under section 19. (entité participante)
(a)a cooperative credit society, savings and credit union or caisse populaire that is regulated by a provincial Act;
(b)a provincial Crown corporation that offers deposit-taking services; or
(c)an insurance company that is regulated by a provincial Act. (institution financière provinciale)
registered payment service provider means a payment service provider, as defined in section 2 of the Retail Payment Activities Act, that is registered, as defined in that section. (fournisseur de services de paiement enregistré)
sharing, in respect of consumer data, means the provision or receipt of that data by participating entities. (partage)
technical standards body means the body designated under subsection 125(1). (organisme de normalisation technique)
third-party service provider means an individual or entity that is not an employee or an agent or mandatary of a participating entity and that, under a contract, provides the participating entity with a service that is related to the activities that the participating entity performs under this Act. (tiers fournisseur de services)
Purpose
3Purpose#
The purpose of this Act is to establish a framework within which consumers, including businesses, can direct that their data be shared among participating entities of their choice, to ensure that the sharing of data among participating entities is safe and secure and to foster competition in the financial sector.
Objects of the Bank
4Objects#
The Bank’s objects under this Act are to
(a)supervise participating entities, accredited third-party service providers, the external complaints body and the technical standards body to determine whether they are in compliance with
(i)the provisions of this Act and the regulations that are applicable to them, and
(ii)orders made, undertakings required, compliance agreements entered into and directions made under this Act;
(b)monitor and evaluate trends and emerging issues that may have an impact on consumers of consumer-driven banking, including trends and issues in respect of products, services and market developments, and make information on those trends and issues public;
(c)foster participation in consumer-driven banking in cooperation with any department, agency or agent corporation of the Government of Canada or any department, agency or agent or mandatary corporation of the government of a province, financial institutions and consumer and other organizations; and
(d)foster competition in the financial sector in the interests of consumers.
5Agreements or arrangements#
The Bank may, for the purpose of exercising its powers or performing its duties and functions under this Act, enter into an agreement or arrangement with any government authority or regulatory body.
6Guidelines — Bank#
(1)Subject to subsection (2), the Bank may issue guidelines respecting the manner in which this Act is to be applied.
7Publication of information — regulations#
(1)The Bank must publish, within the time and in the manner provided for in the regulations, the information that is provided for in the regulations respecting consumer-driven banking.
Application
10Data#
(1)This Act applies in respect of data that relates to the following products and services, including data that is provided by a consumer and data that is provided for in the regulations:
(a)deposit accounts;
(b)registered investment accounts;
(c)non-registered investment accounts;
(d)payment products;
(e)lines of credit, mortgages or hypothecs and other kinds of loans; and
(f)other products or services provided for in the regulations.
(2)This Act does not apply in respect of derived data.
11Limit — editing data#
Data that is shared between participating entities in accordance with this Act is to be shared in a manner that does not enable the participating entity that receives the data to edit the data on servers that are used by the participating entity that provides the data.
Participating Entities
Banks Listed in Schedule
Federal Financial Institutions and Provincial Financial Institutions
15Accreditation#
(1)Subject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit a federal financial institution, other than a bank that is listed in the schedule, or provincial financial institution if the Bank is satisfied that the federal financial institution or provincial financial institution is in compliance with the technical standard referred to in subsection 125(1) and the security safeguards provided for in the regulations.
(2)An applicant must include with the application an accreditation fee determined in accordance with the regulations.
(4)As soon as feasible after an applicant becomes aware that information provided as part of the application has changed or is about to change, the applicant must notify the Bank of the change or anticipated change, and the Bank must then, as soon as feasible, notify the Minister and any designated person or government authority.
16Notice and addition to registry#
As soon as feasible after deciding to accredit an applicant or refuse an application, the Bank must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
Registered Payment Service Providers
17Accreditation#
(1)Subject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit a registered payment service provider if the Bank is satisfied that it meets the requirements provided for in the regulations.
(2)An applicant must include with the application an accreditation fee determined in accordance with the regulations.
(4)As soon as feasible after an applicant becomes aware that information provided as part of the application has changed or is about to change, the applicant must notify the Bank of the change or anticipated change, and the Bank must then, as soon as feasible, notify the Minister and any designated person or government authority.
18Notice and addition to registry#
As soon as feasible after deciding to accredit an applicant or refuse an application, the Bank must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
Other Entities
19Accreditation#
(1)Subject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit an entity other than a federal financial institution or provincial financial institution or a registered payment service provider, if the Bank is satisfied that the entity meets the requirements provided for in the regulations.
(2)An applicant must include with the application an accreditation fee determined in accordance with the regulations.
(4)As soon as feasible after an applicant becomes aware that information provided as part of the application has changed or is about to change, the applicant must notify the Bank of the change or anticipated change, and the Bank must then, as soon as feasible, notify the Minister and any designated person or government authority.
20Notice and addition to registry#
As soon as feasible after deciding to accredit an applicant or refuse an application, the Bank must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
Refusal to Accredit
21Review#
(1)An applicant that has been notified under section 16, 18 or 20 of a decision to refuse its application for accreditation may, within the period provided for in the regulations, make a request to the Governor for a review of the decision.
(2)After giving the applicant an opportunity to make representations, the Governor must, within the period provided for in the regulations, confirm the refusal or accredit the applicant.
(3)As soon as feasible after deciding to confirm the refusal or accredit the applicant, the Governor must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
Suspension and Revocation
22Request for revocation#
(1)The Bank must revoke a participating entity’s accreditation at the request of the participating entity if the Bank is satisfied that the participating entity
(a)has complied with its duties under this Act;
(b)has, in accordance with the regulations and at least 30 days before the day on which it makes the request for revocation, notified in writing any consumers that use the services that it provides in accordance with this Act of its intention to request revocation and provided those consumers with any other information that is provided for in the regulations; and
(c)in the case of a participating entity that is a provincial financial institution, has, at least 30 days before the day on which it makes the request for revocation, notified in writing the appropriate provincial authority that regulates or supervises the provincial financial institution of its intention to request revocation.
(2)The Bank must, as soon as feasible, notify the participating entity in writing of the decision with respect to the request and the reasons for the decision.
(3)If the Bank decides to revoke the participating entity’s accreditation, the Bank must, as soon as feasible, include a reference to the revocation in the registry.
23Suspension#
(1)The Bank may suspend a participating entity’s accreditation if the Bank is satisfied that the participating entity has contravened this Act or the regulations.
(3)The Bank may impose any conditions that the Bank considers appropriate on a participating entity whose accreditation is suspended and the participating entity must comply with those conditions.
(4)The Bank must, as soon as feasible, notify the participating entity in writing of the suspension and any conditions imposed.
(5)As soon as feasible after being notified of the suspension, the participating entity must notify in writing any consumers that use the services that it provides in accordance with this Act of the suspension and any conditions imposed.
24End of suspension#
If the Bank is satisfied that the grounds for suspending a participating entity’s accreditation no longer exist, the Bank must end the suspension and must, as soon as feasible, notify the participating entity in writing that the suspension has ended and remove the reference to the suspension from the registry.
25Notice of intent to revoke accreditation#
The Bank may give a participating entity a notice of intent to revoke the participating entity’s accreditation if the Bank is satisfied that the participating entity has contravened this Act or the regulations. A notice of intent must include reasons.
26Review of notice of intent#
(1)A participating entity that has been given a notice of intent to revoke may, within the period provided for in the regulations, make a request to the Governor for a review of the notice of intent.
(2)After giving the participating entity an opportunity to make representations, the Governor must, within the period provided for in the regulations, revoke the participating entity’s accreditation or withdraw the notice of intent.
(3)The Governor must, as soon as feasible, notify the participating entity in writing of the decision and the reasons for it.
27Review not requested#
If a participating entity that has been given a notice of intent to revoke does not make a request for a review within the period provided for in the regulations, the Bank must revoke the participating entity’s accreditation or withdraw the notice of intent. The Bank must, as soon as feasible, notify the participating entity in writing of the decision and the reasons for it.
28Reference to revocation in registry#
If the Governor revokes a participating entity’s accreditation under subsection 26(2) or the Bank does so under section 27, the Bank must, as soon as feasible, include a reference to the revocation in the registry.
29Duties of former participating entity#
A participating entity whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection 26(3) or section 27, comply with its duties under this Act and, in accordance with the regulations, notify in writing any consumers that used the services that it provided in accordance with this Act and provide those consumers with any other information that is provided for in the regulations.
30Notice to appropriate provincial authority#
If the Bank gives notice under subsection 22(2) or 23(4) or section 24, 25 or 27 to a participating entity that is a provincial financial institution, or the Governor does so under subsection 26(3), the Bank or the Governor, as the case may be, must, as soon as feasible, notify the appropriate provincial authority that regulates or supervises the provincial financial institution.
Accredited Third-Party Service Providers
31Accreditation required#
A participating entity must not use a third-party service provider to perform any of the following activities under this Act unless the third-party service provider is accredited under section 32:
(a)obtaining or managing consumers’ consent on behalf of the participating entity;
(b)confirming consumers’ authentication information or managing the authentication of consumers on behalf of the participating entity;
(c)providing or receiving consumer data on behalf of the participating entity.
32Accreditation#
(1)Subject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit an individual or entity to perform one or more of the activities referred to in paragraphs 31(a) to (c) if the Bank is satisfied that the individual or entity meets the requirements provided for in the regulations.
(2)An applicant must include with the application an accreditation fee determined in accordance with the regulations.
(4)As soon as feasible after an applicant becomes aware that information provided as part of the application has changed or is about to change, the applicant must notify the Bank of the change or anticipated change, and the Bank must then, as soon as feasible, notify the Minister and any designated person or government authority.
33Notice and addition to registry#
As soon as feasible after deciding to accredit an applicant or refuse an application, the Bank must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information.
34Review#
(1)An applicant that has been notified under section 33 of a decision to refuse its application for accreditation may, within the period provided for in the regulations, make a request to the Governor for a review of the decision.
(2)After giving the applicant an opportunity to make representations, the Governor must, within the period provided for in the regulations, confirm the refusal or accredit the applicant.
35Request for revocation#
(1)The Bank must revoke an accredited third-party service provider’s accreditation at the request of the accredited third-party service provider if the Bank is satisfied that the accredited third-party service provider has complied with its duties under this Act.
(2)The Bank must, as soon as feasible, notify the accredited third-party service provider in writing of the decision with respect to the request and the reasons for the decision.
(3)If the Bank decides to revoke the accredited third-party service provider’s accreditation, the Bank must, as soon as feasible, include a reference to the revocation in the registry.
36Suspension#
(1)The Bank may suspend an accredited third-party service provider’s accreditation if the Bank is satisfied that the accredited third-party service provider has contravened this Act or the regulations.
(3)The Bank may impose any conditions that the Bank considers appropriate on an accredited third-party service provider whose accreditation is suspended and the accredited third-party service provider must comply with those conditions.
(4)The Bank must, as soon as feasible, notify the accredited third-party service provider in writing of the suspension and any conditions imposed.
(5)As soon as feasible after being notified of the suspension, the accredited third-party service provider must notify in writing any participating entities on whose behalf it is performing any of the activities for which it was accredited of the suspension and any conditions imposed.
37End of suspension#
If the Bank is satisfied that the grounds for suspending an accredited third-party service provider’s accreditation no longer exist, the Bank must end the suspension and must, as soon as feasible, notify the accredited third-party service provider in writing that the suspension has ended and remove the reference to the suspension from the registry.
38Notice of intent to revoke accreditation#
The Bank may give an accredited third-party service provider a notice of intent to revoke the accredited third-party service provider’s accreditation if the Bank is satisfied that the accredited third-party service provider has contravened this Act or the regulations. A notice of intent must include reasons.
39Review of notice of intent#
(1)An accredited third-party service provider that has been given a notice of intent to revoke may, within the period provided for in the regulations, make a request to the Governor for a review of the notice of intent.
(2)After giving the accredited third-party service provider an opportunity to make representations, the Governor must, within the period provided for in the regulations, revoke the accredited third-party service provider’s accreditation or withdraw the notice of intent.
(3)The Governor must, as soon as feasible, notify the accredited third-party service provider in writing of the decision and the reasons for it.
40Review not requested#
If an accredited third-party service provider that has been given a notice of intent to revoke does not make a request for a review within the period provided for in the regulations, the Bank must revoke the accredited third-party service provider’s accreditation or withdraw the notice of intent. The Bank must, as soon as feasible, notify the accredited third-party service provider in writing of the decision and the reasons for it.
41Reference to revocation in registry#
If the Governor revokes an accredited third-party service provider’s accreditation under subsection 39(2) or the Bank does so under section 40, the Bank must, as soon as feasible, include a reference to the revocation in the registry.
42Duties of former accredited third-party service provider#
A third-party service provider whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection 39(3) or section 40, comply with its duties under this Act and, in accordance with the regulations, notify in writing any participating entities on whose behalf it was performing, at the time of the revocation, any of the activities for which it was accredited and provide those participating entities with any other information that is provided for in the regulations.
Appeal to Federal Court
43Right of appeal#
(1)An applicant that has been notified under subsection 21(3) or 34(3) of a decision to refuse accreditation, a participating entity that has been notified under subsection 26(3) of a decision to revoke its accreditation or an accredited third-party service provider that has been notified under subsection 39(3) of a decision to revoke its accreditation may appeal the decision to the Federal Court within the period provided for in the regulations or any longer period that the Court allows.
(2)The Federal Court may dismiss the appeal or set aside the decision and refer the matter back to the Governor for redetermination.
Registry
44Registry#
(a)the name and address of each participating entity;
(b)in the case of a participating entity that is a bank that is listed in the schedule, the date on which its name was added to the schedule;
(c)in the case of a participating entity that is accredited under section 15, 17 or 19, the date on which it was accredited;
(d)the status of each participating entity, the date of any change to its status and, if applicable, the reasons for which its accreditation was revoked;
(e)any other information provided for in the regulations in relation to a participating entity or the activities that it performs under this Act;
(f)the name and address of each accredited third-party service provider and the date on which it was accredited;
(g)the status of each accredited third-party service provider, the date of any change to its status and, if applicable, the reasons for which its accreditation was revoked; and
(h)any other information provided for in the regulations in relation to an accredited third-party service provider or the activities that it performs under this Act.
National Security
Designation
45Designation#
The Minister may designate a person or government authority for the purposes of subsections 15(4), 17(4), 19(4) and 32(4), section 46, paragraph 51(e), section 54, paragraph 66(1)(e), sections 71 and 73, subsections 98(3) and 120(3) and sections 132, 137, 139 and 173.
Review of Application for Accreditation
46Copy of application#
The Bank must, as soon as feasible after determining that an application for accreditation is complete, provide the Minister and any designated person or government authority with a copy of the application.
47Decision to review application#
(1)The Minister may, within the period provided for in the regulations, decide to review an application for accreditation if the Minister is of the opinion that it is necessary to do so for reasons related to national security. In that case, the Minister must notify the Bank of the decision and the Bank must then notify the applicant.
48Review#
(1)If the Minister decides to review an application for accreditation, the Minister must conduct the review within the period provided for in the regulations. After completing the review, the Minister must issue a directive to refuse accreditation to the Bank under section 51 or notify the Bank that the Minister has decided not to issue a directive under that section.
50No accreditation#
The Bank must not accredit an applicant during a period referred to in subsection 47(1) or (2) unless the Minister notifies the Bank that the Minister has decided not to review the application. If the Minister notifies the Bank that the Minister has decided to review the application, the Bank must not accredit the applicant unless the Minister notifies the Bank that the Minister has decided not to issue a directive under section 51.
51Directive to refuse accreditation#
(a)there are reasons related to national security;
(b)the applicant has failed to provide additional information in accordance with section 54;
(c)an order made under section 55, or an undertaking required under that section, that relates to the application for accreditation has not been complied with;
(d)a term or condition imposed under section 56 that relates to the application for accreditation has not been complied with; or
(e)the applicant has provided false or misleading information to the Bank, the Minister or a designated person or government authority.
54Additional information#
(1)An applicant must provide the Minister and any designated person or government authority with any additional information that the Minister or the designated person or government authority requests, for reasons related to national security, in relation to the applicant or the activities that the applicant plans to perform under this Act.
(2)A request for information under subsection (1) must be submitted to the Bank, which must then, as soon as feasible, transmit it to the applicant. The applicant must, within the period provided for in the regulations, provide the requested information to the Bank, which must then, as soon as feasible, provide it to the Minister and any designated person or government authority.
Undertakings and Terms and Conditions
55Undertakings#
The Minister may, by order, require any individual or entity to provide an undertaking in relation to an application for accreditation or in relation to a participating entity or accredited third-party service provider if the Minister is of the opinion that it is necessary to do so for reasons related to national security.
56Terms and conditions#
The Minister may, by order, impose terms and conditions on any individual or entity in relation to an application for accreditation or in relation to a participating entity or accredited third-party service provider if the Minister is of the opinion that it is necessary to do so for reasons related to national security.
58Effect on accreditation#
Unless otherwise expressly provided in this Act, a failure to comply with an order made under section 55, an undertaking required under that section or any terms and conditions imposed under section 56 does not invalidate an accreditation to which the order, undertaking or terms and conditions relate.
60National security order#
(1)The Minister may, by order, direct a participating entity, an accredited third-party service provider or any director, officer or agent or mandatary of a participating entity or accredited third-party service provider to take or refrain from taking any measures related to the activities that the participating entity or accredited third-party service provider performs under this Act if the Minister is of the opinion that it is necessary to do so for reasons related to national security.
(2)Subject to subsection (3), the Minister must not make an order under subsection (1) unless the participating entity, accredited third-party service provider, entity or individual in question is provided with an opportunity to make representations in respect of the matter.
(4)A temporary order ceases to have effect on the earlier of
(a)the end of the 30-day period after the day on which it is made or of any shorter period that is specified in the temporary order, and
(b)the day on which an order is made under subsection (1).
61National security order — revocation#
(1)The Minister may, by order, direct a participating entity or third-party service provider whose accreditation is revoked under subsection 69(1), or any director, officer or agent or mandatary of the participating entity or third-party service provider, to take or refrain from taking any measures related to the activities that the participating entity or third-party service provider performed under this Act if the Minister is of the opinion that it is necessary to do so for reasons related to national security.
(2)Subject to subsection (3), the Minister must not make an order under subsection (1) unless the participating entity, third-party service provider, entity or individual in question is provided with an opportunity to make representations in respect of the matter.
(4)A temporary order ceases to have effect on the earlier of
(a)the end of the 30-day period after the day on which it is made or of any shorter period that is specified in the temporary order, and
(b)the day on which an order is made under subsection (1).
62Notice — Committee and Review Agency#
The Minister must, within 30 days after the day on which an order is made under subsection 60(1) or (3) or 61(1) or (3), notify
(a)the National Security and Intelligence Committee of Parliamentarians established by section 4 of the National Security and Intelligence Committee of Parliamentarians Act; and
(b)the National Security and Intelligence Review Agency established under section 3 of the National Security and Intelligence Review Agency Act.
64Confidential information#
(1)The Minister may specify that information about an undertaking required by an order made under section 55, terms and conditions imposed by an order made under section 56 or an order made under subsection 60(1) or (3) or 61(1) or (3), or information that could reveal the existence of the undertaking, terms and conditions or order, is confidential and must be treated accordingly.
(3)If the Minister specifies under subsection (1) that information is confidential, the Minister must, within 30 days after the day on which the order in question is made under section 55 or 56 or subsection 60(1) or (3) or 61(1) or (3), notify
(a)the National Security and Intelligence Committee of Parliamentarians established by section 4 of the National Security and Intelligence Committee of Parliamentarians Act; and
(b)the National Security and Intelligence Review Agency established under section 3 of the National Security and Intelligence Review Agency Act.
65Court enforcement#
(1)If an individual or entity is not complying with an undertaking required by an order made under section 55, terms and conditions imposed by an order made under section 56 or an order made under subsection 60(1) or (3) or 61(1) or (3), the Minister may, in addition to any other action that may be taken under this Act, apply to a superior court for an order requiring the individual or entity to comply with the undertaking, terms and conditions or order.
(2)The court may make the order and any other order that it thinks fit.
(3)An appeal from an order made under subsection (2) lies in the same manner and to the same court as an appeal from any other order of the court.
Suspension and Revocation
66Notice of intent — directive to revoke#
(1)The Minister may issue to the Bank a notice of the Minister’s intent to issue a directive to the Bank to revoke a participating entity’s or accredited third-party service provider’s accreditation if
(a)there are reasons related to national security;
(b)the participating entity or accredited third-party service provider has failed to provide additional information in accordance with section 71;
(c)an order made under section 55, or an undertaking required under that section, that relates to the participating entity or accredited third-party service provider has not been complied with;
(d)a term or condition imposed under section 56 that relates to the participating entity or accredited third-party service provider has not been complied with;
(e)the participating entity or accredited third-party service provider has provided false or misleading information to the Bank, the Minister or a designated person or government authority; or
(f)the participating entity or accredited third-party service provider or a director, officer or agent or mandatary of the participating entity or accredited third-party service provider has not complied with an order made under subsection 60(1) or (3).
(2)The Bank must, as soon as feasible, notify in writing the participating entity or accredited third-party service provider in question of the notice of intent.
67Review of notice of intent#
(1)A participating entity or accredited third-party service provider that has been notified under subsection 66(2) may, within the period provided for in the regulations, request a review of the notice of intent by the Minister. The request must be submitted to the Bank, which must then, as soon as feasible, transmit it to the Minister.
(2)If, in the Minister’s opinion, the length of time required for a review of the notice of intent might be prejudicial to the public interest, the Minister may issue a directive to the Bank to immediately suspend the participating entity’s or accredited third-party service provider’s accreditation while the review is being undertaken.
(3)The Bank must immediately suspend the participating entity’s or accredited third-party service provider’s accreditation if the Minister issues a directive to that effect under subsection (2). The Bank must then, as soon as feasible, notify the participating entity or accredited third-party service provider in writing that its accreditation has been suspended in accordance with a directive issued by the Minister.
(5)A participating entity that is notified that its accreditation has been suspended under subsection (3) must immediately cease all consumer-driven banking activities that it performs under this Act.
(6)An accredited third-party service provider that is notified that its accreditation has been suspended under subsection (3) must immediately cease all activities for which it is accredited.
(7)On completion of the review and after giving the participating entity or accredited third-party service provider an opportunity to make representations, the Minister must withdraw the notice of intent or issue a directive to the Bank to revoke the accreditation.
(8)If the Minister decides to withdraw the notice of intent, the Minister must notify the Bank, which must then immediately notify the participating entity or accredited third-party service provider in writing, end any suspension and remove any reference to the suspension from the registry.
68Review not requested#
If a participating entity or accredited third-party service provider that has been notified under subsection 66(2) does not request a review of the notice of intent within the period provided for in the regulations, the Minister must withdraw the notice of intent or issue a directive to the Bank to revoke the accreditation.
69Revocation of accreditation#
(1)The Bank must revoke a participating entity’s or accredited third-party service provider’s accreditation if the Minister issues a directive to that effect under subsection 67(7) or section 68.
(2)The Bank must, as soon as feasible, notify the participating entity or accredited third-party service provider in writing that its accreditation has been revoked in accordance with a directive issued by the Minister.
(4)A participating entity whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection (2), comply with its duties under this Act and, in accordance with the regulations, notify in writing any consumers that used the services that it provided in accordance with this Act and provide those consumers with any other information that is provided for in the regulations.
(5)A third-party service provider whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection (2), comply with its duties under this Act and, in accordance with the regulations, notify in writing any participating entities on whose behalf it was performing, at the time of the revocation, any of the activities for which it was accredited and provide those participating entities with any other information that is provided for in the regulations.
70Notice — Committee and Review Agency#
Within 30 days after the day on which the Minister issues a directive under subsection 67(2), the Minister must notify
(a)the National Security and Intelligence Committee of Parliamentarians established by section 4 of the National Security and Intelligence Committee of Parliamentarians Act; and
(b)the National Security and Intelligence Review Agency established under section 3 of the National Security and Intelligence Review Agency Act.
71Additional information#
(1)A participating entity or accredited third-party service provider must provide the Minister and any designated person or government authority with any additional information that the Minister or the designated person or government authority requests, for reasons related to national security, in relation to the participating entity or the activities that it performs under this Act or in relation to the accredited third-party service provider or the activities for which it is accredited.
(2)A request for information under subsection (1) must be submitted to the Bank, which must then, as soon as feasible, transmit it to the participating entity or accredited third-party service provider. The participating entity or accredited third-party service provider, as the case may be, must, within the period provided for in the regulations, provide the requested information to the Bank, which must then, as soon as feasible, provide it to the Minister and any designated person or government authority.
72Notice to appropriate provincial authority#
If the Bank gives notice under subsection 67(3) or (8) or 69(2) to a participating entity that is a provincial financial institution, the Bank must, as soon as feasible, notify the appropriate provincial authority that regulates or supervises the provincial financial institution.
General
73Personal information#
The Minister is not authorized to make a request or an order under section 54, 55, 56, 60, 61 or 71 requiring an individual, a participating entity, an accredited third-party service provider or any other entity to provide the Minister or any designated person or government authority with a consumer’s personal information.
74Decisions and orders final#
Decisions and orders made by the Minister under this Act are final and binding and, except for judicial review under the Federal Courts Act, are not subject to appeal or to review by any court.
75Advice and information to Minister#
(1)The Bank must, at least once every year, provide the Minister with advice and information on matters relating to national security and the integrity or security of the financial system in Canada, as those matters relate to the Minister’s exercise of powers or performance of duties and functions under this Act.
(2)The Bank must consult the Superintendent of Financial Institutions before providing the Minister with advice or information that relates to a federal financial institution.
Duties of Participating Entities
Data Sharing
76Sharing as directed by consumer#
(1)Unless otherwise prohibited by law and subject to the regulations, a participating entity must share a consumer’s data with other participating entities as directed by the consumer.
(2)A participating entity that shares a consumer’s data must do so in compliance with the technical standard referred to in subsection 125(1).
(3)Subject to the regulations, a participating entity must not impose any conditions on another participating entity for the sharing of a consumer’s data in accordance with this Act.
(4)Unless otherwise prohibited by law, a participating entity must notify the Bank, within the time and in the manner specified by the Bank, if the participating entity does not share a consumer’s data as required by subsection (1).
77No charge for sharing#
A participating entity must not impose a charge for sharing a consumer’s data in accordance with this Act, including for obtaining or renewing a consumer’s consent or for withdrawing that consent.
78Credit or refund#
(1)If a participating entity imposes a charge on a consumer for sharing the consumer’s data in accordance with this Act, the participating entity must credit the amount of the charge to the consumer or, if the amount was collected, refund it.
(2)The amount referred to in subsection (1) bears interest beginning on the day on which the charge is imposed, at a rate equal to the Bank’s overnight rate on that day, and ending on the day on which the amount is refunded or credited.
Security
79Security safeguards#
(1)A participating entity must implement the security safeguards that are provided for in the regulations.
(2)A participating entity must notify the Bank, as soon as feasible and in the manner specified by the Bank, of any change that has a significant impact on the participating entity’s compliance with the security safeguards.
80Designated officer or employee#
A participating entity must designate one of its officers or employees to be responsible for the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act.
81Mitigating harm#
A participating entity must establish policies and procedures to mitigate the harm to consumers that may result from a breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act.
82Report to Bank#
(1)A participating entity must report to the Bank any breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act if the breach involves consumer data that is under the participating entity’s control.
(2)The report must contain the information that is provided for in the regulations and must be made, in the form and manner specified by the Bank, immediately after the participating entity determines that a breach of the security safeguards has occurred.
(3)Unless otherwise prohibited by law, a participating entity must notify a consumer of any breach of the security safeguards that involves the consumer’s data that is under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the consumer.
(4)The notice must contain sufficient information to allow the consumer to understand the significance of the breach to them and to take steps, if any are possible, to reduce the risk of harm that could result from the breach or to mitigate that harm. The notice must contain any other information that is provided for in the regulations.
(5)The notice must be conspicuous and must be given to the consumer in the manner provided for in the regulations.
(6)The notice must be given as soon as feasible after the participating entity determines that the breach has occurred.
(7)For the purposes of this section, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, of business or of professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.
(8)The factors that are relevant to determining whether a breach of security safeguards creates a real risk of significant harm to a consumer include
(a)the sensitivity of the consumer data involved;
(b)the probability that the consumer data has been, is being or will be misused; and
(c)any other factor provided for in the regulations.
83Duty to investigate#
A participating entity must investigate every breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act, for the purposes of identifying any significant, recurring or systemic problems and remedying the problems identified. The participating entity must report the conclusions of every investigation to the Bank in accordance with the regulations.
84Notice#
If a participating entity identifies a significant, recurring or systemic problem that may have an impact on the consumer-driven banking system, the participating entity must, as soon as feasible, notify the Bank, which may then notify other participating entities.
Consent
85Express consent required#
(1)A participating entity must obtain a consumer’s express consent before requesting that another participating entity provide it with the consumer’s data.
(2)Use by the consumer of a product or service does not constitute express consent for the purposes of subsection (1).
(3)If the express consent is given orally, the participating entity must immediately confirm the consumer’s express consent in writing.
(4)The participating entity must provide a consumer with the following information before obtaining the consumer’s express consent:
(a)a description of the data in respect of which it is seeking the consumer’s express consent;
(b)a description of how it will use the data;
(c)the period during which the consumer’s consent will be valid, which must not exceed the period referred to in section 86; and
(d)any other information that is provided for in the regulations.
(5)Any communication from a participating entity seeking to obtain a consumer’s express consent to have the participating entity receive the consumer’s data, including for the purposes of providing information under subsection (4), must be made in a manner, and using language, that is clear, simple and not misleading.
(6)Subject to the regulations, a participating entity must use the data of a consumer that it receives from another participating entity only for the uses described in the information that is provided to the consumer under paragraph (4)(b).
(7)A participating entity must not require a consumer to consent to the sharing of the consumer’s data beyond what is necessary for the participating entity to provide the consumer with a product or service.
(8)A participating entity must keep a record of each express consent obtained.
(9)Nothing in this section renders ineffective any federal or provincial legislative or regulatory provision requiring a participating entity that provides data to obtain a consumer’s express consent.
86Duration of consent#
A consumer’s express consent may be valid for a period of not more than 12 months after the day on which a participating entity obtains it.
87Renewal of consent#
(1)A participating entity must renew a consumer’s express consent within seven days after the day on which the period for which the consumer’s consent was last obtained or renewed ends or within seven days after the day on which the participating entity becomes aware of any circumstance provided for in the regulations.
(2)Subsections 85(2) to (9) apply to a renewal of express consent.
(3)A participating entity that is required to renew a consumer’s express consent under subsection (1) must immediately stop receiving the consumer’s data until it has renewed the consumer’s consent to do so.
(4)If the participating entity fails to renew the consumer’s consent within the period referred to in subsection (1), it must, immediately after the end of the period,
(a)inform the consumer of the consequences of not renewing their consent;
(b)inform the consumer that they may request that the participating entity delete the data in respect of which consent was not renewed and of the manner in which that request may be made; and
(c)provide the consumer, in accordance with the regulations, with any information provided for in the regulations.
(5)Unless otherwise prohibited by law and subject to the regulations, the participating entity must, at the request of the consumer, delete the data in respect of which consent was not renewed.
88Consent obtained by deception#
A participating entity must not obtain or renew, or attempt to obtain or renew, a consumer’s express consent by providing false or misleading information or using deceptive or misleading practices.
89Undue pressure or coercion#
A participating entity must not obtain or renew, or attempt to obtain or renew, a consumer’s express consent by imposing undue pressure on the consumer or coercing them.
90Withdrawal of consent#
(1)A consumer may withdraw their consent, in whole or in part, by notifying the participating entity that obtained the consent.
(2)If the consumer notifies the participating entity of their intention to withdraw their consent, the participating entity must immediately
(a)inform the consumer of the consequences of withdrawing their consent;
(b)inform the consumer that they may request that the participating entity delete the data in respect of which consent was withdrawn and of the manner in which that request may be made; and
(c)provide the consumer, in accordance with the regulations, with any information provided for in the regulations.
(3)If the consumer confirms that they withdraw their consent after receiving the information referred to in subsection (2), the participating entity must, immediately or at any later date that is specified by the consumer, stop receiving the data in respect of which consent was withdrawn and notify the participating entity that was providing the data of the withdrawal of consent.
(4)Unless otherwise prohibited by law and subject to the regulations, the participating entity must, at the request of the consumer, delete the data in respect of which consent was withdrawn.
91Request to stop providing data#
(1)A consumer may request that a participating entity stop providing their data, in whole or in part, to another participating entity.
(2)If a consumer requests that a participating entity stop providing their data, the participating entity must immediately
(a)stop providing the consumer’s data in accordance with the request;
(b)inform the consumer that there might be consequences for stopping the provision of the data and that the consumer should contact the participating entity that was receiving the data; and
(c)inform the participating entity that was receiving the data that it has stopped providing the data at the consumer’s request.
Consumer Authentication
92Authentication requirements#
(1)Before providing a consumer’s data to another participating entity, a participating entity must confirm
(a)the consumer’s authentication information;
(b)the period for which the consumer’s express consent is valid; and
(c)the products and services in respect of which the data is to be provided.
(2)A participating entity must not, as a condition of providing a consumer’s data to another participating entity,
(a)require the consumer to consent to being provided with a product or service; or
(b)require the consumer to consent to the participating entity receiving their data from the other participating entity.
93Renewal of consent#
In the circumstances and within the period provided for in the regulations, a participating entity that is providing a consumer’s data to another participating entity must request that the other participating entity renew the consumer’s express consent in accordance with section 87.
Consumer Measures
94Display of sign#
A participating entity must, in the form specified by the Bank, prominently display a sign indicating that it is a participating entity
(a)at each of the locations in Canada at which it offers services in accordance with this Act; and
(b)on the home page of each of its websites and on each application through which it offers services in accordance with this Act.
95Information in consumer dashboard#
A participating entity must, in a single location on its website or application,
(a)provide a consumer with up-to-date information about
(i)any other participating entities with which it is sharing the consumer’s data,
(ii)the period for which the consumer’s consent to the sharing of their data is valid, and
(iii)the data that is being shared;
(b)provide the consumer with the option to renew their consent, if applicable; and
(c)provide the consumer with the option to withdraw their consent or to request that their data stop being provided, as the case may be.
96Clear, simple and not misleading#
(1)A participating entity must provide consumers with information in a manner, and using language, that is clear, simple and not misleading.
(2)A participating entity must take principles of accessibility into account when providing consumers with information.
(3)A participating entity must establish policies and procedures respecting the manner in which it provides consumers with information related to the activities that it performs under this Act.
(4)The Bank must, from time to time, review and evaluate the policies and procedures referred to in subsection (3) to ensure that the participating entity is complying with this section.
97False or misleading information#
A participating entity must not provide false or misleading information to consumers or the public respecting the activities that it performs under this Act.
Provision of Information
98Notice of change#
(1)A participating entity must notify the Bank of any change provided for in the regulations that relates to the participating entity or the activities that it performs under this Act.
(2)The notice must be given as soon as feasible after the participating entity becomes aware of the change but before the change takes effect. However, if a different period is provided for in the regulations, the notice must be given within that period.
(3)The Bank must, as soon as feasible, notify the Minister and any designated person or government authority of any notice given under subsection (1).
99Request for information#
A participating entity must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act.
100Annual reporting#
Following the end of its financial year, a participating entity must, within the time and in the form and manner specified by the Bank, submit a report to the Bank that includes the information that is provided for in the regulations.
General
101Policies and procedures — integrity or security#
A participating entity must establish policies and procedures to protect itself against threats to its integrity or security, including foreign interference, and must adhere to those policies and procedures.
102Duty to keep records#
A participating entity must keep all records that are provided for in the regulations.
Liability
103Consumer not liable#
(1)Subject to the regulations, unless a consumer has demonstrated gross negligence or, in Quebec, gross fault, in safeguarding their authentication information, the consumer is not liable for any financial loss that arises directly from a loss of, unauthorized access to or unauthorized use of their data that occurs in relation to the sharing of data in accordance with this Act.
(2)If a consumer reports to a participating entity that their authentication information has been lost or stolen or is otherwise at risk of being used in an unauthorized manner, the consumer is not liable for any financial loss that is incurred, after the participating entity receives the report, as a result of the unauthorized use of their authentication information in relation to the sharing of data in accordance with this Act, unless the participating entity demonstrates, on a balance of probabilities, that the consumer contributed to the unauthorized use.
(3)The unauthorized use of a consumer’s authentication information in relation to the sharing of data in accordance with this Act does not by itself establish that the consumer demonstrated gross negligence or, in Quebec, gross fault, in safeguarding their authentication information.
104Responsibility for safeguarding data#
(1)A participating entity is responsible for safeguarding consumer data that is within its control in the course of the sharing of data between participating entities in accordance with this Act.
(2)Consumer data continues to be within the control of a participating entity even if the participating entity uses a third-party service provider or an affiliate entity to perform its activities under this Act.
(3)A participating entity is liable to a consumer for any financial loss that arises directly from a loss of, unauthorized access to or unauthorized use of the consumer’s data that results from a breach of the participating entity’s security safeguards that occurs in the course of the sharing of data in accordance with this Act.
(4)A participating entity remains liable to a consumer under subsection (3) even if it uses a third-party service provider or an affiliate entity to perform its activities under this Act.
Complaints Procedures
Internal Complaints Process
105Procedures for dealing with complaints#
(1)A participating entity must
(a)establish procedures that are satisfactory to the Bank for dealing with complaints;
(b)designate one of its officers or employees in Canada to be responsible for implementing those procedures; and
(c)designate one or more of its officers or employees in Canada to receive and deal with those complaints.
(2)A participating entity must not use any misleading term with respect to its procedures or designated officers or employees, including any term that suggests that the procedures, officers or employees are independent of the participating entity — such as the term “ombudsperson” or any other term with a similar meaning — or any term that is provided for in the regulations.
(3)A participating entity must provide the Bank with a copy of its most recent procedures, within the time and in the manner specified by the Bank.
(4)A participating entity must provide a person who makes a complaint with
(a)a written acknowledgment of the date on which it received the complaint;
(b)the information referred to in paragraphs 111(a) to (c); and
(c)any information that is necessary to enable the person to meet the requirements of the procedures referred to in paragraph 111(a).
106Time for dealing with complaint#
A participating entity must deal with a complaint within 56 days after the day on which it receives the complaint.
107Duty to inform complainant#
A participating entity must keep the person who made the complaint informed of the progress made in dealing with the complaint.
108Record of complaint#
A participating entity must, with respect to each complaint, make a record that is to be retained for at least five years and that contains
(b)in the case of a complaint made orally,
(i)the recording or a transcript of the recording, if the complaint was recorded, or
(c)the name of the person who made the complaint;
(e)the contact information provided by the person who made the complaint;
(f)the date on which the participating entity received the complaint;
(g)a description of the nature of the complaint;
(h)the date on which the complaint was resolved, if, in the participating entity’s opinion, it was resolved to the satisfaction of the person who made the complaint;
(i)a description of any actions that the participating entity took to attempt to resolve the complaint;
(j)a description of any compensation provided to the person who made the complaint or to the consumer referred to in paragraph (d);
(k)confirmation that the participating entity provided the person who made the complaint with the information referred to in paragraphs 111(a) to (c), if it did so; and
(l)any other information provided for in the regulations.
109Access to Bank#
A participating entity must ensure that any record retained under section 108 is accessible to the Bank.
110Annual information#
Following the end of each financial year, a participating entity must, within the time and in the form and manner specified by the Bank, provide the Bank with the following information for that year:
(a)the number and nature of any complaints that were dealt with by the officer or employee designated by the participating entity to deal with complaints who holds the most senior position identified for that purpose in the procedures established by the participating entity;
(b)the average length of time taken to deal with the complaints received by that officer or employee;
(c)the number of complaints that, in the participating entity’s opinion, were resolved by that officer or employee to the satisfaction of the persons who made them; and
(d)any other information that is provided for in the regulations.
111Complaints procedures#
A participating entity must disclose to its consumers and the public
(a)its procedures for dealing with complaints established under paragraph 105(1)(a);
(b)the name of the external complaints body and the manner in which that body may be contacted; and
(c)the Bank’s mailing address, website address and telephone number.
112Disclosure — consumers and public#
A participating entity must disclose information to its consumers and the public under section 111 by
(a)displaying the information prominently
(i)at each of the locations in Canada at which it offers services in accordance with this Act, and
(ii)on each of its websites and applications through which it offers services in accordance with this Act; and
(b)providing the information to any person who requests it, in a commonly used format that is acceptable to the person.
External Complaints Process
113Purpose#
The purpose of sections 114 to 118 is to enhance the process for dealing with complaints by establishing a regime composed of a sole external complaints body that performs its functions and activities in a transparent, effective, timely and fair manner based on the principles of accessibility, accountability, impartiality and independence.
114Designation of corporation#
(1)The Minister may, on the recommendation of the Bank, designate a corporation incorporated under the Canada Not-for-profit Corporations Act or under a provincial Act equivalent to that Act to be the external complaints body responsible for dealing with complaints referred to in paragraph 105(1)(a) that have not been resolved by its member participating entities to the satisfaction of the persons who made the complaints or that have not been dealt with within the period set out in section 106.
(2)Before designating a corporation, the Minister must take into account all factors that the Minister considers relevant, including whether the corporation has
(a)the reputation required under paragraph 115(a); and
(b)policies and procedures and terms of reference that would enable it to perform its functions and activities in a manner that is consistent with the purpose set out in section 113 and to comply with paragraphs 115(b) to (u).
(3)Every participating entity must be a member of the external complaints body.
(4)The external complaints body is not an agent of His Majesty.
(5)A designation made under subsection (1) must be published in the Canada Gazette.
115Requirements#
The external complaints body must
(a)maintain a reputation for being operated in a manner that is consistent with the standards of good character and integrity;
(b)make its services available across Canada in both official languages and offer those services free of charge to persons who make complaints;
(c)establish policies, procedures and terms of reference that are satisfactory to the Bank with respect to, among other things, dealing with complaints and consulting, at least once a year, its member participating entities and consumers to allow them to raise concerns about the external complaints body;
(d)establish the manner of calculating, to the satisfaction of the Bank, the fees it charges to each of its member participating entities for its services;
(e)make information available to consumers about their rights and responsibilities in relation to the external complaints handling regime, respond to their inquiries and requests for information and offer them assistance in making complaints;
(f)inform the parties to a complaint about the external complaints body’s terms of reference and procedures for dealing with complaints and, on request, provide the parties with any additional information and assistance to enable them to understand the requirements of those terms of reference and procedures;
(g)deal with complaints in a manner that affects only the parties to the complaints;
(h)inform the Bank in writing within 30 days after the day on which the external complaints body determines that a complaint raises a potential systemic issue;
(i)if it determines that all or part of a complaint is not within its terms of reference, provide the person who made the complaint with written reasons for that determination and the name of any entity to which the person may make a complaint, within 30 days after the day on which it receives the complaint;
(j)obtain confirmation from the member participating entity to which each complaint relates regarding whether the period set out in section 106 has ended, unless the person who made the complaint has provided the external complaints body with the written acknowledgment referred to in paragraph 105(4)(a);
(k)impartially deal with complaints referred to in paragraph 105(1)(a) that have not been resolved by its member participating entities to the satisfaction of the persons who made the complaints or that have not been dealt with within the period set out in section 106;
(l)no later than 120 days after the day on which it has all of the information that it requires to deal with a complaint, make a final written recommendation to the parties;
(m)immediately inform the Bank, in writing, of cases in which a member participating entity does not comply with a final recommendation;
(n)within 90 days after making a final recommendation, make available on its website free of charge a summary of the final recommendation that includes
(i)a description of the nature of the complaint that is the subject of the final recommendation,
(ii)the name of the member participating entity that received the complaint,
(iii)a description of any compensation provided to the person who made the complaint or to the consumer referred to in paragraph 108(d),
(iv)the reasons for the final recommendation, and
(v)any other information that is provided for in the regulations;
(o)within 60 days after the end of each quarter, submit to the Bank, in a form satisfactory to the Bank,
(i)in relation to all investigations completed during the quarter, a copy of the record of the complaint, and
(ii)any other information that is provided for in the regulations;
(p)within 60 days after the end of each financial year, meet with the Bank to discuss, among other things, complaints, operations and market trends and issues respecting consumer-driven banking that have the potential to impact consumers;
(q)within 135 days after the end of each financial year, file with the Bank a written report on the performance of its functions and activities in respect of consumer-driven banking for that year, which report is to include
(i)information about
(A)its constitution, governance and terms of reference and the identity of its member participating entities,
(B)all sources of funding for its functions and activities, including the fees charged to each of its member participating entities for its services and the manner in which those fees are calculated, and
(C)the results of the most recent evaluation referred to in paragraph (s),
(ii)a summary of the results of any consultation with its member participating entities and with persons who made complaints,
(iii)in respect of each of its member participating entities, the number and nature of complaints that it received, the number of complaints that it determined were within its terms of reference, the number of final recommendations that it made and the number of complaints that, in its opinion, were resolved to the satisfaction of the persons who made them,
(iv)the average length of time taken to deal with complaints,
(v)the number of complaints that it determined were not within its terms of reference and the reasons for that determination,
(vi)the number of complaints for which a member participating entity did not comply with a final recommendation,
(vii)the number of final recommendations in which compensation was recommended, and
(viii)the average and total compensation provided with respect to complaints that it determined were within its terms of reference;
(r)immediately after the report referred to in paragraph (q) is filed with the Bank, make that report available on its website free of charge and provide any person who requests it with a copy;
(s)submit, every five years, to an evaluation of the performance of its functions and activities in respect of consumer-driven banking that is conducted, at the discretion of the Bank, by the Bank or a third party in accordance with terms of reference that the external complaints body establishes in consultation with the Bank;
(t)accept as a member any participating entity that makes a request to it for membership, other than a participating entity that is exempted or is a member of a class that is exempted under subsection 119(1); and
(u)meet any other requirements that are provided for in the regulations.
116Provision of information — external complaints body#
A participating entity must provide the external complaints body with all information in its possession or control that relates to a complaint immediately after the external complaints body notifies it that the complaint has been received.
117Clear, simple and not misleading#
If a participating entity or the external complaints body is required under sections 105 to 116 to provide information, it must do so in a manner, and using language, that is clear, simple and not misleading.
Exemption
119Minister’s order#
(1)If the Minister is of the opinion that a participating entity is a member of or is otherwise supervised by — or that the members of a class of participating entities are members of or are otherwise supervised by — a body that exercises powers and performs duties and functions that are substantially similar to those that are conferred on the external complaints body under this Act, the Minister may, by order, exempt the participating entity or the class of participating entities from the application of subsection 114(3).
(2)A participating entity that is exempted or is a member of a class that is exempted under subsection (1) must not be a member of the external complaints body for the purposes of this Act and the provisions of this Act respecting the external complaints body do not apply in respect of the participating entity or class.
Duties of Accredited Third-Party Service Providers
120Notice of change#
(1)An accredited third-party service provider must notify the Bank of any change provided for in the regulations that relates to the accredited third-party service provider or the activities for which it is accredited.
(2)The notice must be given as soon as feasible after the accredited third-party service provider becomes aware of the change but before the change takes effect. However, if a different period is provided for in the regulations, the notice must be given within that period.
(3)The Bank must, as soon as feasible, notify the Minister and any designated person or government authority of any notice given under subsection (1).
121Request for information#
An accredited third-party service provider must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act.
122Duty to keep records#
An accredited third-party service provider must keep all records that are provided for in the regulations.
Disclosure Protection
123Disclosure — employee of participating entity#
(1)An employee of a participating entity who has reasonable grounds to believe that the participating entity or any individual or other entity has committed or intends to commit a wrongdoing may report the particulars of the matter to the Bank, a government authority, a regulatory body or a law enforcement agency.
(2)An employee of the technical standards body who has reasonable grounds to believe that the technical standards body or any individual or other entity has committed or intends to commit a wrongdoing may report the particulars of the matter to the Bank, a government authority, a regulatory body or a law enforcement agency.
(3)The Bank, government authority, regulatory body or law enforcement agency must keep confidential the identity of the employee and any information that could reasonably be expected to reveal their identity.
(4)Despite subsection (3), the Bank, government authority, regulatory body or law enforcement agency may disclose to one another the employee’s identity and information that could reasonably be expected to reveal the employee’s identity for purposes related to an investigation.
(5)If the Bank, government authority, regulatory body or law enforcement agency discloses the identity of the employee or information under subsection (4), they must make every reasonable effort to inform the employee of the disclosure.
(6)In this section, wrongdoing means a contravention of this Act or the regulations and, with respect to a participating entity, a contravention of a policy or procedure established by the participating entity in relation to its compliance with this Act.
Designation — Provincial Authority
124Designation#
(1)At the request of a provincial minister who has responsibilities that are similar to those of the Minister, the Minister may, by order, designate a department or agency of a province to, in the place of the Bank, supervise a participating entity that is a provincial financial institution or a class of participating entities that are provincial financial institutions for the purposes of any of sections 79 to 93, 95 to 97 and 103 to 112.
(2)In the order, the Minister must specify the provisions, from among those referred to in subsection (1), to which the designation relates and the participating entity or class of participating entities in respect of which it applies.
Technical Standard
125Designation of body#
(1)The Minister may, by order, designate a body to be the technical standards body that is responsible for establishing the technical standard that is to be used for the sharing of data by participating entities in accordance with this Act.
(2)In designating the technical standards body, the Minister must take into account the following factors:
(a)the need to ensure the safe, secure and efficient sharing of data among participating entities;
(b)fairness, accessibility, transparency and good governance;
(c)whether the body is incorporated, formed or otherwise organized in Canada;
(d)the independence of the body in exercising its powers and performing its duties and functions;
(e)the body’s ability to exercise its powers and perform its duties and functions in a manner that is consistent with the purposes of this Act;
(f)any other factor that the Minister considers relevant; and
(g)any other factor provided for in the regulations.
(3)The Minister must publish the order in the Canada Gazette.
127Revocation#
(1)The Minister may, by order, revoke the designation, including in the following circumstances:
(b)the Minister is of the opinion that the designation is no longer consistent with any factor referred to in subsection 125(2);
(c)the Minister is of the opinion that the designation poses a risk to national security; or
(d)the Minister is of the opinion that the designation poses a risk to the integrity or security of the financial system in Canada.
(2)The Minister must publish the order in the Canada Gazette.
128Annual report#
The technical standards body must submit an annual report to the Bank in accordance with the regulations.
129Change that has significant impact#
The technical standards body must notify the Bank of any change that has a significant impact on the technical standards body or the technical standards, including any change to the operation of the technical standard referred to in subsection 125(1) or the governance, composition or decision making of the technical standards body, as soon as feasible but no later than the seventh day after the day on which the change takes effect.
Confidentiality of Information
131Information obtained by Bank#
(1)Subject to subsections (2) and (3), information that is obtained under this Act by the Bank, and any information prepared from that information, is confidential and must be treated accordingly.
(2)The Bank may disclose information that is obtained under this Act if it is required to make the information public under subsection 7(1) or section 44 or if it does so under subsection 7(2) or section 168.
(3)The Bank may disclose information that is obtained under this Act to the Minister or to any government authority or regulatory body that agrees to treat the information as confidential.
132Information obtained by Minister#
(1)Subject to subsection (2), information that is obtained under this Act by the Minister or by a designated person or government authority, and any information prepared from that information, is confidential and must be treated accordingly.
(2)The Minister or the designated person or government authority may disclose information that is obtained under this Act to a government authority or regulatory body that agrees to treat the information as confidential.
133Evidentiary privilege#
(1)Information provided for in the regulations that relates to the supervision of participating entities or accredited third-party service providers under this Act must not be used as evidence in any civil proceedings and is privileged for that purpose.
(2)An individual or entity must not by an order of any court, tribunal or other body be required in any civil proceedings to give oral testimony or to produce any document relating to any information referred to in subsection (1).
(4)Despite subsection (1), a participating entity or accredited third-party service provider may, in accordance with the regulations, use information referred to in that subsection as evidence in any proceedings in relation to the administration or enforcement of this Act, the Bankruptcy and Insolvency Act or the Companies’ Creditors Arrangement Act that are commenced by the participating entity, the accredited third-party service provider, the Minister, the Governor, the Bank or the Attorney General of Canada.
(5)Despite subsections (1) and (2), a court, tribunal or other body may, by order, require the Minister, the Governor, the Bank, a participating entity or an accredited third-party service provider to give oral testimony or produce any document relating to any information referred to in subsection (1) in any civil proceedings in relation to the administration or enforcement of this Act that are commenced by the Minister, the Governor, the Bank, the Attorney General of Canada, a participating entity or an accredited third-party service provider.
(6)The disclosure of any information referred to in subsection (1), other than under subsection (3), (4) or (5), does not constitute a waiver of the privilege referred to in subsection (1).
Advisory and Other Committees
134Advisory and other committees#
(2)Members of a committee may be paid for their services the remuneration and expenses that the Bank may determine.
135Advisory committee#
(1)There is established an advisory committee to provide advice to the Minister and the Bank on matters relating to consumer-driven banking. The advisory committee consists of
(a)one representative appointed by the Minister;
(b)one or two representatives designated by each province; and
(c)one representative designated by the Bank.
(2)The representative appointed by the Minister is a co-chairperson of the advisory committee.
(3)The other co-chairperson is to be chosen, from among the members who are designated by the provinces, by those members to hold office for a one-year term. That co-chairperson is not authorized to hold that office for consecutive terms.
(4)If the co-chairperson chosen under subsection (3) is absent or unable to act, the members who are designated by the provinces may choose another one of those members to act as co-chairperson.
No Liability
136No liability — Bank#
No action lies against His Majesty, any officer, employee or director of the Bank or any person acting under the direction of the Governor for anything done or omitted to be done in good faith in the administration or discharge of any powers, duties or functions that under this Act are intended or authorized to be exercised or performed.
137No liability — Minister#
No action lies against His Majesty, the Minister, any designated person or government authority or any person acting under the direction of the Minister for anything done or omitted to be done in good faith in the administration or discharge of any powers, duties or functions that under this Act are intended or authorized to be exercised or performed.
Not Compellable
138Not compellable — Bank#
An officer, employee or director of the Bank or any person acting under the instructions of the Governor is not a compellable witness in any civil proceedings in respect of any matter coming to their knowledge as a result of exercising any of their powers or performing any of their duties or functions under this Act.
139Not compellable — Minister#
The Minister, a designated person or government authority or any person acting under the instructions of the Minister or the designated person or government authority is not a compellable witness in any civil proceedings in respect of any matter coming to their knowledge as a result of exercising any of their powers or performing any of their duties or functions under this Act.
Assessment of Fees
140Bank to ascertain expenses#
(1)The Bank must, before September 30 of each year, ascertain the total amount of expenses incurred by it during the immediately preceding calendar year for or in connection with the administration of this Act and deduct from that amount any accreditation fees paid to it in that preceding calendar year.
(2)The amount ascertained is final and conclusive for the purposes of this section.
(3)As soon as feasible after ascertaining the amount, the Bank must, in the manner and to the extent provided for in the regulations, assess a portion of the total amount of expenses against each participating entity, each accredited third-party service provider and the external complaints body, in accordance with the regulations.
(4)The Bank may, during each calendar year, prepare an interim assessment against any participating entity, any accredited third-party service provider or the external complaints body.
(5)Every assessment and interim assessment is final and conclusive and binding on the participating entity or accredited third-party service provider against which it is made or the external complaints body.
(6)Every assessment and interim assessment constitutes a debt due to the Bank, is immediately payable and may be recovered as a debt in any court of competent jurisdiction.
(7)Interest may be charged on the unpaid amount of an assessment or interim assessment at a rate equal to the rate prescribed under the Income Tax Act for amounts payable by the Minister of National Revenue as refunds of overpayments of tax under that Act in effect from time to time plus 2%.
141Request for information#
(1)The Bank may request in writing that a participating entity, an accredited third-party service provider or the external complaints body provide the Bank, within the period provided for in the regulations, with any information that the Bank considers necessary for the purposes of subsection 140(3) or (4).
(2)The participating entity, accredited third-party service provider or external complaints body must comply with the request.
Administration and Enforcement
Bank’s Powers
142Request for information#
(1)The Bank may request in writing that an individual or entity, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank considers necessary for a purpose related to verifying compliance with an undertaking required under section 55 or terms and conditions imposed under section 56.
(2)The individual or entity must comply with the request.
143Examination and inquiry#
(1)The Bank must, from time to time, make or cause to be made any examination and inquiry that the Bank considers necessary for the purposes of satisfying the Bank that participating entities, accredited third-party service providers, the external complaints body and the technical standards body are complying with this Act and, after the conclusion of each examination and inquiry, must report on it to the Minister.
(2)For the purposes of this section, the Bank
(a)has a right of access to any records of a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body; and
(b)may require the directors or officers of a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body to provide information and explanations, to the extent that they are reasonably able to do so, in respect of any matter subject to examination or inquiry under this section.
(3)The Bank may direct that a special audit of a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body be conducted, in accordance with any conditions that the Bank considers appropriate, if the Bank is of the opinion that the special audit is necessary for a purpose related to verifying compliance with this Act. The Bank may appoint an individual or entity to conduct the special audit.
(4)The participating entity, accredited third-party service provider, external complaints body or technical standards body must give all assistance that is reasonably required to enable the appointed individual or entity to conduct the special audit and must provide any documents or information, and access to any data, that are specified by the individual or entity.
(5)If a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body is the subject of a special audit, it must provide the Bank with the results of the audit.
(6)The expenses incurred in respect of any special audit are payable by the participating entity, accredited third-party service provider, external complaints body or technical standards body that is the subject of the audit.
(7)If the Bank makes or causes to be made any examination, inquiry or audit in respect of a participating entity that is a provincial financial institution, the Bank must, as soon as feasible, notify the appropriate provincial authority that regulates or supervises the provincial financial institution.
144Designation#
The Governor may designate persons or classes of persons as authorized persons for the purposes of sections 145 and 146.
145Powers — authorized person#
(1)An authorized person may, from time to time, examine the records and inquire into the business and affairs of a participating entity for the purpose of verifying compliance with this Act and for that purpose may
(a)enter any place in which the authorized person has reasonable grounds to believe that there are records relevant to verifying compliance with this Act;
(b)use any computer system in the place, or cause it to be used, to examine data contained in or available to it;
(c)reproduce any record or cause any record to be reproduced from the data, in the form of a printout or other intelligible output and remove the printout or other output for examination or copying; or
(d)use any copying equipment in the place or cause it to be used.
(2)The owner or person in charge of the place and every person in the place must give all assistance that is reasonably required to enable the authorized person to perform their functions under this section and must provide any documents or information, and access to any data, that are specified by the authorized person.
146Warrant to enter dwelling-house#
(1)If the place is a dwelling-house, an authorized person may enter it without the occupant’s consent only under the authority of a warrant issued under subsection (2).
(2)On ex parte application, a justice of the peace may issue a warrant authorizing an authorized person to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice is satisfied by information on oath that
(a)the dwelling-house is a place referred to in paragraph 145(1)(a);
(b)entry to the dwelling-house is necessary for a purpose related to verifying compliance with this Act; and
(c)entry was refused by the occupant or there are reasonable grounds to believe that entry will be refused by, or that consent to entry cannot be obtained from, the occupant.
147Compliance agreement#
The Bank may enter into a compliance agreement with a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body for the purpose of implementing any measure that is designed to further its compliance with this Act.
148Directions — participating entity#
(1)If, in the Bank’s opinion, a participating entity, or another entity or individual in conducting the business or affairs of the participating entity, fails to comply — or there are reasonable grounds to believe that the participating entity or the entity or individual will fail to comply — with a compliance agreement, the Bank may direct the participating entity or the entity or individual to comply with the compliance agreement and to take any measures that in the Bank’s opinion are necessary to do so.
(2)If, in the Bank’s opinion, a participating entity does not have adequate policies and procedures to protect itself against threats to its integrity or security or a participating entity is not adhering to its policies and procedures in that matter, the Bank may direct the participating entity to take any measures that in the Bank’s opinion are necessary to remedy the situation.
(3)If, in the Bank’s opinion, an accredited third-party service provider, or another entity or individual in conducting the business or affairs of the accredited third-party service provider, fails to comply — or there are reasonable grounds to believe that the accredited third-party service provider or the entity or individual will fail to comply — with a compliance agreement, the Bank may direct the accredited third-party service provider or the entity or individual to comply with the compliance agreement and to take any measures that in the Bank’s opinion are necessary to do so.
(4)If, in the Bank’s opinion, the external complaints body fails, or there are reasonable grounds to believe that it will fail, to comply with a compliance agreement or any of paragraphs 115(b) to (u) or to perform its functions and activities in a manner that is consistent with the purpose set out in section 113, the Bank may direct the external complaints body to comply, to so perform its functions and activities and to take any measures that in the Bank’s opinion are necessary to do so.
(5)If, in the Bank’s opinion, the technical standards body fails to comply, or there are reasonable grounds to believe that it will fail to comply, with a compliance agreement, the Bank may direct the technical standards body to comply and to take any measures that in the Bank’s opinion are necessary to do so.
(6)Subject to subsection (7), the Bank must not make a direction under any of subsections (1) to (5) unless the participating entity, accredited third-party service provider, entity or individual in question or the external complaints body or technical standards body is provided with an opportunity to make representations in respect of the matter.
(8)A temporary direction continues to have effect after the end of the 15-day period if no representations are made to the Bank within that period or, if representations have been made, the Bank notifies the participating entity, accredited third-party service provider, entity or individual, external complaints body or technical standards body that the Bank is not satisfied that there are sufficient grounds for revoking the direction.
149Court enforcement — participating entity#
(1)If a participating entity, or another entity or individual in conducting the business or affairs of the participating entity, fails to comply with a compliance agreement or a direction made under section 148, contravenes a provision of this Act or the regulations or omits to do any thing that is required to be done under this Act, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the participating entity, entity or individual to comply with the compliance agreement or the direction, cease the contravention or do any thing that is required to be done. The court may make the order and any other order that it thinks fit.
(2)If an accredited third-party service provider, or another entity or individual in conducting the business or affairs of the accredited third-party service provider, fails to comply with a compliance agreement or a direction made under section 148, contravenes a provision of this Act or the regulations or omits to do any thing that is required to be done under this Act, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the accredited third-party service provider, entity or individual to comply with the compliance agreement or the direction, cease the contravention or do any thing that is required to be done. The court may make the order and any other order that it thinks fit.
(3)If the external complaints body fails to comply with a compliance agreement, any of paragraphs 115(b) to (u) or a direction made under section 148, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the external complaints body to comply with the compliance agreement, the paragraph or the direction. The court may make the order and any other order that it thinks fit.
(4)If the technical standards body fails to comply with a compliance agreement or a direction made under section 148, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the technical standards body to comply with the compliance agreement or the direction. The court may make the order and any other order that it thinks fit.
(5)An appeal from a decision of a court under this section lies in the same manner and to the same court as an appeal from any other order of the court.
150Notice to Minister#
If, in the Bank’s opinion, an individual or entity fails to comply, or there are reasonable grounds to believe that an individual or entity will fail to comply, with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3), the Bank must immediately notify the Minister.
Minister’s Powers
151Designation#
The Minister may designate persons or classes of persons as authorized persons for the purposes of sections 152 to 154.
152Request for information#
(1)An authorized person may request in writing that an individual or entity, within the time and in the manner specified by the authorized person, provide the authorized person with any information that the authorized person considers necessary for a purpose related to verifying compliance with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3).
(2)The individual or entity must comply with the request.
153Powers — authorized person#
(1)An authorized person may, from time to time, examine the records and inquire into the business and affairs of an individual or entity for the purpose of verifying compliance with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3) and for that purpose may
(a)enter any place in which the authorized person has reasonable grounds to believe that there are records relevant to verifying compliance with the undertaking, terms and conditions or order;
(b)use any computer system in the place, or cause it to be used, to examine data contained in or available to it;
(c)reproduce any record or cause any record to be reproduced from the data, in the form of a printout or other intelligible output and remove the printout or other output for examination or copying; or
(d)use any copying equipment in the place or cause it to be used.
(2)The owner or person in charge of the place and every person in the place must give all assistance that is reasonably required to enable the authorized person to perform their functions under this section and must provide any documents or information, and access to any data, that are specified by the authorized person.
154Warrant to enter dwelling-house#
(1)If the place is a dwelling-house, an authorized person may enter it without the occupant’s consent only under the authority of a warrant issued under subsection (2).
(2)On ex parte application, a justice of the peace may issue a warrant authorizing an authorized person to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice is satisfied by information on oath that
(a)the dwelling-house is a place referred to in paragraph 153(1)(a);
(b)entry to the dwelling-house is necessary for a purpose related to verifying compliance with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3); and
(c)entry was refused by the occupant or there are reasonable grounds to believe that entry will be refused by, or that consent to entry cannot be obtained from, the occupant.
Administrative Monetary Penalties
Violations
155Regulations#
(1)The Governor in Council may make regulations
(a)designating as a violation the contravention of a specified provision of this Act or of the regulations or the non-compliance with orders made, undertakings required, compliance agreements entered into or directions made under this Act;
(b)establishing, having regard to subsection (2), a penalty or a range of penalties in respect of a violation;
(c)respecting the service of documents under sections 156 to 168, including the manner and proof of service and the circumstances under which documents are considered to be served;
(e)generally, for carrying out the purposes and provisions of this section and sections 156 to 168.
(2)The maximum penalty for a violation is $1,000,000 if the violation is committed by an individual and $10,000,000 if the violation is committed by a participating entity or accredited third-party service provider.
156Criteria for penalty#
Except if a penalty is fixed under paragraph 155(1)(b), the amount of a penalty must, in each case, be determined taking into account
(a)the degree of intention or negligence on the part of the individual or entity that committed the violation;
(b)the harm done by the violation;
(c)the duration of the violation;
(d)the ability of the individual or entity that committed the violation to pay the penalty;
(e)the history of the individual or entity that committed the violation with respect to any prior violation or conviction under this Act within the five-year period immediately before the violation; and
(f)any other criteria that may be provided for in the regulations.
Proceedings
159Commission of violation#
(1)Every contravention or non-compliance that is designated under paragraph 155(1)(a) constitutes a violation and the individual or entity that commits the violation is liable to a penalty determined in accordance with sections 155 and 156.
(3)A notice of violation must name the individual or entity believed to have committed a violation, identify the violation and set out
(a)the penalty that the Bank proposes to impose;
(b)the right of the individual or entity, within 30 days after the day on which the notice is served or within any longer period that the Bank specifies, to pay the penalty or to make representations to the Governor with respect to the violation and the proposed penalty, and the manner for doing so; and
Determination of Responsibility and Penalty
160Payment#
(2)If the individual or entity makes representations in accordance with the notice, the Governor must decide, on a balance of probabilities, whether the individual or entity committed the violation and, if so, may, subject to any regulations made under paragraph 155(1)(b), impose the penalty proposed in the notice, a lesser penalty or no penalty.
(3)An individual or entity that neither pays the penalty nor makes representations in accordance with the notice is deemed to have committed the violation and the Bank may, subject to any regulations made under paragraph 155(1)(b), impose the penalty proposed in the notice, a lesser penalty or no penalty.
Appeal to Federal Court
161Right of appeal#
(1)An individual or entity on which a notice under subsection 160(4) is served may, within 30 days after the day on which the notice is served or within any longer period that the Court allows, appeal the decision to the Federal Court.
(2)In an appeal, the Federal Court must take every reasonable precaution, including, if appropriate, conducting hearings in private, to avoid the disclosure by the Court or any person of confidential information referred to in section 131.
(3)On an appeal, the Federal Court may confirm, set aside or, subject to any regulations made under paragraph 155(1)(b), vary the decision.
Enforcement
162Debts to His Majesty#
(1)A penalty constitutes a debt due to His Majesty in right of Canada that may be recovered in the Federal Court.
(2)No proceedings to recover a debt referred to in subsection (1) may be commenced later than five years after the day on which the debt becomes payable.
(3)A debt referred to in subsection (1) is payable to and must be remitted to the Receiver General.
163Certificate of default#
(1)The unpaid amount of any debt referred to in subsection 162(1) may be certified by the Governor.
(2)Registration in the Federal Court of a certificate has the same effect as a judgment of that Court for a debt of the amount specified in the certificate and all related registration costs.
Rules About Violations
164Violations not offences#
For greater certainty, a violation is not an offence and, accordingly, section 126 of the Criminal Code does not apply in respect of a violation.
165Due diligence available#
(1)Due diligence is a defence in a proceeding in relation to a violation.
(2)Every rule and principle of the common law that makes any circumstance a justification or excuse in relation to a charge for an offence applies in respect of a violation to the extent that it is not inconsistent with this Act.
General Provisions
166Admissibility#
In a proceeding in respect of a violation or a prosecution for an offence, a notice purporting to be issued under subsection 159(2) or 160(4) or a certificate purporting to be made under subsection 163(1) is admissible in evidence without proof of the signature or official character of the person appearing to have signed it.
167Limitation period or prescription#
(1)No proceedings in respect of a violation may be commenced later than two years after the day on which the subject matter of the proceedings became known to the Bank.
(2)A document appearing to have been issued by the Bank, certifying the day on which the subject matter of any proceedings became known to the Bank, is admissible in evidence without proof of the signature or official character of the person appearing to have signed the document and is, in the absence of evidence to the contrary, proof of the matter asserted in it.
Authorization — “Consumer-Driven Banking”
169Use of phrase#
A participating entity, an accredited third-party service provider and the technical standards body are authorized to use the phrase “consumer-driven banking” to indicate or describe the activities that they perform under this Act.
Prohibitions
170Claiming to be participating entity#
An individual or entity, other than a participating entity, must not
(a)use the term “participating entity” or a variation, abbreviation or equivalent of that term, or any words, name or designation — in any language — in a manner that leads to a reasonable belief that the individual or entity is a participating entity for the purposes of this Act; or
(b)represent themselves, in any way or by any means, to be a participating entity for the purposes of this Act.
171Screen scraping#
Subject to the regulations, an individual or entity must not, for the purposes of providing a consumer in Canada with a product or service, use an interface or application to gain direct access to the consumer’s data using the consumer’s authentication information.
Offences and Punishment
174Offence#
(1)Every individual or entity commits an offence that
(a)contravenes a provision of this Act, other than section 172, or of the regulations;
(b)fails to comply with an order made under section 55 or an undertaking required under that section;
(c)fails to comply with an order made under section 56 or subsection 60(1) or (3) or 61(1) or (3);
(d)fails to comply with a compliance agreement entered into under section 147; or
(e)fails to comply with a direction made under section 148.
(2)Every individual or entity that contravenes section 172 commits an offence.
(3)Every individual or entity that commits an offence under subsection (1) or (2) is liable
(a)on conviction on indictment,
(i)in the case of an individual, to a fine of not more than $1,000,000 or to imprisonment for a term of not more than five years, or to both, or
(ii)in the case of an entity, to a fine of not more than $5,000,000; or
(b)on summary conviction,
(i)in the case of an individual, to a fine of not more than $100,000 or to imprisonment for a term of not more than one year, or to both, or
(ii)in the case of an entity, to a fine of not more than $500,000.
(4)An individual or entity is not to be found guilty of an offence under subsection (1) if they establish that they exercised due diligence to prevent the commission of the offence.
175Order to comply#
(1)If an individual or entity is convicted of an offence under this Act, the court may, in addition to any punishment that it may otherwise impose, order the individual or entity to comply with the provisions of this Act or of the regulations in respect of which the individual or entity was convicted.
(2)If an individual or entity is convicted of an offence under this Act, the court may, if it is satisfied that as a result of the commission of the offence the convicted individual or entity acquired any monetary benefits or that monetary benefits accrued to the convicted individual or entity or the individual’s spouse, common-law partner or other dependant, order the convicted individual or entity to pay, despite the maximum amount of any fine that may otherwise be imposed under this Act, an additional fine in an amount equal to three times the court’s estimation of the amount of those monetary benefits.
176Party to offence#
If an entity commits an offence under this Act, any director, any officer, any agent or mandatary or any principal officer of the entity who directed, authorized, assented to, acquiesced in or participated in the commission of the offence is a party to and guilty of the offence and is liable on summary conviction or on conviction on indictment to the punishment provided for an individual in respect of the offence, whether or not the entity has been prosecuted or convicted.
177Limitation period#
(1)Proceedings by way of summary conviction in respect of an offence under this Act may be commenced at any time within, but not later than, two years after the day on which the subject matter of the proceedings became known to the Bank.
(2)A document appearing to have been issued by the Bank, certifying the day on which the subject matter of any proceedings became known to the Bank, is admissible in evidence without proof of the signature or official character of the person appearing to have signed the document and is, in the absence of evidence to the contrary, proof of the matter asserted in it.
Regulations
178Regulations#
The Governor in Council may, on the recommendation of the Minister, make regulations generally for carrying out the purposes and provisions of this Act and, in particular, may make regulations
(a)specifying the data that is excluded from the definition derived data in section 2;
(b)respecting accreditation;
(c)respecting fees for accreditation;
(d)respecting notifications and the provision of information in the case of the revocation of a participating entity’s or accredited third-party service provider’s accreditation;
(e)respecting the registry referred to in section 44;
(f)respecting the sharing of data under section 76 and providing for exceptions to the duty to share and to the prohibition on imposing conditions set out in that section;
(g)respecting security safeguards to be implemented for the purposes of section 79;
(h)respecting designations under section 80;
(i)respecting reports made and notices given under section 82;
(j)respecting the duty to investigate and report under section 83;
(k)respecting the express consent that must be obtained under section 85;
(l)respecting the information to be provided under subsection 85(4);
(m)respecting exceptions to the duty set out in subsection 85(6);
(n)respecting the record that must be kept under subsection 85(8);
(o)respecting the renewal of consent under subsection 87(1), providing for the circumstances referred to in that subsection and respecting the information to be provided under paragraph 87(4)(c);
(p)exempting participating entities, for the purposes of subsection 87(2), from any requirements under subsection 85(4);
(q)respecting exceptions to the duty set out in subsection 87(5);
(r)respecting the notice of withdrawal of consent referred to in subsection 90(1) and the information to be provided under paragraph 90(2)(c);
(s)respecting exceptions to the duty set out in subsection 90(4);
(t)respecting the duty set out in subsection 92(1);
(u)respecting the display of a sign under section 94;
(v)respecting the duties set out in section 96;
(w)respecting the duty to keep records under section 102;
(x)respecting the liability of consumers and participating entities under subsection 103(1);
(y)respecting the duties set out in subsection 105(4) or section 111;
(z)respecting the duty to keep records under section 122;
(z.1)respecting the annual report referred to in section 128, including the information that is to be included in the report and the form and manner in which, and the time within which, it is to be submitted;
(z.2)respecting the circumstances in which information referred to in subsection 133(1) may be used as evidence;
(z.3)respecting exceptions to the prohibition set out in section 171; and
(z.4)providing for anything that by this Act is to be provided for in the regulations.
179Statutory Instruments Act#
The Statutory Instruments Act does not apply in respect of
(a)an order made under any of subsections 13(1) to (3);
(b)a notice given under section 25;
(c)a notice given under section 38;
(d)a directive issued under section 51;
(e)an order made under any of sections 55 to 57;
(f)an order made under subsection 60(1) or (3) or 61(1) or (3);
(g)a notice issued under subsection 66(1);
(h)a directive issued under subsection 67(2) or (7) or section 68;
(i)a designation made under subsection 114(1);
(j)an order made under subsection 119(1);
(k)an order made under subsection 124(1);
(l)an order made under subsection 125(1) or 127(1); or
(m)a direction made under section 148.
Review
Coming into Force
*181Order in council#
The provisions of this Act, other than sections 1 to 9, 13, 14, 74 and 113, subsections 114(1), (2), (4) and (5), paragraph 115(a) and sections 117 to 119, 123 to 132, 136 to 139, 143, 147 to 149, 169, 170 and 172 to 179, come into force on a day or days to be fixed by order of the Governor in Council.
(Section 2, subsections 13(1) to (3), 14(1) and (2) and 15(1) and paragraph 44(b))
Amendments not in force
— 2026, c. 22, s. 26Subsection 23(1) of the Consumer-Driven Banking Act is replaced by the following:The Bank may suspend a participating entity’s accreditation if the Bank is satisfied that the participating entity has contravened this Act or its regulations, sections 30.2 to 30.5 of the Bank of Canada Act or regulations made for the purposes of section 30.2, 30.3 or 30.5 of that Act. — 2026, c. 22, s. 27Section 25 of the Act is replaced by the following:The Bank may give a participating entity a notice of intent to revoke the participating entity’s accreditation if the Bank is satisfied that the participating entity has contravened this Act or its regulations, sections 30.2 to 30.5 of the Bank of Canada Act or regulations made for the purposes of section 30.2, 30.3 or 30.5 of that Act. A notice of intent must include reasons. — 2026, c. 22, s. 28Subsection 36(1) of the Act is replaced by the following:The Bank may suspend an accredited third-party service provider’s accreditation if the Bank is satisfied that the accredited third-party service provider has contravened this Act or its regulations, sections 30.2 to 30.5 of the Bank of Canada Act or regulations made for the purposes of section 30.2, 30.3 or 30.5 of that Act. — 2026, c. 22, s. 29Section 38 of the Act is replaced by the following:The Bank may give an accredited third-party service provider a notice of intent to revoke the accredited third-party service provider’s accreditation if the Bank is satisfied that the accredited third-party service provider has contravened this Act or its regulations, sections 30.2 to 30.5 of the Bank of Canada Act or regulations made for the purposes of section 30.2, 30.3 or 30.5 of that Act. A notice of intent must include reasons. — 2026, c. 22, s. 30The heading before section 140 and sections 140 and 141 of the Act are repealed. — 2026, c. 22, s. 31Paragraph 155(1)(a) of the Act is replaced by the following:designating as a violation the contravention of a specified provision of this Act or its regulations — or of sections 30.2 to 30.5 of the Bank of Canada Act or of regulations made for the purposes of section 30.2, 30.3 or 30.5 of that Act — or the non-compliance with orders made, undertakings required, compliance agreements entered into or directions made under this Act;
Federal laws of Canada reproduced under the Reproduction of Federal Law Order (SI/97-5); not the official version. Source: Justice Laws Website.