Banks in Canada have been continuously recognised as amongst the soundest and safest across the globe and well positioned for future challenges.
Banks in Canada have been continuously recognised as amongst the soundest and safest across the globe and well positioned for future challenges.
Banking in Canada falls under federal jurisdiction such that the Parliament of Canada has legislative authority over “Banking, Incorporation of Banks, and the Issue of Paper Money”. The primary piece of legislation that governs banking in Canada is the Bank Act1 and its regulations.
Banks in Canada are supervised by multiple regulators, with the Office of the Superintendent of Financial Institutions (OSFI) responsible for prudential regulation and financial stability, and the Financial Consumer Agency of Canada (FCAC) responsible for consumer protection and market conduct. OSFI regulates and supervises all banks under its supervisory framework, develops and interprets legislation, and issues guidelines. The FCAC ensures that federally regulated financial institutions (FRFIs) comply with consumer protection measures, and helps to keep consumers informed. The FCAC also supervises payment card network operators and external complaints bodies. The FCAC’s Enforcement Division investigates and evaluates possible concerns, and has the power to enforce compliance.
Several other regulatory bodies are also involved in regulating banks in Canada. The Department of Finance helps the Government develop and implement financial sector policy and legislation. The Bank of Canada, which is owned by the Federal Government, helps to keep inflation low, promotes efficient banking systems, is responsible for currency, and is a fiscal agent for the Government. The Canadian Payments Association (d.b.a. Payments Canada) (PC) runs the national clearing and settlement system in Canada. The Canada Deposit Insurance Corporation (CDIC) provides deposit insurance to all member institutions (which includes all major Canadian banks) against the loss of eligible deposits in the event of failure. The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) helps to protect Canada’s financial system by detecting and deterring money laundering and terrorist financing under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act2 (Proceeds of Crime Act) and its regulations.
The Ombudsman for Banking Services and Investments is an independent and impartial body that resolves disputes between banks and their customers when a bank is unable to resolve the dispute internally. The Canadian Bankers Association (CBA) advocates for effective policies and works with banks and law enforcement to protect Canadians against financial crimes. Banks in Canada also need to ensure compliance with privacy legislation, which is enforced by the Office of the Privacy Commissioner of Canada, who has the power to investigate complaints, conduct audits, and pursue court action. Finally, the Financial Institutions Supervisory Committee, whose membership consists of OSFI, the Bank of Canada, the Department of Finance, CDIC and the FCAC, meets to discuss, coordinate, and advise the Federal Government on issues related to the Canadian financial system.
There are also three supranational regulatory bodies that are influential in Canadian banking. The Bank for International Settlements (BIS), of which the Bank of Canada is a member, leads global regulatory work on financial systems across the globe. The Basel Committee on Banking Supervision (Basel Committee) is made up of BIS members, and strengthens worldwide banking through the release of recommendations aimed at enhancing financial stability. Both the Bank of Canada and OSFI are Basel Committee members and are committed to implementing its recommendations. Lastly, the Financial Stability Board (FSB), which consists of G20 countries, monitors and makes recommendations related to the global financial system. The Bank of Canada, OSFI and the Department of Finance are members of the FSB.
Restrictions on activities
The Bank Act imposes ownership requirements on banks in Canada. For instance, the Bank Act prohibits a person from being a major shareholder of a bank with equity of $12bn or more. Banks with equity of $2bn or more but less than $12bn must have at least 35% of their shares with voting rights listed and posted on a recognised stock exchange and they must not be owned by a major shareholder.
Pursuant to the Bank Act, banks are only permitted to carry on the “business of banking”, which includes activities such as providing financial services, acting as a financial agent, providing investment counselling, issuing payment, credit, or charge cards, etc. Except when permitted by the Bank Act, banks may not “deal in goods, wares or merchandise or engage in any trade or other business”.
The Bank Act also includes restrictions on undertaking fiduciary activities, guarantees of payment or repayment, dealing in securities, engaging in the insurance business, undertaking personal property leasing activities, and entering into partnerships. Moreover, banks have restrictions on the types of investments they can make and are prohibited from investing in an entity that carries on some of the activities listed above or entities that deal in securities, except in certain circumstances. Banks may invest in securities, but are restricted from making substantial investments (e.g. acquiring more than 10% interest in a non-bank entity) or in controlling certain types of entities. Under s. 468(1) of the Bank Act, banks may make a substantial investment in, or take control of, other banks, trust or loan companies, insurance companies, cooperative credit societies, and entities primarily engaged in dealing in securities. However, certain investments nonetheless require the approval of OSFI or the Minister of Finance.
Banks are prohibited from imposing any undue pressure or coercion on a person to obtain a product or service as a condition for obtaining another product or service. Subject to certain exceptions, a bank cannot make a loan to a natural person that contains conditions that prohibit the prepayment of the loan prior to the due date, nor require a natural person to have an initial minimum deposit or maintain a minimum balance with respect to a retail account.
Banks are also prohibited from entering into related party transactions, except as otherwise permitted under the Bank Act (for instance, if the value is “nominal or immaterial to the bank”).
The banking architecture in Canada continues to evolve to strengthen financial security and to incorporate international standards. The Canadian Federal Government’s 2019 budget (2019 Budget) set out measures to update financial sector statutes by introducing amendments to the Bank Act, the Insurance Companies Act, and the Trust and Loan Companies Act (TLCA), as well as related legislation such as the Bank of Canada Act, the Canada Deposit Insurance Corporation Act (CDIC Act), the Proceeds of Crime Act and the Payment Clearing and Settlement Act (PCSA).3 As of October 2021, most of the proposed legislative changes resulting from the 2019 Budget have now been implemented, either through Budget Implementation Act, 2019, No. 1,4 which introduced new proxy solicitation requirements under the Bank Act and changes to the disclosure rules under the Proceeds of Crime Act, or through Budget Implementation Act, 2021, No. 1 (2021 Budget Implementation Act), which was assented to on June 29, 2021. The 2021 Budget Implementation Act includes amendments to the CDIC Act and the PCSA to, among other things, clarify the compensation process when financial sector authorities sell, wind down or restore to viability a failing bank, and also amendments to the Bank Act, the Bank of Canada Act, and the TLCA to modernise the federal unclaimed assets regime. Other changes resulting from the 2021 Budget Implementation Act, including the enactment of the Retail Payment Activities Act, are discussed further below.5
On November 30, 2020, the Federal Government of Canada released its Fall Economic Statement, which introduced certain proposed legislative amendments, including to the Proceeds of Crime Act, the Bank Act, the CDIC Act and the PCSA.6 For example, the legislative amendments include changes to: (i) clarify the Bank of Canada’s authority to oversee payment exchanges as clearing and settlement systems under the PCSA; and (ii) clarify how investors, creditors and other participants may be compensated as a result of actions taken by financial sector authorities to sell, wind down or restore a failing bank.
With respect to open banking, on January 31, 2020, the Canadian Government published an initial report completed by its Advisory Committee on Open Banking (OB Committee) recommending that the Government move forward to enable open banking in Canada and to develop an open banking framework in collaboration with industry.7 On August 4, 2021, the OB Committee published its final report on open banking, which included recommendations for the vision, scope, and governance of an open banking system in Canada. The OB Committee recommends that consumer-friendly outcomes form the basis of the open banking system in Canada and that financial inclusion and education play a key role. The OB Committee also recommends that the initial scope include data that is “traditionally readily available to consumers through their online banking applications”, with the possibility of expansion to other forms of consumer data in the future. However, the OB Committee acknowledges that financial institutions should be permitted to exclude any “derived data”, which includes data enhanced by a financial institution to provide additional value or insight to a consumer (e.g. internal credit risk assessment or new product offerings). Also, the initial scope should allow third-party service providers “read-only” access to consumer financial data, but not allow them to edit such data.
In addition, the OB Committee recommended a two-phased approach to governance. During the first stage, it was recommended that an open banking lead be appointed by the Government to develop, in consultation with stakeholders, the three tenets of an open banking system: (i) common rules; (ii) an accreditation framework; and (iii) technical specifications. The OB Committee recommended that this process take place over the course of nine months, following which third-party providers would be able to seek accreditation, and the system would be tested and refined, ultimately allowing for the operationalisation of an open banking system by January 2023. During the second stage, consumer use could begin, and the Government would appoint an organisation to manage administration of the system on an ongoing basis.8
The Budget Implementation Act, 2018, No. 2 (2018 Budget Implementation Act 2) set out a new financial consumer protection framework (Consumer Framework) to strengthen the Bank Act provisions related to customer protection, corporate governance, responsible business conduct, disclosure, transparency, whistleblowing, and redress. On August 17, 2021, the Department of Finance published the Financial Consumer Protection Framework Regulations, which are set to come into force on June 30, 2022. The regulations introduce new requirements to protect bank customers, including by raising the maximum amount of a Federal Government cheque that a bank must cash for free from $1,500 to $1,750, prescribing a 56-day period in which a bank must resolve complaints, and amending certain disclosure requirements, including in respect of unauthorised credit card transaction liability.9
On September 1, 2021, PC announced the launch of the first release of Lynx, Canada’s new high-value payments system, which replaces the existing Large Value Transfer System. PC also announced that the second phase, expected in late 2022, will introduce support for the ISO 20022 message standard.10 The transfer to Lynx is a critical part of PC’s ongoing plan to modernise the infrastructure, rules, and standards of Canada’s national payments systems, a plan that also includes the expected implementation of a new real-time payments system, the Real-Time Rail, in 2022.
On May 25, 2018, the Department of Finance published a consultation paper that proposed expanded access to PC’s systems for non-traditional payment service providers, with the goal of ensuring that the Canadian payments system continues to function efficiently and competitively, while maintaining high standards of safety and soundness. The proposed introduction of a new associate member class of PC membership that provides rights and obligations for non-traditional payment service providers (as set out in PC’s 2019–2023 Corporate Plan) is one way in which innovation and competition may be enhanced.
The 2019 Budget proposed a new retail payments oversight framework, promoting both innovation and safety by mandating operational risk management practices and protecting users’ funds against losses. Pursuant to this new Retail Payments Supervision Framework, the Bank of Canada will oversee payment service providers’ compliance and maintain a public registry of regulated payment service providers. The Retail Payment Activities Act, which formally establishes this new framework, was enacted on June 29, 2021; however, the majority of the act’s sections are not yet in force, and accompanying regulations have not yet been introduced or approved.11
Recent developments suggest that sustainable financing will be a priority for the banking industry going forward. In November 2020, the Bank of Canada and OSFI launched a pilot project using climate change scenarios to better understand the risks to the financial system related to a transition to a low-carbon economy. A report describing the specific scenarios, methodology, assumptions and key sensitivities is expected to be published by the end of 2021. As part of this work, on January 11, 2021, OSFI published a discussion paper and launched a three-month consultation focused on how FRFIs can prepare to effectively manage climate-related risks.12 On October 12, 2021, OSFI published a summary of responses to the consultation, noting that many FRFIs are in the early stages of assessing these risks.13 OSFI expects to communicate next steps on its climate-related policy work early in 2022, following the expected upcoming publication of the results of its pilot project with the Bank of Canada.
In July 2019, OSFI announced revisions to its capital requirements for operational risk applicable to Canadian deposit-taking institutions (DTIs).14 DTIs currently approved to use the Advanced Measurement Approach will be required to use a revised Basel III Standardized Approach starting in Q1 2022, subject to a phased-in transition period.
On June 9, 2018, the Department of Finance proposed a series of amendments to the regulations under the Proceeds of Crime Act that govern Canada’s anti-money laundering and anti-terrorist financing (AML/ATF) regime. The final amendments came into force in 2021, which update due diligence and beneficial ownership requirements, regulate businesses dealing in virtual currencies, include foreign money service businesses in Canada’s AML/ATF regime, clarify a number of existing requirements, and make minor technical changes.
In October 2020, to reduce redundancy, OSFI announced that FINTRAC will be the primary agency conducting AML/ATF assessments of FRFIs. On July 26, 2021, OSFI rescinded Guideline B-8 Deterring and Detecting Money Laundering and Terrorist Financing, as part of its work to eliminate duplication in the application of AML/ATF requirements for FRFIs. However, it noted that it would continue to coordinate and share relevant information with FINTRAC.15
Canadian banks are subject to the regulatory oversight of OSFI. In 2019, OSFI released its 2019–2022 Strategic Plan, which sets goals to improve FRFIs’ preparedness and resilience to financial and non-financial risks, improve OSFI’s agility and operational effectiveness, and preserve Canadians’ support and the financial industry’s cooperation. The theme of principle-based regulation and individual institution oversight, as well as the implementation of resolution regimes, is expected to continue in Canada. However, as is the case globally, the regulatory landscape in Canada was affected by the COVID-19 pandemic.
On March 13, 2020, OSFI announced that all of its consultations and policy developments on new or revised guidance would be suspended until the uncertainty caused by the COVID-19 pandemic dissipated; however, much of this work has since resumed. In addition, OSFI announced several regulatory measures to support the financial and operational resilience of FRFIs during the COVID-19 pandemic, including temporary adjustments to existing capital, liquidity and reporting requirements, many of which have since been phased out as OSFI determines that such adjustments are no longer necessary.16
Basel III reforms
OSFI has publicly affirmed its commitment to participating in the development of international financial standards, and has been proactive in the adoption and implementation of the Basel III framework of the Basel Committee. However, on March 27, 2020, the Basel Committee’s oversight body announced a delay in the international implementation of the Basel III reform package due to COVID-19. In line with this extension, OSFI announced that the implementation of the final Basel III reforms and revised Pillar 3 disclosure would be delayed to fiscal Q1 2023 at the earliest.
On March 11, 2021, OSFI launched consultations on proposed regulatory changes to its Capital Adequacy Requirements Guideline (CAR Guideline), Leverage Requirements Guideline (LR Guideline), Liquidity Adequacy Requirements Guideline (LAR Guideline), and Pillar 3 Disclosure Guideline, to introduce the final round of Basel III reforms in Canada.17 OSFI noted that its final guidance would be published in late 2021. As part of this process, it also launched consultations on corresponding changes to the Basel Capital Adequacy Reporting and Leverage Requirements Returns.18 Additionally, as part of its efforts to better tailor its guidelines to the unique attributes of small and medium-sized DTIs (SMSBs) (as discussed further below), on August 5, 2021, OSFI published a draft Pillar 3 Disclosure Guideline, which proposes the implementation of a proportional set of Pillar 3 disclosure requirements for SMSBs that would be effective as of November 1, 2022.19
Capital conservation buffer
To avoid breaches of minimum capital requirements, banks in Canada are required to hold a capital conservation buffer, the details of which are set out in OSFI’s CAR Guideline.20 The capital conservation buffer is equal to 2.5% of a bank’s risk-weighted assets. Currently, banks in Canada are advised to maintain the minimum Common Equity Tier 1 (CET1) capital ratio, Tier 1 capital ratio and total capital ratio plus the capital conservation buffer.
Domestic systemically important banks (D-SIBs) are required to hold a Domestic Stability Buffer (DSB) intended to cover a range of Pillar 2 systemic vulnerabilities not adequately addressed in the CAR Guideline. The level of the DSB is the same for all D-SIBs and is reviewed by OSFI on a semi-annual basis. Effective as of October 31, 2021, the DSB was increased from 1.00% to 2.50% of total risk-weighted assets (as calculated under the CAR Guideline).21
In addition to the CAR Guideline, Canadian banks must maintain a ratio of capital to exposure that meets or exceeds 3% at all times under OSFI’s LR Guideline.22
On April 9, 2020, OSFI announced that DTIs could temporarily exclude central bank reserves and sovereign-issued securities, which qualify as High-Quality Liquid Assets under the LAR Guideline, from the leverage ratio exposure measure. The purpose of this change was to facilitate DTIs’ ability to provide credit during the COVID-19 pandemic. On August 12, 2021, OSFI announced that the exclusion of sovereign-issued securities from the leverage ratio would not be extended beyond December 31, 2021; however, central bank reserves will continue to be excluded beyond the end of 2021.23
Common Equity Tier 1 surcharge
Consistent with the Basel Committee’s Basel III framework,24 and as described above, OSFI has designated six Canadian institutions as D-SIBs: the Bank of Montreal; the Bank of Nova Scotia; the Canadian Imperial Bank of Commerce; the National Bank of Canada; the Royal Bank of Canada (RBC); and the Toronto-Dominion Bank (TD). These D-SIBs account for approximately 90% of the total assets of Canada’s federally regulated DTIs and must comply with heightened regulatory requirements. The imposition of such requirements may offset the potential negative impact of any one D-SIB’s failure.
Pursuant to the CAR Guideline, D-SIBs are subject to a CET1 surcharge equivalent to 1% of the D-SIB’s risk-weighted assets. This CET1 surcharge is implemented through the extension of the capital conservation buffer. D-SIBs will be restricted in their ability to make distributions such as dividends in the event they do not satisfy their relevant capital conservation ratio.
RBC and TD are also global systemically important banks (G-SIBs) and as such, are required to meet additional requirements.
Total Loss Absorbing Capacity
In April 2018, OSFI published its Total Loss Absorbing Capacity (TLAC) Guideline (TLAC Guideline),25 the purpose of which is to ensure that a non-viable D-SIB has sufficient loss-absorbing capacity to support its recapitalisation. The minimum TLAC ratio is 21.5% of risk-weighted assets of D-SIBs, and the minimum TLAC leverage ratio is 6.75%.26 All D-SIBs are required to meet the requirements set out in the TLAC Guideline by November 1, 2021.
In May 2018, OSFI published its Total Loss Absorbing Capacity (TLAC) Disclosure Requirements Guideline and Capital Disclosure Requirements Guideline,27 which provide robust disclosure requirements and templates, promoting transparency and market discipline with respect to Canadian D-SIBs. TLAC disclosures were required by D-SIBs commencing on the quarterly reporting period ending January 31, 2019.
Stressed Value-at-Risk multipliers
Pursuant to the CAR Guideline, banks and other FRFIs are required to calculate their market risk capital requirement by including a Value-at-Risk estimate of their portfolio under both the current conditions (VaR) and under a stressed period (SVaR). The intent of the SVaR is to ensure that a minimum amount of capital is held against stress periods. However, in 2020, as the COVID-19 pandemic resulted in market volatility, VaR increased significantly to reach SVaR levels. As a result, OSFI announced a temporary adjustment to the SVaR such that banks and other FRFIs that are subject to market risk capital requirements and use internal models were permitted to reduce their previous SVaR multiplier (from the last fiscal quarter) by two (from a multiplier of at least three to a multiplier of at least one). On March 16, 2021, OSFI announced that effective May 1, 2021, the level of the SVaR multipliers would be returned to what they were prior to the temporary adjustment.28
Residential mortgage underwriting
On January 1, 2018, revisions to OSFI’s Guideline B-20 Residential Mortgage Underwriting Practices and Procedures became effective, which have strengthened mortgage underwriting across Canada.29 The revisions include recommending that FRFIs develop strong underwriting policies, perform due diligence to record and assess the borrower’s identity, background and demonstrated willingness to service their debt obligations on a timely basis, and develop effective credit and counterparty risk management practices and procedures that support residential mortgage underwriting and loan asset portfolio management.
In February 2020, OSFI announced the adoption of a new rate for the calculation of the minimum qualifying rate for uninsured mortgages (residential mortgages with a down payment of 20% or more), which was originally set to become effective in April 2020 but was postponed due to COVID-19. However, on May 20, 2021, OSFI announced that effective June 1, 2021, the new minimum qualifying rate for uninsured mortgages will be the greater of the mortgage contract rate + 2%, or 5.25%. Additionally, OSFI announced that it would review and communicate the new minimum qualifying rate at least annually, in each December.30
In addition to the Pillar 3 Disclosure Guideline for SMSBs (discussed above), on March 11, 2021, OSFI published the SMSB Capital and Liquidity Requirements Guideline (SMSB Guideline). The purpose of the SMSB Guideline is to act as a reference tool to clarify which parts of the CAR Guideline, LR Guideline, and LAR Guideline apply to SMSBs. Additionally, the SMSB Guideline reflects certain changes to the capital and liquidity requirements for SMSBs, as set out in the proposed changes to the CAR Guideline, LR Guideline, and LAR Guideline that introduce the final round of Basel III reforms. The SMSB Guideline will become effective in November 2022 for SMSBs with a fiscal year-end of October 31, and in January 2023 for SMSBs with a fiscal year-end of December 31.31
The legislative requirements for the governance of banks are found in the Bank Act, which prescribes the form and degree of governance required. Canadian banks must have a minimum of seven directors: if the bank is a subsidiary of a foreign bank, at least half of its directors must be resident Canadians; and if the bank is a domestic bank, a majority of its directors must be resident Canadians. Banks are prohibited from having more than two-thirds of their directors qualifying as “affiliated” with the bank, which includes but is not limited to the following relationship with the bank: ownership of a significant interest in a class of shares; being a significant borrower; or acting as an officer.
Directors are legally obligated to discharge their duties honestly and in good faith with a view to the best interests of the bank, and are required to exercise the care, diligence and skill that a reasonably prudent person would exercise in comparable circumstances. Directors must also establish an audit committee, a conduct review committee, a committee to monitor compliance with public disclosure requirements, and a committee to monitor the resolution of conflicts of interest. The Chief Executive Officer (CEO) of a Canadian bank must be a director of the bank as well as a resident of Canada. A significant feature of the Bank Act is the power of the shareholders to remove a bank’s directors. A bank’s board of directors (Board) is responsible for ensuring that the compensation of employees, senior management (Management) and the Board is aligned with the bank’s long-term interests. Compensation for all employees is to be consistent with the FSB’s Principles for Sound Compensation Guideline and related Implementation Standards.43
Corporate governance – the role of the Board and Management
Although the legislative regime of the Bank Act is fulsome, OSFI publishes guidance documents that detail the practical mechanisms of compliance in the Canadian banking industry. OSFI’s Corporate Governance Guideline (Governance Guideline)44 communicates OSFI’s expectations with respect to corporate governance and complements the Bank Act and OSFI’s Supervisory Framework and Assessment Criteria.45 The Governance Guideline does not apply to the branch operations of foreign banks. It highlights the distinction between the decision-making role of a bank’s Board and the decision-implementing role of Management and highlights that the Board should be independent of Management. Apart from the critical separation of the roles of Board Chair and CEO, the Governance Guideline does not prescribe any single Board structure as guaranteeing independence. However, the Governance Guideline suggests that to ensure its effectiveness, a Board should be “diverse and, collectively, bring a balance of expertise, skills, experience, competencies and perspectives, taking into consideration the FRFI’s strategy, risk profile, culture and overall operations”.46 Board members should also have expertise in the relevant financial industry and in risk management.
The Board plays a crucial role in the success of a DTI through its approval of overall strategy and risk appetite, as well as oversight of Management and internal controls. Management is responsible for guidance related to significant operational, business, risk and crisis-management policies, compensation policies, business and financial performance relative to the strategy and Risk Appetite Framework (RAF) approved by the Board, implementation and effectiveness of internal controls, implementing the Board’s decisions and directing the operations of the DTI.
Both Board and Management have significant duties beyond those expressly found in the Bank Act. The structure of the bank itself may impose further duties on a Board. For example, a parent company’s Board should implement sufficient oversight of a subsidiary’s activities to ensure that the parent Board is able to discharge all of its responsibilities to the parent company. The interaction between Management and the Board should occur primarily through the CEO. The Board should supervise the oversight functions of the bank through the engagement of the relevant committees, such as the Audit Committee. The heads of the oversight functions should have sufficient authority and autonomy from Management and should have unfettered and direct access to the Board or the relevant Board committee for reporting purposes.
One focal element of the Governance Guideline is the concept of risk governance, which OSFI characterises as a distinct and crucial element of corporate governance in Canada. Banks should be in a position to identify the important risks they face, assess their potential impact, and have policies and controls in place to effectively manage them.
Measures endorsed in the Governance Guideline include the creation of a Board Risk Committee and the appointment of a Chief Risk Officer (CRO). The CRO should have the necessary stature and authority within the bank and be independent from operational management. The CRO should not be directly involved in revenue-generation, and their compensation should not be linked to the bank’s performance of specific business lines. The CRO should have unfettered access to, and a direct reporting line to, the Board or Risk Committee.
OSFI’s Enterprise-Wide Model Risk Management for Deposit-Taking Institutions Guideline47 ensures that all DTIs have a baseline understanding of the minimum level of expectations with respect to their use of models that could have a material impact on their risk profile. Internal Models Approved Institutions are subject to all components of the Guideline, whereas Standardised Institutions are only required to comply with the minimum expectations (but should strive to comply with the entire Guideline).
OSFI’s Large Exposure Limits for Domestic Systemically Important Banks Guideline48 sets out a framework to limit the potential loss that would be suffered by a D-SIB as a result of a sudden failure of an individual counterparty or group of connected counterparties. The Guideline includes reporting requirements for D-SIBs and requires them to create and implement procedures for identifying, correcting, and notifying OSFI of breaches of large exposure limits. In the Guideline, OSFI makes clear that D-SIBs should have a large exposure policy that is consistent with its RAF.
The role of the Audit Committee
The Governance Guideline also expands upon the relevant duties of the Audit Committee as mandated by the Bank Act. The Audit Committee, not Management, should recommend to the shareholders the appointment and removal of the external auditor for the bank. The Audit Committee should agree to the scope and terms of the audit engagement, review and recommend for approval by the Board the engagement letter and remuneration for the external auditor, and discuss with Management and the external auditor the overall results of the audit, the financial statements, and any related concerns raised by the external auditor.
The Audit Committee should satisfy itself that the financial statements fairly represent the financial positions, the results of operations, and the cash flow of the DTI. In order to do so, the Audit Committee should meet with the external auditor, the internal auditor, and other heads of the oversight function, as appropriate, with and without Management.
Consumer Protection Committee
The Bank Act requires that the directors of a bank establish a committee to monitor compliance with public disclosure requirements and complaint procedures (Consumer Protection Committee). As a result of the 2018 Budget Implementation Act 2, the Bank Act will be amended on June 30, 202249 to further detail the scope of the Consumer Protection Committee’s duties, as well as provide more prescriptive requirements for the composition of such committee. For example, it will need to be composed of a minimum of three directors, a majority of which must not be affiliated with the bank. None of the members of the Consumer Protection Committee may be officers or employees of the bank or of a subsidiary of the bank. The Consumer Protection Committee must require a bank’s Management to establish procedures for complying with consumer protection provisions and to give annual reports on the implementation of consumer protection activities. The directors of a bank will be required to report annually as to the activities of the Consumer Protection Committee during the previous financial year.
The 2018 Budget Implementation Act 2 also introduced a new whistleblower regime to the Bank Act, which is set to come into force on June 30, 2022.50 The changes will allow whistleblowers to report any occurrences or intended occurrences of “wrongdoing” to the bank, the Superintendent of Financial Institutions, the Commissioner of the FCAC, a law enforcement agency, or any other bank regulator. The entity or entities being reported to would be bound to maintain the confidentiality of the whistleblower, subject to certain exceptions. Banks will need to establish and implement procedures for dealing with reports of wrongdoing and will be prohibited from punishing a whistleblower.
Outsourcing of banking functions
Technology, specialisation, cost, and competition continually and dynamically shape the market for Canadian banks both domestically and abroad. Banks may consider outsourcing certain activities in response to such shifts in the market. OSFI’s guideline on Outsourcing of Business Activities, Functions and Processes (Outsourcing Guideline) highlights that although regulatory flexibility is afforded in order to ensure the commercial viability of Canadian banks, banks remain responsible for all outsourced activities. In light of this responsibility, a bank’s Management should periodically review and approve outsourcing policies and relationships. Operational management should communicate with the Board regarding material outsourcing risks, develop outsourcing policies for Management’s approval, implement such outsourcing policies upon approval, and periodically review their effectiveness.
It is expected that banks will assess the materiality of their outsourcing arrangements and develop and maintain a Risk Management Program for all material outsourcing arrangements, which should include a centralised list of all outsourcing arrangements identified as material using the template annexed to the Outsourcing Guideline. When out-of-Canada outsourcing is being contemplated, the FRFI should pay particular attention to the legal requirements of that jurisdiction, as well as the potential foreign political, economic and social conditions, and events that may reduce the foreign service provider’s ability to provide the service, as well as any additional risk factors that may require adjustment to the Risk Management Program.
Part X of the Bank Act requires Canadian banks to maintain adequate capital and adequate and appropriate forms of liquidity. Bank capital under the Basel regime consists of “Tier 1” capital – in turn consisting of CET1 capital and Additional Tier 1 capital – and “Tier 2” capital. In response to COVID-19, on March 27, 2020, OSFI introduced an adjustment to capital for Expected Credit Loss provisioning, which is permitted under the Basel framework. This adjustment permits a portion of allowances that would otherwise be included in Tier 2 capital to instead be included in CET1 capital. This adjustment remains in effect as of October 2021.
OSFI is authorised under the Bank Act to establish guidelines respecting both the maintenance of adequate capital and adequate and appropriate forms of liquidity. The CAR Guideline supplements the Bank Act and implements the related Basel III capital rules without significant deviation, other than a more accelerated timeline than is required under Basel III.
In accordance with the LR Guideline, OSFI has the power to prescribe leverage ratio requirements for specific institutions on the basis of a number of factors, including the institution’s risk-based capital ratios compared to internal targets and OSFI targets, the adequacy of capital and liquidity management processes and procedures, and the institution’s risk profile and business lines. The authorised leverage ratio for individual institutions is not publicly disclosed.
A bail-in regime for D-SIBs has been in effect since September 2018 (mostly pursuant to the CDIC Act and its regulations) allowing the Government of Canada to convert certain debt of a failing D-SIB into common shares to recapitalise the bank. Only prescribed long-term debt is subject to the bail-in power, and deposits are excluded. The legislative regime defines the conditions for the conversion of instruments eligible for bail-in, outlines the terms that must be adhered to upon issuance of an eligible bail-in instrument, and establishes a framework to determine compensation for those entitled under the regulations.
The purpose of the TLAC Guideline (discussed above) is to provide a non-viable D-SIB with sufficient loss-absorbing capacity to support recapitalisation in the event of failure. This would facilitate an orderly resolution of the D-SIB while minimising adverse impacts on the stability of the financial sector and taxpayers’ exposure to loss.
The TLAC Guideline, together with CAR requirements and the LR Guideline (each as discussed above), help to form the framework for the assessment of whether a D-SIB maintains its minimum capacity to absorb losses, in accordance with the Bank Act.
As part of compliance and monitoring requirements, DTIs (other than foreign bank branches) provide OSFI with quarterly Basel Capital Adequacy Reporting.51 If reporting indicates deteriorating capital, the DTI may be subject to escalating stages of intervention, starting with additional reporting requirements and continuing to specific temporary restrictions on business lines. OSFI’s Net Stable Funding Ratio Disclosure Requirements Guideline requires quarterly disclosure about key quantitative information relating to the Net Stable Funding Ratio of D-SIBs.
Additionally, OSFI has the authority to direct an FRFI to increase its capital if it determines that such FRFI is undercapitalised or, in severe cases, to take control of the assets of the FRFI or of the FRFI itself.
In July 2019, OSFI announced plans to modify the current capital and liquidity requirements for SMSBs.52 This initiative aims to achieve greater proportionality for SMSBs by striking a balance between improving the risk sensitivity of the requirements for SMSBs and reducing the complexity of the capital and liquidity frameworks to reflect the nature, size and business activities of these smaller DTIs. While OSFI has delayed implementation of the SMSB framework to January 1, 2023 due to COVID-19, the SMSB Draft Guidelines were recently published (as further discussed above).
The Bank Act and specific regulations thereunder have detailed provisions relating to consumer protection. Among other things, the Bank Act and related regulations contain requirements for the simplified disclosure to customers of the cost of borrowing and interest rates.
The FCAC has the mandate of administering consumer protection provisions of the Bank Act. Pursuant to the Financial Consumer Agency of Canada Act,53 the FCAC’s mandate includes: supervision of FRFIs to ensure that they comply with federal consumer protection measures; promotion of the adoption of policies and procedures with respect to voluntary codes of conduct and FRFIs’ public commitments designed to implement consumer protection measures; and supervision of payment card network operators and promotion of consumer financial awareness. The FCAC also promotes public awareness about the consumer protection obligations of FRFIs and payment card network operators. The FCAC has the power to, for example, impose monetary penalties and criminal sanctions. For minor oversights, the FCAC will work with the FRFI to rectify the issue. The FCAC’s Supervision Framework describes the principles and processes applied by the FCAC to supervise FRFIs and ensure that financial consumers and merchants continue to benefit from applicable protections. In addition, the Consumer Framework has expanded the FCAC’s mandate to, for example, enhance the scope of the FCAC’s authority to impose increased monetary penalties on banks and to require quarterly complaints reporting.
The CBA’s voluntary Code of Conduct for the Delivery of Banking Services to Seniors (Code) reinforces existing initiatives and resources used by banks and their staff to respond to the unique, evolving needs of senior customers.54 The FCAC monitors compliance with the Code, which requires banks to, for instance, mitigate potential financial harm to seniors and account for market demographics and the needs of seniors when proceeding with branch closures. Banks began implementing requirements under the Code on January 1, 2021.
CDIC is a statutory corporation funded through premiums charged to member institutions that provides deposit insurance on certain types of small deposits. CDIC insures up to $100,000 per customer, per financial institution, per insured category of deposits for certain eligible Canadian dollar-denominated deposits (including savings accounts, chequing accounts, and term deposits with an original term to maturity of five years or less). On April 30, 2022, the CDIC deposit protection regime will be updated to, among other things, (i) add separate coverage for up to $100,000 in eligible deposits held in a Registered Education Savings Plan and a Registered Disability Savings Plan, (ii) remove separate coverage for deposits in mortgage tax accounts, and (iii) add new requirements for deposits held in trust that enhance CDIC’s ability to extend protection to these deposits and reimburse quickly after a CDIC member failure.55
With respect to customer information and privacy, Canadian banks must comply with the Personal Information Protection and Electronics Documents Act (PIPEDA). In addition, all banks in Canada have a common law duty of confidentiality in their dealings with customers and in customer identification. PIPEDA provides a regulatory regime in respect of the collection, use and sharing of personal information in the context of commercial activities, and requires that institutions obtain an individual’s consent prior to using such personal information. Canadian banks have a positive duty to safeguard personal information that has been collected, and to abide by the limits on the retention of personal information, as set out in PIPEDA.
On August 13, 2021, OSFI released an updated Cyber Security Self-Assessment to assist FRFIs in improving their readiness for emerging and expanding cyber threats.56 At the same time, OSFI also released updated guidance on how FRFIs should report and disclose technology and cyber incidents to OSFI in the Technology and Cyber Security Incident Advisory (Technology Advisory). Under the Technology Advisory, FRFIs must report a technology or cyber security incident to OSFI’s Technology Risk Division and its lead supervisor within 24 hours. The Technology Advisory also indicates that where an FRFI fails to report a cyber incident, it could be subject to increased oversight by OSFI, put on a watch list, or assigned to one of the stages of OSFI’s supervisory intervention approach.57
Banks are also required to comply with Canada’s Anti-spam Legislation (CASL), which regulates unsolicited commercial electronic communications sent by commercial enterprises to individuals. CASL applies to all electronic messages and requires the prior consent (express or implied) of the recipient before any such message can be sent, and includes mechanisms for civil recourse as well as monetary penalties and criminal charges for non-compliance.