Banks must get consent for transfers

Summary#

This is a proposed rule called the Regulations Amending the Financial Consumer Protection Framework Regulations, published in the Canada Gazette on June 27, 2026. It would require banks to get customers’ express consent before turning on certain electronic transfer features, let customers turn those features off, and force banks to report fraud data to the Financial Consumer Agency of Canada (FCAC). The proposal is open for comments for 30 days.

What it does#

• Requires banks to get a customer’s express consent before enabling electronic funds‑transfer capabilities on a personal deposit account (examples named in the proposal include Interac e‑Transfers, wire transfers and global money transfers).
• Lets customers disable those same transfer capabilities and requires banks to tell new account holders that they can do this.
• Says banks must apply an identity check if a customer asks to raise a transaction limit; if the bank verifies the identity the increase must take effect without delay, otherwise it must wait until the next business day.
• Requires banks to have written policies and procedures for investigating suspicious transactions and for deciding when to notify customers about suspicious requests. Those policies must be reviewed at least once a year.
• Forces banks to collect specific fraud data for every fraud instance (attempted or confirmed) and to report that information annually to FCAC in a form the Commissioner accepts. Reported details include dates, fraud type, communication method, transaction method, amounts lost and reimbursed, and basic victim demographics.
• Requires FCAC to compile the banks’ reports into a confidential annual report to the Minister of Finance by September 30 of the year after the data year.
• The proposal says the rules would come into force on July 1, 2027, and that the first bank-level fraud report would cover January 1 to December 31, 2028 and be submitted by May 15, 2029.

Who's affected#

• Banks and authorized foreign banks (the proposal estimates 79 institutions would be covered).
• Account holders of personal deposit accounts — anyone who uses or might use bank transfer features (these customers would get more control but may face small delays or extra steps).
• Financial Consumer Agency of Canada (FCAC), which would collect and analyze the new data and supervise compliance.
• Department of Finance, which would receive the compiled fraud report and use the data for policy work.
• The proposal says small businesses that use personal accounts are generally not expected to be affected; if that’s not the case for some small businesses, impacts are expected to be small.

Why it matters#

• Fraud is rising: public reporting to the Canadian Anti‑Fraud Centre (CAFC) showed $704 million in reported losses in 2025, and CAFC estimates reported cases represent only 5 to 10% of actual fraud. That under‑reporting makes it hard for policy-makers to see the full picture.
• Giving customers the ability to disable high‑value transfer features and requiring express consent aims to make it harder for fraudsters to move stolen money quickly from compromised accounts.
• The new reporting rules would create a consistent, bank‑level dataset for fraud. That should help the government and regulators understand how fraud happens and design better protections.
• The Regulatory Impact Analysis estimates a net benefit over 10 years of about $2.3 billion (benefits $2.9 billion minus costs $611 million). Those are estimates based on many assumptions; the government’s analysis includes sensitivity testing.
• There will be trade‑offs: banks and regulators will face implementation and ongoing costs, and some legitimate customer transactions could see small delays or extra steps (for example, identity checks to raise limits).