Banks: consent, limits and fraud reporting

Summary#

These are proposed Regulations Amending the Financial Consumer Protection Framework Regulations that would put into rules new anti-fraud measures announced in the Budget Implementation Act, 2025, No. 1. If adopted, they would make banks get customers’ clear consent before turning on high‑value electronic transfer features, let customers turn those features off, set rules for transaction‑limit changes, and require banks to report fraud data to the Financial Consumer Agency of Canada (FCAC). The proposal is not law yet and the rules are planned to come into force on July 1, 2027.

What it does#

• Require banks to get a customer’s express consent before enabling any capability that lets money be moved by electronic transfer (examples in the proposal include wire transfers, global money transfers and Interac e‑Transfers).
  • Exemptions include transfers between a person’s own accounts at the same bank, ATM withdrawals, card payments, pre‑authorized debits and direct bill payments.
• Let customers disable those electronic‑transfer capabilities and require banks to tell new account holders that these options exist.
• Set how quickly a bank must increase a transaction or withdrawal limit when a customer asks: immediately if the bank has verified the customer’s identity, or by the next business day if it has not.
• Require banks to have written policies and procedures for spotting and investigating suspicious transactions and to review those policies at least once a year.
• Require banks to collect and report detailed fraud data to the FCAC every year. Required data points include: date bank learned about the event; whether it was attempted or completed; fraud type and tactic; communication method; transaction method; amounts lost and refunded; whether the transaction was unauthorized or authorized because of coercion/deception; and basic demographics (age range, gender, first three characters of postal code).
• Require the FCAC to compile a confidential annual summary of the bank reports and send it to the Minister of Finance by September 30 each year.
• Include a transitional rule that the first bank report will be due by May 15, 2029, covering the period January 1, 2028 to December 31, 2028.

Who's affected#

• Bank customers who hold personal deposit accounts. People who rarely use electronic transfers would be the most likely to change settings or benefit.
• Banks and authorized foreign banks. The government estimates about 79 institutions would be covered.
• Financial Consumer Agency of Canada (FCAC), which would receive the reports and supervise compliance.
• Department of Finance, which will use the compiled data for policy work (including the planned National Anti‑Fraud Strategy).
• The proposal says small businesses are not expected to be affected, though it notes that small businesses that use personal deposit accounts could experience small frictions.

Why it matters#

• Real-world effect: it aims to make it harder for fraudsters to quickly move large sums out of a compromised personal account by defaulting those transfer features off unless a customer opts in. That could reduce certain kinds of theft.
• Data: banks would have to report detailed fraud information directly to the FCAC, giving policymakers better, more consistent data than the current voluntary and underreported sources.
• Trade‑offs: the government’s analysis estimates monetized benefits over 10 years of $2.9 billion, costs of $611 million, and a net benefit of about $2.3 billion. Those are estimates with uncertain assumptions about how much fraud goes unreported.
• Daily life impact: some customers may face new friction (extra steps or short waiting periods) when enabling transfers or increasing limits, which could be inconvenient for time‑sensitive legitimate transactions. Banks will also face implementation and reporting costs, and the FCAC will need more resources to oversee the rules.
• Status: this is a proposed regulation (published in Part I) and not yet final. Comments were invited (the notice sets a comment period after publication). If finalized, the planned coming‑into‑force date is July 1, 2027.