Skip to main content
Use this guide to map the requirements for your Canadian deployment. Applicability depends on the entities, activities, data flows, and institution involved.

​
Privacy across Canada

PIPEDA applies to personal information in relevant commercial activities, including interprovincial and international flows. Alberta, British Columbia, and Quebec have substantially similar private-sector privacy laws that can govern activity within those provinces. Consider both the organization and the particular processing activity. See the OPC jurisdiction guidance. Review PIPEDA requirements, Alberta responsibilities, and BC guidance. Business borrowers can supply personal information about owners and guarantors.

​
Financial-institution oversight

OSFI guidance is relevant to federally regulated financial institutions and their use of third parties. It is not automatically binding on every credit union, provincial lender, or software supplier. Outsourcing does not remove institutional accountability. The revised E-23 takes effect on May 1, 2027; identify requirements applicable during transition rather than treating that future date as already effective. Sources: B-10, B-13, and E-23. For other institutions, map provincial-regulator requirements separately. Agree information, review rights, and operational assistance required from AMLOK in the service agreement.

​
AML and FINTRAC

Reporting-entity obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act depend on sector and activity. FINTRAC’s scope includes financial entities, mortgage administrators, brokers and lenders, and specified financing or leasing activities, among others. See who must report and financing and leasing requirements. The institution determines its identification, beneficial-ownership, monitoring, recordkeeping, and reporting duties. Underwriting analysis or a monitoring signal is not, by itself, a completed AML program or regulatory filing. Agree any screening or verification scope expressly.

​
Bank-data access and payments

Consumer-driven banking participation and accreditation are distinct from connecting a commercial data provider. Confirm the current framework, permitted access route, and permissions before relying on a connection. The Bank of Canada’s consumer-driven banking page tracks implementation and proposed regulations. If a workflow introduces payment initiation, funds handling, or another payment function, assess the Retail Payment Activities Act before activation. Applicability depends on actual functions, geographic scope, and exclusions. See the supervisory framework.

​
Communications and product-specific obligations

Commercial email and text messages may require consent, sender identification, and an unsubscribe mechanism under CASL, subject to applicable exceptions. Review the CRTC guidance for each message type. Also assess applicable provincial lending, mortgage, consumer-reporting, collections, human-rights, accessibility, and language requirements. Health or public-sector data requires separate analysis. This guide does not enumerate every obligation for every lending product.