> ## Documentation Index > Fetch the complete documentation index at: https://docs.amlok.io/llms.txt > Use this file to discover all available pages before exploring further. # Canadian requirements > Privacy, financial-sector oversight, data access, and activity-based obligations for Canadian deployments. Use this guide to map the requirements for your Canadian deployment. Applicability depends on the entities, activities, data flows, and institution involved. ## Privacy across Canada PIPEDA applies to personal information in relevant commercial activities, including interprovincial and international flows. Alberta, British Columbia, and Quebec have substantially similar private-sector privacy laws that can govern activity within those provinces. Consider both the organization and the particular processing activity. See the [OPC jurisdiction guidance](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/02_05_d_26/). | Framework | Deployment review | | - | - | | PIPEDA | Accountability, appropriate purposes, consent where required, collection limits, safeguards, retention, openness, access, and correction. | | Alberta PIPA | Provincial processing requirements, outside-Canada service-provider transparency, and breach assessment. | | British Columbia PIPA | Reasonable purposes, consent and exceptions, protection, access, correction, and retention. | | Quebec private-sector privacy law, as amended by Law 25 | Governance, assessments, sensitive information, automated decisions, transfers, and rights. See [Quebec privacy](https://docs.amlok.io/security/quebec.md). | Review [PIPEDA requirements](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/), [Alberta responsibilities](https://www.alberta.ca/organization-responsibilities-for-protecting-personal-information), and [BC guidance](https://www.oipc.bc.ca/for-private-organizations/). Business borrowers can supply personal information about owners and guarantors. ## Financial-institution oversight OSFI guidance is relevant to federally regulated financial institutions and their use of third parties. It is not automatically binding on every credit union, provincial lender, or software supplier. | Guidance | Matters to address with the institution | | - | - | | B-10: Third-party risk management | Supplier assessment, materiality, agreements, subcontractors, monitoring, continuity, and exit. | | B-13: Technology and cyber risk management | Technology governance, information protection, resilience, incident management, and control evidence. | | E-23: Model risk management | Model inventory, intended use, validation, monitoring, change controls, and accountability. | Outsourcing does not remove institutional accountability. The revised E-23 takes effect on **May 1, 2027**; identify requirements applicable during transition rather than treating that future date as already effective. Sources: [B-10](https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline), [B-13](https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-risk-management), and [E-23](https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e-23-model-risk-management-2027). For other institutions, map provincial-regulator requirements separately. Agree information, review rights, and operational assistance required from AMLOK in the service agreement. ## AML and FINTRAC Reporting-entity obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act depend on sector and activity. FINTRAC's scope includes financial entities, mortgage administrators, brokers and lenders, and specified financing or leasing activities, among others. See [who must report](https://fintrac-canafe.canada.ca/reporting-declaration/info/re-ed-eng.php) and [financing and leasing requirements](https://fintrac-canafe.canada.ca/re-ed/lease-bail-eng). The institution determines its identification, beneficial-ownership, monitoring, recordkeeping, and reporting duties. Underwriting analysis or a monitoring signal is not, by itself, a completed AML program or regulatory filing. Agree any screening or verification scope expressly. ## Bank-data access and payments Consumer-driven banking participation and accreditation are distinct from connecting a commercial data provider. Confirm the current framework, permitted access route, and permissions before relying on a connection. The [Bank of Canada's consumer-driven banking page](https://www.bankofcanada.ca/regulatory-oversight/consumer-driven-banking/) tracks implementation and proposed regulations. If a workflow introduces payment initiation, funds handling, or another payment function, assess the Retail Payment Activities Act before activation. Applicability depends on actual functions, geographic scope, and exclusions. See the [supervisory framework](https://www.bankofcanada.ca/regulatory-oversight/retail-payments/supervisory-framework/). ## Communications and product-specific obligations Commercial email and text messages may require consent, sender identification, and an unsubscribe mechanism under CASL, subject to applicable exceptions. Review the [CRTC guidance](https://crtc.gc.ca/eng/internet/anti/reg.htm) for each message type. Also assess applicable provincial lending, mortgage, consumer-reporting, collections, human-rights, accessibility, and language requirements. Health or public-sector data requires separate analysis. This guide does not enumerate every obligation for every lending product. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.