PROCESSING...

Anti-Money Laundering
Consulting Services & Strategies

0 Items - Total: $0.00 CAD

Real Estate Sector – Identifying Individuals

We often hear friends and clients in the real estate sector say they are frustrated that there are not many ways to identify a customer other than meeting them face-to-face. Real estate developers, brokers and sales representatives have an obligation to ascertain a customer’s identity which requires them to refer to specific information and/or documentation to verify a customer’s identity.  However, this does not mean that identification must take place face-to-face. Below is a summary of all the different methods outlined in FINTRAC Guidance that are currently available to identify customers that are individuals and what’s coming.[1]

This article should not be considered advice (legal or otherwise). Throughout this article we refer to a purchaser of real estate as a customer, but you may refer to them as clients depending on your internal procedures. Also, your internal procedures may dictate what methods are acceptable in identifying a customer. If you are unsure, consult with your Compliance Officer where there is any doubt on what is acceptable within your organization.

Face-to-Face Identification for Individuals

When meeting customers face-to-face you may ask for a piece of identification that is:

  • Issued by a provincial, territorial or federal government in Canada or an equivalent foreign government (a foreign Passport would be acceptable for example);
  • Valid, not expired (if there is not expiry date this must be stated in the customer identification record);
  • Bears a unique identifier number (such as a driver’s license number);
  • Bears the name of the individual being identified;
  • Is an original (not a copy, photo, scan, video call, etc.); and
  • Bears a photo of the individual being identified.

Information that must also be collected and recorded includes things such as the customer’s full name (no initials, short forms or abbreviations), their occupation, date of birth, etc. The needed information is included in various fields on industry customer identification forms that are used so it is crucial they are complete and accurate.

Single Process Method

Under the single process method, a customer’s identify can be confirmed by completing  a credit header match on their Canadian credit file, provided it has been in existence for at least three years and has at least two trade lines.  This means there is not a ‘hard hit’, impacting the customer’s credit score. This must be completed at the time of confirming a customer’s identity and cannot take place earlier or later.  To be acceptable, the credit file details must match the exact name, date of birth and address provided by the customer. When using this method to confirm a customer’s identity a record of the following information must be retained:

  • The customer’s name;
  • The name of the Canadian credit bureau holding the credit file;
  • The reference number of the credit file; and
  • The date the credit file was consulted.

Dual Process Method

Where the single process method provides information that does not match what the customer has provided and/or the credit file does not meet the requisite requirements, the dual process method can be used to identify that customer.  This involves referring to information from reliable and independent sources and must be original, valid and the most recent.  In order to qualify as reliable, the sources should be well-known and reputable. Reliable and independent sources can be the federal, provincial, territorial and municipal levels of government, crown corporations, financial entities or utility providers. It is important to note that independent means neither of the sources can be the same, nor can they be you or your business.

Documentation being used must be in its original form.  This makes electronic documents the preference because the customer can send the originals via email, while retaining a copy for themselves. You cannot accept documents that have been photocopied, scanned or faxed.

Under the dual process method, you can refer to any two of the following options:

  • Documents or information from a reliable source that contain the customer’s name and date of birth;
  • Documents or information from a reliable source that contain the customer’s name and address; or
  • Documents or information that contain the customer’s name and confirms that they have a deposit, credit card or other loan account with a financial entity.

The table below provides some examples of the sources and documents that can be referred to when confirming a customer’s identification.  In order to meet the standards of the dual process method, two documents must be obtained but each document cannot be in the same column.

 

Documents or information to verify name and address

 

 

Column A

 Documents or information to verify name and date of birth

 

 

Column B

 Documents or information to verify name and confirm a financial account

 

Column C

 
Issued by a Canadian government body:

Any card or statement issued by a Canadian government body (federal, provincial, territorial or municipal):

·      Canada Pension Plan (CPP) statement;

·      Property tax assessment issued by a municipality; or

·      Provincially-issued vehicle registration.

·      Federal, provincial, territorial, and municipal levels.

CRA documents:

·      Notice of assessment;

·      Requirement to pay notice;

·      Installment reminder / receipt;

·      GST refund letter; or

·      Benefits statement.

 Issued by a Canadian government body:

Any card or statement issued by a Canadian government body (federal, provincial, territorial or municipal):

·      Canada Pension Plan (CPP) statement of contributions;

 

 

Issued by other Canadian sources:

·      Referring to a customer/customer’s Canadian credit file that has been in existence for at least 6 months; or

Insurance documents (home, auto, life);

 Confirm that your customer/customer has a deposit account, credit card or loan account by means of:

·      Credit card statement;

·      Bank statement;

·      Loan account statement (for example: mortgage);

·      Cheque that has been processed by a financial institution;

·      Telephone call, email or letter from the financial entity holding the deposit account, credit card or loan account; or

·      Identification product from a Canadian credit bureau (containing two trade lines in existence for at least 6 months);
Issued by other Canadian sources:

·      Referring to the customer/customer ‘s Canadian credit file that has been in existence for at least 6 months;

·      Utility bill (for example, electricity, water, telecommunications);

·      T4 statement;

·      Record of Employment;

·      Investment account statements (for example, RRSP, GIC); or

·      Identification product from a Canadian credit bureau (containing two trade lines in existence for at least 6 months).

 

Where the dual process method is used to confirm the identity of a customer, a record of certain information must be maintained. Specifically:

  • The customer’s name;
  • The name of the two different sources that were used to identify the customer;
  • The type of information (for example, utility statement, bank statement, etc.) that was referred to;
  • The account number associated with the information for each source (if there is account number, you must record a reference number); and
  • The date the information was verified.

Third Parties (Agent or Mandatary)

If you are unable to use any of the methods above (say in the case of a foreign buyer that you cannot meet with face-to-face), you can ask someone in their area to identify them on your behalf.  There must be a written agreement or arrangement in place before using this method and procedures must be in place on how the third party will identify a buyer.

 

What’s To Come?

On June 9th, 2018, draft amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its enacted regulations (there are five separate regulations that we’re going to collectively call regulations here for simplicity’s sake) were published. The draft amendments include some positive changes in respect to requirements related to identity verification.

With regards to the identification document used to identify a customer, the draft amendments replace the word “original” with “authentic” and state that a document used for verification of identity must be “authentic, valid and current.” This may[2] allow for scanned copies of documentation and/or for software that can authenticate identification documents to be used for the dual process method.

Under the draft amendments, regarding the single process method, information in a credit report must be derived from more than one source (this means there must be more than one trade line).

Under the draft amendments, real estate developers, brokers and sales representatives would be allowed to rely on identity verification undertaken by other regulated entities. This method requires a written agreement and a requirement to deliver the identity documentation within three days.

 

We’re Here To Help

If you have questions regarding the identification requirements in place currently or the requirements that are in draft form please contact us.

 

[1] Note that methods used to identify customers that are organizations are different from the ones discussed in this article.

[2] There is no certainty in this regard until a final version is published and FINTRAC has provided their guidance on the matter.

AML Changes For The Real Estate Sector

Here We Go Again! Canada’s Proposed AML Changes for Real Estate Developers, Brokers and Sales Representatives

 

On June 9th, 2018, draft amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its enacted regulations (there are five separate regulations that we’re going to collectively call regulations here for simplicity’s sake). This article is intended to give a high-level summary of the proposed amendments as they relate to the real estate industry.

This article should not be considered advice (legal, tax or otherwise). That said, any of the content shared here may be used and shared freely – you don’t need our permission. While we’d love for content that we’ve written to be attributed to us, we believe that it’s more important to get reliable information into the hands of community members (meaning that if you punk content that we wrote, we may think you’re a jerk but we’re not sending an army of lawyers).

Finally, we want to encourage the community to discuss the proposed changes and submit meaningful feedback for policy makers. The comment period for this draft is 90 days. After this, the Department of Finance takes the feedback to the bat cave and drafts a final version of the amendments. From the time that the final version is published, the draft indicates that there will be 12 months of transition to comply with the new requirements.

What does this mean for my business?

While there are quite a number of proposed changes (the draft is about 200 pages in length), some are likely to have more of an impact on for real estate developers, brokers and sales representatives than others. We’ve summarized the changes that we expect to have the most impact below. Remember these are just proposed changes so there is no need to update your compliance material just yet.

What’s New?

Virtual Currency:

While there are not many proposed amendments that will introduce new requirements for real estate developers, brokers and sales representatives the draft regulations introduce reporting requirements for the receipt of CAD 10,000 or more of virtual currency. These basically are the same as large cash reporting obligations and will require reporting entities to maintain a large virtual currency transaction record.

The requirements for reporting and recordkeeping for virtual currency will be very similar to cash reporting requirements.

What existing requirements are changing?

24-hour rule:

The draft regulations clarify that multiple transactions performed by or on behalf of the same customer or entity within a 24-hour period are considered a single transaction for reporting purposes when they total CAD 10,000 or more. Only one report would need to be submitted to capture all transactions that aggregate to CAD 10,000 or more. For real estate developers, brokers and sales representatives this would apply to recipient of cash deposits. Specifically, this will apply to large cash transactions or CAD 10,000 or more. 

Identification:

The draft regulations replace the word “original” with “authentic” and states that a document used for verification of identity must be “authentic, valid and current. This would allow for scanned copies of documentation and/or for software that can authenticate identification documents to be used for the dual process method for real estate developers, brokers and sales representatives that identify clients in a non-face-to-face manner. Another change, related to measures for verifying identity, is that the word “verify” has been replaced with “confirm” and “ascertain” has been replaced with confirm. What this will mean exactly is still unclear (FINTRAC will need to provide more guidance once the final amendments are released). We are hopeful that it will allow for easier customer identification – especially for customers outside of Canada.

Records:

There have been some changes to the details that must be recorded in records that real estate broker or sales representative must maintain. In particular, the draft regulations add the requirement that information records must contain details of every person or entity for which they act as an agent or mandatary in respect of the purchase or sale of real property. Under the existing regulations information related to the person or entity purchasing real estate only.

Risk Assessment:

Under current regulations, reporting entities are required to assess the risks associated with its business and develop a risk assessment specific to your situation. For real estate developers, brokers and sales representatives a risk assessment must address the following four areas:

  • Products, services, and delivery channels (to better reflect the reality of the real estate sector, this workbook will now only refer to services and delivery channels);
  • Geography;
  • Clients and business relationships; and
  • Other relevant factors

A proposed amendment would require all reporting entities to assess the risk related the use of new technologies, before they are implemented.  This has been a best practice since the requirement to conduct a risk assessment came into force, but this change would make this a formal requirement.

Suspicious Transaction Reporting:

Under current regulations if a reporting entity has reasonable grounds to suspect that a transaction or attempted transaction is related to money laundering or terrorist financing, a report must be submitted to FINTRAC within 30 days of the date that a fact was discovered that caused the suspicion. The revised regulations add to this requirement by stating:

“The person or entity shall send the report to the Centre within three days after the day on which measures taken by them enable them to establish that there are reasonable grounds to suspect that the transaction or attempted transaction is related to the commission of a money laundering offence or a terrorist activity financing offence.

This would require reports to be submitted to FINTRAC within three days after the reporting entity conducts an analysis that established reasonable grounds for suspicion.

Schedules:

The draft regulations introduce changes to reporting schedules, requiring more detailed information to be filed with FINTRAC then previously was required. This is in addition to including information that is marked as optional, if a reporting entity has the information. As it relates real estate developers, brokers and sales representatives these changes will impact attempted suspicious and suspicious transaction reporting, terrorist property reporting and large cash reporting. Some of the additional proposed data fields are:

  • every reference number that is connected to the transaction,
  • every other known detail that identifies the receipt (of cash for large cash transactions),
  • type of device used by person who makes request online,
  • number that identifies device,
  • internet protocol address (IP address) used by device,
  • person’s user name, and
  • date and time of person’s online session in which request is made.

Such changes may be onerous for reporting entities, especially for transactions that are conducted online.

Training:

Under current regulation, if real estate developers, brokers and sales representatives use agents, mandataries or other persons to act on their behalf, they must develop and maintain a written, ongoing compliance training program for those agents, mandataries or other persons. The draft regulations introduces an additional requirement in which there must be a documented plan for the ongoing compliance training program and delivering of that the training.

What’s Next?

If you’ve read this far, congratulations and thank you!

We hope that you will contribute your thoughts and comments. You can do this by contacting the Department of Finance directly. Their representative on this file is:

Lynn Hemmings
Acting Director General
Financial Systems Division
Financial Sector Policy Branch
Department of Finance
90 Elgin Street
Ottawa, Ontario
K1A 0G5
Email: fin.fc-cf.fin@canada.ca

If you would like assistance drafting a submission, or have questions that you would like Outlier to answer, please get in touch!

Canada’s Proposed AML Changes for MSBs

What’s Old is New Again, Well Updated

On June 9th, 2018, draft amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its enacted regulations (there are five separate regulations that we’re going to collectively call regulations here for simplicity’s sake). This article is intended to give a high-level summary of the proposed amendments as they relate to Money Services Businesses (MSBs).

This article should not be considered advice (legal, tax or otherwise). That said, any of the content shared here may be used and shared freely – you don’t need our permission. While we’d love for content that we’ve written to be attributed to us, we believe that it’s more important to get reliable information into the hands of community members (meaning that if you punk content that we wrote, we may think you’re a jerk but we’re not sending an army of lawyers).

Finally, we want to encourage the community to discuss the proposed changes and submit meaningful feedback for policy makers. The comment period for this draft is 90 days. After this, the Department of Finance takes the feedback to the bat cave and drafts a final version of the amendments. From the time that the final version is published, the draft indicates that there will be 12 months of transition to comply with the new requirements.

♬The Times Regulations Are Changing♬

Foreign MSBs

Currently, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) has issued a policy interpretation (PI-5594) in August of 2013, which states that a “real and substantial connection” to Canada must be present for an entity to be required to register as an MSB with FINTRAC.  A “real and substantial connection” was defined in the interpretation as having one or more of the following:

  • Whether the business is incorporated in Canada;
  • Whether the business has agents in Canada;
  • Whether the business has physical locations in Canada; and/ or
  • Whether the business maintains a bank account or a server in Canada.

The draft amendments introduce a new definition, which is “Foreign Money Services Business” that means anyone serving Canadian customers or entities in Canada is now subject to all Canadian requirements no matter where they are located.  Throughout the proposed changes, where there is a reference to money services businesses, there is also a reference to foreign money services businesses.  This will be significant to MSBs who operate non-face-to-face in the online marketplace and do not reside in Canada.

Non-Face-To-Face Customer Identification

Currently, there is a requirement that when customers are identified using the dual process method, the document and/or data that you collect is in its “original” format. This has been interpreted to mean that if the customer receives a utility bill in the mail, they must send you the original paper (not scanned or copied) document. The word “original” will be replaced with “authentic” (meaning that so long as you believe that the utility bill is a real utility bill for that person, it doesn’t need to be the same piece of paper that they received in the mail).

In addition, there are provisions that would allow reporting entities to rely on the identification conducted previously by other reporting entities. If this method is used to identify a customer, the reporting entity must immediately obtain the identification information from the other reporting entity and have a written agreement in place requiring the entity doing the identification to provide the identification verification within 3 days of the request.

Reporting EFTs of $10,000 or More

If you conduct international remittance transactions at the request of your customers, the requirement to report transactions of $10,000 or more will now be your responsibility, not your financial services provider.

The proposed change removes the language commonly known as the “first in, last out” rule.  This means that the first person/entity to ‘touch’ the funds for transactions incoming to Canada or the last person/entity to ‘touch’ the funds for a transaction outgoing from Canada had the reporting obligation (as long as the prescribed information was provided to them).

The update will change the reporting obligation to whoever maintains the customer relationship. So if you initiate a transaction at your customer’s request (outgoing transaction) or provide final receipt of payment to your customer (incoming transaction), it will be your obligation to report that transaction to FINTRAC.

For example, if the flow of the instructions for payment were as follows:

Currently, the reporting obligation of the outgoing EFT would fall to the bank in Canada.  With the draft updates, the reporting obligation would now fall to the MSB in Canada, because they have the relationship with the customer initiating the transaction.

 

Third Party Determination

Currently, the obligation to determine whether a third party is involved in a transaction relates to Large Cash Transactions.  The proposed changes would include the obligation to make a third party determination for all EFTs of $10,000 or more.  This would also require similar record keeping obligations as a third party determination under the current Large Cash Transaction records.

Suspicious Transaction Reporting

Currently, if a reporting entity has reasonable grounds to suspect that a transaction or attempted transaction is related to money laundering or terrorist financing, a report must be submitted to FINTRAC within 30 days of the date that a fact was discovered that caused the suspicion. This change appeared in the last round of amendments that came into force last year, and the proposed new wording would be another significant change:

The person or entity shall send the report to the Centre within three days after the day on which measures taken by them enable them to establish that there are reasonable grounds to suspect that the transaction or attempted transaction is related to the commission of a money laundering offence or a terrorist activity financing offence.

This means that a report would be due three days after the reporting entity conducts an investigation or does something that allows them to reach the conclusion that there are reasonable grounds to suspect.

Information Included In Reports to FINTRAC

Certain information is required in reports to FINTRAC. Even where information is marked as being optional, if a reporting entity has the information, it becomes mandatory to include it. Some of the additional proposed data fields are:

  • every reference number that is connected to the transaction,
  • type of device used by person who makes request online,
  • number that identifies device,
  • internet protocol address (IP address) used by device,
  • person’s user name, and
  • date and time of person’s online session in which request is made.

These fields may require significantly more data to be included in reports, especially for transactions that are conducted online.

Ongoing Compliance Training

Currently, there are five required elements of a Canadian AML compliance program, but there is soon to be a sixth.  Before you get too worried, it’s not that major.  The change is specific to your ongoing compliance training obligations, which says you must institute and document a plan for your ongoing compliance training program and the delivery of the training.  Basically, in your AML compliance program documentation, you need to provide a description of your training program for at least the next year and how the training will be delivered. Many MSBs have already implemented this best practice.

Risk Assessment Obligations

With the recent addition of the “New Technologies and Developments” category to the Risk-Based Approach requirements, the next logical progression has be added.  The updates include the obligation to assess the money laundering and terrorist financing risk of any new technology before implementation.  Meaning, if you are looking to take your business online and are going to use this fancy, new non-face-to-face ID system, you had better take careful inventory of where your risks are and be sure the appropriate controls have been put in place before going live. Much like the training plan, many MSBs have already implemented this best practice.

Virtual Currency

The draft updates also include major changes related to virtual currency. “Dealers in virtual currencies’ would be regulated as MSBs. New record keeping and reporting obligations would apply to all reporting entities that accept payment in virtual currency, or send virtual currency on behalf of their customers.

For more information on updates specific to virtual currency, please check out our full article.

What Next

If you’ve read this far, congratulations and thank you!

We hope that you will contribute your thoughts and comments. You can do this by contacting the Department of Finance directly. Their representative on this file is:

Lynn Hemmings

Acting Director General

Financial Systems Division

Financial Sector Policy Branch

Department of Finance

90 Elgin Street

Ottawa, Ontario

K1A 0G5

Email: fin.fc-cf.fin@canada.ca

If you would like assistance drafting a submission, or have questions that you would like Outlier to answer, please get in touch!

If you are interested in sharing your comments with the Canadian MSB Association (and we highly encourage you to do so) please email luisa@global-currency.com. She will have more information on the industry group’s submission and consultation process.

Finalized Breach of Security Safeguards Regulations

Back in June of 2015, the Digital Privacy Act, received royal assent resulting in amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA). Most amendments came into force at that time, except for the much-anticipated requirements related to breach notification. These requirements will come into force once regulations have been developed and put into place and will affect any organization that collects, uses or discloses personal information in the course of commercial activities.

 On September 2, 2017, a draft of those regulations was published for public comment in the Canada Gazette and on April 18, 2018 the final Breach of Security Safeguards Regulations under PIPEDA were published. The regulations set out prescribed requirements for mandatory breach reporting and will come into force on November 1, 2018.

The objective of the regulations is to:

  • Ensure that all Canadians receive consistent information about data breaches that pose a risk of significant harm to them.
  • Ensure that data breach notifications contain sufficient information to enable individuals to understand the significance and potential impact of the breach.
  • Ensure that the Commissioner receives consistent and comparable information about data breaches that pose a risk of significant harm.
  • Ensure that the Commissioner is able to provide effective oversight and verify that organizations are complying.

The regulations require organizations to report, to the privacy Commissioner, any breach of security safeguards involving personal information under its control if it is reasonable to believe the breach creates a real risk of significant harm. The regulations state that such a report must contain the following:

  • a description of the circumstances of the breach and, if known, the cause;
  • the day or the period in which the breach occurred;
  • a description of the personal information that was involved in the breach;
  • an estimate of the number of individuals impacted – were the breach creates a real risk of significant harm;
  • the steps that the organization has taken to reduce the risk of harm to the impacted individuals;
  • the steps that the organization has taken or will take to notify impacted individuals; and
  • the name and contact information of a person who can answer, on behalf of the organization, the Privacy Commissioner’s questions about the breach.

Organizations that experience such a breach will have also have to do the  following:

  • Determining if the breach poses a “real risk of significant harm” to any individual whose personal information was involved in the breach by conducting a risk assessment;
  • Notifying affected individuals if it is determined that there is a real risk of significant harm. How the notification will take place depends on serval factors such as if contact information of the impacted individuals is known, cost, and if the method chosen to deliver such a notification will cause further harm;
  • Issuing notification that contains:
    • a description of the circumstances of the breach;
    • the day or period during which the breach occurred;
    • a description of the personal information that was involved in the breach;
    • the steps that the organization has taken to reduce the risk of harm to the impacted individuals;
    • the steps that the impacted individuals could take to reduce the risk of harm resulting from the breach;
    • a toll-free number or email address that the impacted individuals can use to obtain further information about the breach; 
    • information about the organization’s internal complaint process and about the individual’s right, under PIPEDA and that they can make a complaint with the Privacy Commissioner;
  • Notifying other organizations or government institution if they believe the they may be able to reduce the risk of harm to the impacted individuals.  (i.e. law enforcement agencies). If this is the case, consent of individuals is not required for such disclosures; and
  • Keeping records of any data breach for a minimum of 24 months.

In determining if there is a “real risk of significant harm”, the assessment of risk conducted must consider factors such as the sensitivity of the personal information involved, whether or not the data was encrypted, whether the personal information was misused, if the information has been recovered, etc. The true risk of such factors may not always be known at the time that the risk assessment is first conducted.  One distinction from the draft regulations is that the final regulations also refer to harm “that could result from the breach” rather than harm “resulting from the breach”. This final wording is more practical than that of the language found in the draft, as potential harms will often be speculative at the time the breach is first discovered.

In reporting “as soon as feasible,” the final regulations allow for an organization to submit new information to the Commissioner after the initial report has been submitted. This is a significant improvement over the draft regulations, since organizations often do not have all information at the time a report is required to be submitted.

We’re Here To Help

If you have questions regarding these new requirements or any questions related to privacy legislation in general, please contact us.

PIPEDA’s Security Breach Notification Provisions

Back in September we published an article on Breach of Security Safeguards Regulation. Those requirements will come into force on November 1, 2018, according to an Order in Council issued on March 26, 2018.

The much-anticipated requirements will require organizations to report, to the privacy commissioner and affected individuals, any breach of security safeguards involving personal information under its control if it is reasonable to believe the breach creates a real risk of significant harm.

While the final regulation is not yet available, a draft of the regulation can be found here.

We’re Here To Help

If you have questions regarding how your organization will be impacted by these requirements or any questions related to privacy legislation in general, please contact us.

FCAC Supervision Framework

The Financial Consumer Agency of Canada (FCAC) Supervision Framework updates and replaces FCAC’s current Compliance Framework. The updates provide a clearer and deeper understanding of how FCAC fulfills its mandate to protect financial consumers.

The current Compliance Framework combined the supervision and enforcement divisions.  Under the New Supervision Framework, there will be three separate divisions:

  1. Promotion/Policy Division;
  2. Supervision/Monitoring Division; and
  3. Enforcement Division.

Who Does This Apply To?

The FCAC supervises the market conduct of federally regulated entities, these fall into two categories:

Tier 1 regulated entities – entities where business activities inherently include market conduct risk and nature of the products or services offered by tier 1 entities requires compliance with market conduct obligations overseen by FCAC. These include entities such as Federally Regulated Financial Institutions (FRFIs) that offering retail products and services to consumers; payment card network operators who offer payment services to merchants; and external complaints bodies (ECBs) offering dispute resolution services to member banks.

Tier 2 includes regulated entities such as banks and trust companies that do not offer retail products and services, or insurance companies that restrict their business to the sale of insurance. FCAC monitors tier 2 regulated entities significantly less than tier 1 regulated entities.

What Do You Need To Do?

FCAC expects regulated entities to proactively identify, address, monitor and keep FCAC updated on their risks and controls. Also, they expect regulated entities to proactively report to FCAC any material developments that could change their market conduct risk.

Tools For Promotion

The FCAC promotes responsible market conduct by communicating expectations and interpretations using various tools. The FCAC will continue to promote responsible market conduct using guidelines and decisions, but will introduce a rulings process. Although rulings apply to a particular case and its specific circumstances, publishing information about the ruling provides direction to entities of similar nature.

Tools For Monitoring

FCAC monitoring activities include gathering and assessing information and introduces new monitoring tools. One such tool is the maintenance of a market conduct profile for each tier 1 regulated entity, which will help identify the entity’s risk profile.

Tools For Enforcement

Enforcement begins with the process of investigating a potential breach of a market conduct obligation. Such investigations may lead to the issuance of either a compliance report which is included in the existing FCAC Compliance Framework or a notice of breach which is a new tool under the Supervision Framework. There are three levels of a notice of breach.

What path of action the FCAC will take when it comes to enforcement remains unclear, but perhaps the new ruling process discussed within the new Framework will be helpful for organizations.

When Does This Come Into Force?

It was expected that the FCAC would commence implementation of the Supervision Framework on November 1, 2017 and that the FCAC internal processes and tools that will be used (i.e. revised Publishing Principles) will likely come at a later date. This has now been extended to sometime in 2018. The FCAC’s website is vague on details as to when exactly enforcement will start or as to reasons why enforcement has been pushed out.

We’re Here To Help

If you have questions about these changes, or compliance in general, please contact us.

Breach of Security Safeguards Regulations

Back in June of 2015, the Digital Privacy Act received royal assent, resulting in amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA). Most amendments came into force at that time, except for the much-anticipated requirements related to breach notification. These requirements will come into force once regulations have been developed and put into place, and will affect any organization that collects, uses or discloses personal information in the course of commercial activities.

On September 2, 2017, a draft of those regulations was published in the Canada Gazette. The draft regulations will require organizations to report, to the privacy commissioner, any breach of security safeguards involving personal information under its control if it is reasonable to believe the breach creates a real risk of significant harm. The draft regulations state that such a report would have to contain the following:

  • a description of the circumstances of the breach and, if known, the cause;
  • the day or the period in which the breach occurred;
  • a description of the personal information that was involved in the breach;
  • an estimate of the number of individuals impacted – where the breach creates a real risk of significant harm;
  • the steps that the organization has taken to reduce the risk of harm to the impacted individuals;
  • the steps that the organization has taken or will take to notify impacted individuals; and
  • the name and contact information of a person who can answer, on behalf of the organization, the Privacy Commissioner’s questions about the breach.

Organizations that experience such a breach will also have to do the  following:

  • Determine if the breach poses a “real risk of significant harm” to any individual whose personal information was involved in the breach by conducting a risk assessment;
  • Notify affected individuals if it is determined that there is a real risk of significant harm. How the notification will take place depends on serval factors such as if contact information of the impacted individuals is known, cost, and if the method chosen to deliver such a notification will cause further harm;
  • Issue notification that contains:
    • a description of the circumstances of the breach;
    • the day or period during which the breach occurred;
    • a description of the personal information that was involved in the breach;
    • the steps that the organization has taken to reduce the risk of harm to the impacted individuals;
    • the steps that the impacted individuals could take to reduce the risk of harm resulting from the breach;
    • a toll-free number or email address that the impacted individuals can use to obtain further information about the breach; and
    • information about the organization’s internal complaint process and about the individual’s rights under PIPEDA, and that they can make a complaint with the privacy commissioner;
  • Notify other organizations or government institutions if they believe they may be able to reduce the risk of harm to the impacted individuals (i.e. law enforcement agencies). If this is the case, consent of individuals is not required for such disclosures; and
  • Keep records of any data breach for a minimum of 24 months.

The determination if there is a real risk of significant harm to an individual, and reporting “as soon as feasible” requirements, are likely to be the most challenging for organizations.

In determining if there is a “real risk of significant harm”, the assessment of risk conducted must consider factors such as the sensitivity of the personal information involved, whether or not the data was data encrypted, whether the personal information could be misused, if the information has been recovered, etc. The true risk of such factors may not always be known at the time that the risk assessment is first conducted. If not known, it may be best to use a worst case scenario in the assessment.

In reporting “as soon as feasible” after an organization determines that the breach has occurred, to both the Privacy Commissioner and impacted individuals, organizations may be hesitant to provide specific information. Reasons why organizations may be hesitant may include, details and information may change as further investigating of the breach is conducted, or for fear of litigation risk down the road. Additionally, there is reputational risk that organizations will be concerned about. When notifying the Privacy Commissioner, organizations may want to state that the investigation is ongoing and that updates will be provided in a timely manner. When notifying impacted individuals, organizations should ensure that all required information is contained in the notification. It is best to be transparent and truthful in such notifications, as not doing so may cause even greater litigation and reputational risk.

Regulatory Impact Analysis and Regulations

The draft regulations are open for a comment period, to read full details of the draft and the accompanying regulatory impact analysis statement please visit the Canada Gazette.

We’re Here To Help

If you have questions regarding this or any questions related to privacy legislation in general, please contact us.

AML & Digital Currency in Canada

Because we’ve been asked a time or two what’s new in AML & digital currency in Canada…

The following are a compilation of FINTRAC’s policy positions in relation to digital currency. This document is current as of July 25, 2017.

We have not charged anyone for access to this information, and if you have downloaded this document, our only condition of its use is that you do not do so either.

Free Download: FINTRAC Bitcoin Policy Interpretations as at 25Jun2017

If you feel inclined to tip, we won’t argue. Tips will be shared among the team members that collaborated to put this memo together.

bitcoin ethereum
3AqYJQhfKYCde7syKKqTJJPdLs6M5CbWkR 0x03CDF23a2Eb070F2c79De5B2E6FB90671D3c70fE
Outlier BTC Tipping Address

If you have any questions or concerns about how these may apply to you and your business, please feel free to get in touch.

Amber & The Outlier Canada Team

Email: amber@outliercanada.com

Skype: OutlierCanada

Twitter: @OutlierCanada

FINTRAC’s 2016 Real Estate Brief

Quick Overview

A little over a month ago, FINTRAC published an operational brief for the Canadian real estate industry.  The brief was intended to assist reporting entities in meeting the obligations to report suspicious transactions or attempted suspicious transactions that related to potential money laundering or terrorist financing.  The publication provided some common indicators that may be present in a transaction that suggest money laundering or terrorist financing could be involved.

What Does it Mean?

The suspicious indicators provided by FINTRAC list circumstances or activities that might signal potentially illicit activity.  This does not mean that if one or more of the indicators are present that the transaction is definitely suspicious and must be reported to FINTRAC, it is meant to ensure that you are aware of the potential that suspicious activity may be taking place.  In that context, if you are involved in real estate transactions, you must be aware of the indicators in the brief.  If you do encounter a transaction that may be considered suspicious, you will need to collect additional information that will aid in your decision to report it or document why it was not considered suspicious.

What Now?

In order to ensure familiarity for anyone who interacts with customers and their transactions, the list of FINTRAC’s indicators should be included in your ongoing AML compliance training program.  Furthermore, the indicators should also be included in your procedure manuals, allowing easy access to the information.  Finally, the indicators should be incorporated into your Risk Assessment documentation.  Specifically, when determining customer risk and the controls used to effectively mitigate potential risks.

We’ve made it easier for you to integrate this content into your program by putting the indicators in a Word document for you.

Need a Hand?

Outlier has taken the list of indicators provided by FINTRAC and formatted them into an easy to use Microsoft Word document, which can be downloaded here: FINTRAC Indicators Specific to Real Estate Transactions.  This should allow companies within the real estate sector to easily update their documentation and ensure they are sufficiently monitoring for potentially suspicious activity.  If you aren’t sure what to do with this information and would like some assistance, please feel free to contact us.

Would You Recognize Real Estate Red Flags?

Rodney_FINTRACOn November 14th, 2016 FINTRAC released a brief for all reporting entities who may be involved in real estate transactions.  The briefing is intended as guidance to provide some examples of indicators that may be present in transactions that may suggest they are linked to money laundering or terrorist financing.  The indicators described have been taken from transactions suspected of being related to money laundering or terrorist financing reported internationally.  The briefing focuses on the potential risks and vulnerabilities within the real estate industry and provides suggestions on how to ensure reporting entities are sufficiently meeting suspicious transaction reporting obligations.

The briefing is meant to provide operational guidance given the small overall number of suspicious transactions that have been reported to FINTRAC by the Real Estate industry.  The briefing states that these indicators will be used by FINTRAC to assess compliance with your reporting obligations.  If you are a reporting entity that interacts with the real estate industry in one form or another, the indicators and scenarios outlined in this brief should be considered when updating your Risk Assessment and training materials.

To put things into perspective, though the actual size of the real estate market is difficult to determine precisely, CMHC has produced some statistics.  CMHC suggests that between 2003 and 2013 over $9 trillion of mortgage credits were negotiated and roughly 5 million sales took place through Multiple Listing Services (MLS).  In contrast, FINTRAC received only 127 Suspicious Transactions Reports (STRs) from real estate brokers, agents and developers and 152 by other types of reporting entities, such as banks and trust/loan companies.  To go a step further, in FINTRAC’s 2015 Annual Report, between April 1, 2014 and March 31, 2015, a total of 92,531 STRs were filed across all reporting entities.

 

re-strs-filed-vs-sales

This evidence supports FINTRAC’s assertion that operational guidance for the real estate industry is needed.

The indicators and examples covered in the brief outline numerous scenarios that may suggest that a transaction is related to a money laundering or terrorist financing offense.  It also speaks to how the appearance of legitimacy obfuscates the clarity of suspicious transactions and requires more than a just “gut feel”.  What is required is the consideration of the facts related to the transaction and their context.  Does the transaction with all the known factors, positive or negative, make sense?

 

What This Means to Your Business? 

First off, FINTRAC will be using the indicators provided to assess your compliance with reporting obligations.  This has a couple different applications.  The first being, does your AML compliance program documentation make reference to the suspicious indicators that are provided.  Basically, are staff aware of the elements that may be present in a transaction that would suggest money laundering or terrorist financing may be occurring?

Secondly, is there an oversight process to ensure if there are transactions that contain one or more of these indicators where an STR was not submitted, is reviewed?  If so, does the process ensure supporting evidence that the Compliance Officer reviewed the transaction and determined there were not reasonable grounds to suspect its relation to money laundering or terrorist financing?  When you encounter a transaction involving any of the indicators provided, it is very important that you collect as much information as possible to assist the Compliance Officer with their determination of whether there are reasonable grounds to suspect that a transaction, or attempted transaction, may be related to money laundering or terrorist financing.  Alternatively, even if none of the indicators provided by FINTRAC are present but we still feel there is “something off” about our customer’s transaction, speak with your Compliance Officer.  They will be able to provide some insight on additional information that may assist our decision.  Once you have collected any additional information you may still not feel comfortable, but this does not mean you cannot complete the transaction, but that you must be sure your Compliance Officer is provided with all the information, which includes our reason for the escalation, so that they can decide whether there are reasonable grounds to suspect it may be related to a money laundering or terrorist financing offense.  The Compliance Officer will document their decision and, if necessary, submit an STR to FINTRAC.

Need a Hand?

If you are a reporting entity that interacts with the real estate industry and would like assistance updating your AML compliance program documentation or simply have some questions, please contact us.

Return to Blog Listing