Consumer-Driven Banking Act

An Act to establish a consumer-driven banking framework Short title This Act may be cited as the Consumer-Driven Banking Act. Definitions The following definitions apply in this Act. authentication information means any password or other information that a consumer creates or adopts to be used to authenticate their identity. (authentifiant) Bank means the Bank of Canada. (Banque) complaint means an expression of dissatisfaction, whether justified or not, to a participating entity with respect to any activity that it performs under this Act. (plainte) derived data means, subject to the regulations, data about a consumer, product or service that has been enhanced by a participating entity to significantly increase its usefulness or commercial value. (données dérivées) entity means a corporation, trust, partnership, fund, unincorporated association or organization or federal or provincial Crown corporation. (entité) external complaints body means the corporation designated under subsection 114(1). (organisme externe de traitement des plaintes) federal financial institution means a bank that is listed in Schedule I or II to the Bank Act; an authorized foreign bank as defined in section 2 of the Bank Act; a company to which the Trust and Loan Companies Act applies; an association to which the Cooperative Credit Associations Act applies; or a company, fraternal benefit society or foreign company to which the Insurance Companies Act applies. (institution financière fédérale) government authority includes the Royal Canadian Mounted Police, the Communications Security Establishment and the Canadian Security Intelligence Service. (autorité administrative) Governor has the same meaning as in section 2 of the Bank of Canada Act. (gouverneur) Minister means the Minister of Finance. (ministre) participating entity means a bank that is listed in the schedule; a federal financial institution or provincial financial institution that is accredited under section 15; a registered payment service provider that is accredited under section 17; or an entity that is accredited under section 19. (entité participante) provincial financial institution means a cooperative credit society, savings and credit union or caisse populaire that is regulated by a provincial Act; a provincial Crown corporation that offers deposit-taking services; or an insurance company that is regulated by a provincial Act. (institution financière provinciale) registered payment service provider means a payment service provider, as defined in section 2 of the Retail Payment Activities Act, that is registered, as defined in that section. (fournisseur de services de paiement enregistré) registry means the registry that is maintained under section 44. (registre) sharing, in respect of consumer data, means the provision or receipt of that data by participating entities. (partage) technical standards body means the body designated under subsection 125(1). (organisme de normalisation technique) third-party service provider means an individual or entity that is not an employee or an agent or mandatary of a participating entity and that, under a contract, provides the participating entity with a service that is related to the activities that the participating entity performs under this Act. (tiers fournisseur de services) Purpose The purpose of this Act is to establish a framework within which consumers, including businesses, can direct that their data be shared among participating entities of their choice, to ensure that the sharing of data among participating entities is safe and secure and to foster competition in the financial sector. Objects The Bank’s objects under this Act are to supervise participating entities, accredited third-party service providers, the external complaints body and the technical standards body to determine whether they are in compliance with the provisions of this Act and the regulations that are applicable to them, and orders made, undertakings required, compliance agreements entered into and directions made under this Act; monitor and evaluate trends and emerging issues that may have an impact on consumers of consumer-driven banking, including trends and issues in respect of products, services and market developments, and make information on those trends and issues public; foster participation in consumer-driven banking in cooperation with any department, agency or agent corporation of the Government of Canada or any department, agency or agent or mandatary corporation of the government of a province, financial institutions and consumer and other organizations; and foster competition in the financial sector in the interests of consumers. Agreements or arrangements The Bank may, for the purpose of exercising its powers or performing its duties and functions under this Act, enter into an agreement or arrangement with any government authority or regulatory body. Guidelines — Bank Subject to subsection (2), the Bank may issue guidelines respecting the manner in which this Act is to be applied. Guidelines — Minister The Minister may issue guidelines respecting the manner in which any provision of this Act that confers powers, duties or functions on the Minister is to be applied. Publication of information — regulations The Bank must publish, within the time and in the manner provided for in the regulations, the information that is provided for in the regulations respecting consumer-driven banking. Publication of information as appropriate The Bank may publish any information with respect to consumer-driven banking that the Bank considers appropriate. Personal information The Bank may collect any personal information that the Bank considers necessary for carrying out its objects under this Act. Delegation of Governor’s powers, duties and functions The Governor may delegate to an officer of the Bank any of the Governor’s powers, duties or functions under this Act. Data This Act applies in respect of data that relates to the following products and services, including data that is provided by a consumer and data that is provided for in the regulations: deposit accounts; registered investment accounts; non-registered investment accounts; payment products; lines of credit, mortgages or hypothecs and other kinds of loans; and other products or services provided for in the regulations. Exclusion This Act does not apply in respect of derived data. Limit — editing data Data that is shared between participating entities in accordance with this Act is to be shared in a manner that does not enable the participating entity that receives the data to edit the data on servers that are used by the participating entity that provides the data. Restriction Nothing in this Act affects any restriction imposed under the Bank Act on banks with respect to the sharing of information about a consumer with an insurance company, agent or broker for the business of insurance. Adding to schedule The Minister may, by order, amend the schedule by adding the name of a bank that is listed in Schedule I to the Bank Act. Amendment The Minister may, by order, amend the schedule by amending the name of a bank. Deletion The Minister may, by order, amend the schedule by deleting the name of a bank if the bank is dissolved or if it is continued, or amalgamated and continued, as a corporation to which another Act of Parliament applies. Order to be published An order made under this section must be published in the Canada Gazette. Notice to Bank The Minister must, as soon as feasible, notify the Bank of any amendment that is made to the schedule. Registry As soon as feasible after being notified of an amendment to the schedule, the Bank must add to the registry the name of any bank whose name was added to the schedule, the date on which it was added to the schedule and any other relevant information; amend in the registry the name of any bank whose name was amended in the schedule; or delete from the registry the name of any bank whose name was deleted from the schedule and all other information about the bank. Notice to bank As soon as feasible after amending the registry under this section, the Bank must notify the bank to which the amendment relates. Accreditation Subject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit a federal financial institution, other than a bank that is listed in the schedule, or provincial financial institution if the Bank is satisfied that the federal financial institution or provincial financial institution is in compliance with the technical standard referred to in subsection 125(1) and the security safeguards provided for in the regulations. Fee An applicant must include with the application an accreditation fee determined in accordance with the regulations. Information At the Bank’s request and within the time and in the manner specified by the Bank, an applicant must provide the Bank with any information that is relevant to the application. Notice of change to information As soon as feasible after an applicant becomes aware that information provided as part of the application has changed or is about to change, the applicant must notify the Bank of the change or anticipated change, and the Bank must then, as soon as feasible, notify the Minister and any designated person or government authority. Notice and addition to registry As soon as feasible after deciding to accredit an applicant or refuse an application, the Bank must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information. Subject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit a registered payment service provider if the Bank is satisfied that it meets the requirements provided for in the regulations. Subject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit an entity other than a federal financial institution or provincial financial institution or a registered payment service provider, if the Bank is satisfied that the entity meets the requirements provided for in the regulations. Review An applicant that has been notified under section 16, 18 or 20 of a decision to refuse its application for accreditation may, within the period provided for in the regulations, make a request to the Governor for a review of the decision. Decision After giving the applicant an opportunity to make representations, the Governor must, within the period provided for in the regulations, confirm the refusal or accredit the applicant. As soon as feasible after deciding to confirm the refusal or accredit the applicant, the Governor must notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information. Request for revocation The Bank must revoke a participating entity’s accreditation at the request of the participating entity if the Bank is satisfied that the participating entity has complied with its duties under this Act; has, in accordance with the regulations and at least 30 days before the day on which it makes the request for revocation, notified in writing any consumers that use the services that it provides in accordance with this Act of its intention to request revocation and provided those consumers with any other information that is provided for in the regulations; and in the case of a participating entity that is a provincial financial institution, has, at least 30 days before the day on which it makes the request for revocation, notified in writing the appropriate provincial authority that regulates or supervises the provincial financial institution of its intention to request revocation. Notice of decision The Bank must, as soon as feasible, notify the participating entity in writing of the decision with respect to the request and the reasons for the decision. Reference to revocation in registry If the Bank decides to revoke the participating entity’s accreditation, the Bank must, as soon as feasible, include a reference to the revocation in the registry. Suspension The Bank may suspend a participating entity’s accreditation if the Bank is satisfied that the participating entity has contravened this Act or the regulations. Reference to suspension in registry The Bank must, as soon as feasible, include a reference to the suspension in the registry. Conditions The Bank may impose any conditions that the Bank considers appropriate on a participating entity whose accreditation is suspended and the participating entity must comply with those conditions. Notice The Bank must, as soon as feasible, notify the participating entity in writing of the suspension and any conditions imposed. Notice to consumers As soon as feasible after being notified of the suspension, the participating entity must notify in writing any consumers that use the services that it provides in accordance with this Act of the suspension and any conditions imposed. End of suspension If the Bank is satisfied that the grounds for suspending a participating entity’s accreditation no longer exist, the Bank must end the suspension and must, as soon as feasible, notify the participating entity in writing that the suspension has ended and remove the reference to the suspension from the registry. Notice of intent to revoke accreditation The Bank may give a participating entity a notice of intent to revoke the participating entity’s accreditation if the Bank is satisfied that the participating entity has contravened this Act or the regulations. A notice of intent must include reasons. Review of notice of intent A participating entity that has been given a notice of intent to revoke may, within the period provided for in the regulations, make a request to the Governor for a review of the notice of intent. After giving the participating entity an opportunity to make representations, the Governor must, within the period provided for in the regulations, revoke the participating entity’s accreditation or withdraw the notice of intent. Notice to participating entity The Governor must, as soon as feasible, notify the participating entity in writing of the decision and the reasons for it. Review not requested If a participating entity that has been given a notice of intent to revoke does not make a request for a review within the period provided for in the regulations, the Bank must revoke the participating entity’s accreditation or withdraw the notice of intent. The Bank must, as soon as feasible, notify the participating entity in writing of the decision and the reasons for it. If the Governor revokes a participating entity’s accreditation under subsection 26(2) or the Bank does so under section 27, the Bank must, as soon as feasible, include a reference to the revocation in the registry. Duties of former participating entity A participating entity whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection 26(3) or section 27, comply with its duties under this Act and, in accordance with the regulations, notify in writing any consumers that used the services that it provided in accordance with this Act and provide those consumers with any other information that is provided for in the regulations. Notice to appropriate provincial authority If the Bank gives notice under subsection 22(2) or 23(4) or section 24, 25 or 27 to a participating entity that is a provincial financial institution, or the Governor does so under subsection 26(3), the Bank or the Governor, as the case may be, must, as soon as feasible, notify the appropriate provincial authority that regulates or supervises the provincial financial institution. Accreditation required A participating entity must not use a third-party service provider to perform any of the following activities under this Act unless the third-party service provider is accredited under section 32: obtaining or managing consumers’ consent on behalf of the participating entity; confirming consumers’ authentication information or managing the authentication of consumers on behalf of the participating entity; providing or receiving consumer data on behalf of the participating entity. Subject to sections 50 and 52, the Bank may, on application made in accordance with the regulations, accredit an individual or entity to perform one or more of the activities referred to in paragraphs 31(a) to (c) if the Bank is satisfied that the individual or entity meets the requirements provided for in the regulations. An applicant that has been notified under section 33 of a decision to refuse its application for accreditation may, within the period provided for in the regulations, make a request to the Governor for a review of the decision. The Governor must, as soon as feasible, notify the applicant in writing of the decision and the reasons for it and, in the case of a decision to accredit, add to the registry the applicant’s name, the date of accreditation and any other relevant information. The Bank must revoke an accredited third-party service provider’s accreditation at the request of the accredited third-party service provider if the Bank is satisfied that the accredited third-party service provider has complied with its duties under this Act. The Bank must, as soon as feasible, notify the accredited third-party service provider in writing of the decision with respect to the request and the reasons for the decision. If the Bank decides to revoke the accredited third-party service provider’s accreditation, the Bank must, as soon as feasible, include a reference to the revocation in the registry. The Bank may suspend an accredited third-party service provider’s accreditation if the Bank is satisfied that the accredited third-party service provider has contravened this Act or the regulations. The Bank may impose any conditions that the Bank considers appropriate on an accredited third-party service provider whose accreditation is suspended and the accredited third-party service provider must comply with those conditions. The Bank must, as soon as feasible, notify the accredited third-party service provider in writing of the suspension and any conditions imposed. Notice to participating entities As soon as feasible after being notified of the suspension, the accredited third-party service provider must notify in writing any participating entities on whose behalf it is performing any of the activities for which it was accredited of the suspension and any conditions imposed. If the Bank is satisfied that the grounds for suspending an accredited third-party service provider’s accreditation no longer exist, the Bank must end the suspension and must, as soon as feasible, notify the accredited third-party service provider in writing that the suspension has ended and remove the reference to the suspension from the registry. The Bank may give an accredited third-party service provider a notice of intent to revoke the accredited third-party service provider’s accreditation if the Bank is satisfied that the accredited third-party service provider has contravened this Act or the regulations. A notice of intent must include reasons. An accredited third-party service provider that has been given a notice of intent to revoke may, within the period provided for in the regulations, make a request to the Governor for a review of the notice of intent. After giving the accredited third-party service provider an opportunity to make representations, the Governor must, within the period provided for in the regulations, revoke the accredited third-party service provider’s accreditation or withdraw the notice of intent. Notice to accredited third-party service provider The Governor must, as soon as feasible, notify the accredited third-party service provider in writing of the decision and the reasons for it. If an accredited third-party service provider that has been given a notice of intent to revoke does not make a request for a review within the period provided for in the regulations, the Bank must revoke the accredited third-party service provider’s accreditation or withdraw the notice of intent. The Bank must, as soon as feasible, notify the accredited third-party service provider in writing of the decision and the reasons for it. If the Governor revokes an accredited third-party service provider’s accreditation under subsection 39(2) or the Bank does so under section 40, the Bank must, as soon as feasible, include a reference to the revocation in the registry. Duties of former accredited third-party service provider A third-party service provider whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection 39(3) or section 40, comply with its duties under this Act and, in accordance with the regulations, notify in writing any participating entities on whose behalf it was performing, at the time of the revocation, any of the activities for which it was accredited and provide those participating entities with any other information that is provided for in the regulations. Right of appeal An applicant that has been notified under subsection 21(3) or 34(3) of a decision to refuse accreditation, a participating entity that has been notified under subsection 26(3) of a decision to revoke its accreditation or an accredited third-party service provider that has been notified under subsection 39(3) of a decision to revoke its accreditation may appeal the decision to the Federal Court within the period provided for in the regulations or any longer period that the Court allows. Powers of Federal Court The Federal Court may dismiss the appeal or set aside the decision and refer the matter back to the Governor for redetermination. The Bank must maintain a public registry that includes the following information: the name and address of each participating entity; in the case of a participating entity that is a bank that is listed in the schedule, the date on which its name was added to the schedule; in the case of a participating entity that is accredited under section 15, 17 or 19, the date on which it was accredited; the status of each participating entity, the date of any change to its status and, if applicable, the reasons for which its accreditation was revoked; any other information provided for in the regulations in relation to a participating entity or the activities that it performs under this Act; the name and address of each accredited third-party service provider and the date on which it was accredited; the status of each accredited third-party service provider, the date of any change to its status and, if applicable, the reasons for which its accreditation was revoked; and any other information provided for in the regulations in relation to an accredited third-party service provider or the activities that it performs under this Act. Designation The Minister may designate a person or government authority for the purposes of subsections 15(4), 17(4), 19(4) and 32(4), section 46, paragraph 51(e), section 54, paragraph 66(1)(e), sections 71 and 73, subsections 98(3) and 120(3) and sections 132, 137, 139 and 173. Copy of application The Bank must, as soon as feasible after determining that an application for accreditation is complete, provide the Minister and any designated person or government authority with a copy of the application. Decision to review application The Minister may, within the period provided for in the regulations, decide to review an application for accreditation if the Minister is of the opinion that it is necessary to do so for reasons related to national security. In that case, the Minister must notify the Bank of the decision and the Bank must then notify the applicant. Extension of period The Minister may extend the period for one or more periods provided for in the regulations if the Minister considers it necessary to do so and notifies the Bank. In that case, the Bank must notify the applicant of the extension. If the Minister decides to review an application for accreditation, the Minister must conduct the review within the period provided for in the regulations. After completing the review, the Minister must issue a directive to refuse accreditation to the Bank under section 51 or notify the Bank that the Minister has decided not to issue a directive under that section. The Minister may extend the period for conducting the review for one or more periods provided for in the regulations if the Minister considers it necessary to do so and notifies the Bank. In that case, the Bank must notify the applicant of the extension. Notice to applicant If the Bank is notified that the Minister has decided not to issue a directive under section 51, the Bank must notify the applicant of the decision. No accreditation The Bank must not accredit an applicant during a period referred to in subsection 47(1) or (2) unless the Minister notifies the Bank that the Minister has decided not to review the application. If the Minister notifies the Bank that the Minister has decided to review the application, the Bank must not accredit the applicant unless the Minister notifies the Bank that the Minister has decided not to issue a directive under section 51. Directive to refuse accreditation The Minister may issue a directive to the Bank to refuse to accredit an applicant if there are reasons related to national security; the applicant has failed to provide additional information in accordance with section 54; an order made under section 55, or an undertaking required under that section, that relates to the application for accreditation has not been complied with; a term or condition imposed under section 56 that relates to the application for accreditation has not been complied with; or the applicant has provided false or misleading information to the Bank, the Minister or a designated person or government authority. Refusal to accredit The Bank must refuse to accredit an applicant if the Minister issues a directive to that effect and must, as soon as feasible, notify the applicant in writing that the application has been refused in accordance with a directive issued by the Minister. Review of directive An applicant that has been notified under section 52 may, within the period provided for in the regulations, request a review by the Minister of the directive to refuse accreditation. The request must be submitted to the Bank, which must then, as soon as feasible, transmit it to the Minister. Decision and notice On completion of the review and after giving the applicant an opportunity to make representations, the Minister must confirm or revoke the directive. The Minister must notify the Bank of the decision and the Bank must then, as soon as feasible, notify the applicant in writing. Additional information An applicant must provide the Minister and any designated person or government authority with any additional information that the Minister or the designated person or government authority requests, for reasons related to national security, in relation to the applicant or the activities that the applicant plans to perform under this Act. Manner A request for information under subsection (1) must be submitted to the Bank, which must then, as soon as feasible, transmit it to the applicant. The applicant must, within the period provided for in the regulations, provide the requested information to the Bank, which must then, as soon as feasible, provide it to the Minister and any designated person or government authority. Undertakings The Minister may, by order, require any individual or entity to provide an undertaking in relation to an application for accreditation or in relation to a participating entity or accredited third-party service provider if the Minister is of the opinion that it is necessary to do so for reasons related to national security. Terms and conditions The Minister may, by order, impose terms and conditions on any individual or entity in relation to an application for accreditation or in relation to a participating entity or accredited third-party service provider if the Minister is of the opinion that it is necessary to do so for reasons related to national security. Revocation, suspension or amendment The Minister may, by order, revoke or suspend an undertaking required by the Minister or approve its amendment, or revoke, suspend or amend any terms and conditions imposed by the Minister. Effect on accreditation Unless otherwise expressly provided in this Act, a failure to comply with an order made under section 55, an undertaking required under that section or any terms and conditions imposed under section 56 does not invalidate an accreditation to which the order, undertaking or terms and conditions relate. Copy to Bank The Minister must provide a copy of each order made under sections 55 to 57 to the Bank, which must then, as soon as feasible, provide a copy to the individual or entity in question. National security order The Minister may, by order, direct a participating entity, an accredited third-party service provider or any director, officer or agent or mandatary of a participating entity or accredited third-party service provider to take or refrain from taking any measures related to the activities that the participating entity or accredited third-party service provider performs under this Act if the Minister is of the opinion that it is necessary to do so for reasons related to national security. Representations Subject to subsection (3), the Minister must not make an order under subsection (1) unless the participating entity, accredited third-party service provider, entity or individual in question is provided with an opportunity to make representations in respect of the matter. Temporary order If, in the Minister’s opinion, the length of time required for representations to be made might be prejudicial to the public interest, the Minister may make a temporary order that has the same effect as an order made under subsection (1). End of temporary order A temporary order ceases to have effect on the earlier of the end of the 30-day period after the day on which it is made or of any shorter period that is specified in the temporary order, and the day on which an order is made under subsection (1). National security order — revocation The Minister may, by order, direct a participating entity or third-party service provider whose accreditation is revoked under subsection 69(1), or any director, officer or agent or mandatary of the participating entity or third-party service provider, to take or refrain from taking any measures related to the activities that the participating entity or third-party service provider performed under this Act if the Minister is of the opinion that it is necessary to do so for reasons related to national security. Subject to subsection (3), the Minister must not make an order under subsection (1) unless the participating entity, third-party service provider, entity or individual in question is provided with an opportunity to make representations in respect of the matter. Notice — Committee and Review Agency The Minister must, within 30 days after the day on which an order is made under subsection 60(1) or (3) or 61(1) or (3), notify the National Security and Intelligence Committee of Parliamentarians established by section 4 of the National Security and Intelligence Committee of Parliamentarians Act; and the National Security and Intelligence Review Agency established under section 3 of the National Security and Intelligence Review Agency Act. The Minister must provide a copy of each order made under subsection 60(1) or (3) or 61(1) or (3) to the Bank, which must then, as soon as feasible, provide a copy to the individual or entity in question. Confidential information The Minister may specify that information about an undertaking required by an order made under section 55, terms and conditions imposed by an order made under section 56 or an order made under subsection 60(1) or (3) or 61(1) or (3), or information that could reveal the existence of the undertaking, terms and conditions or order, is confidential and must be treated accordingly. Prohibition Despite anything in this Act, it is prohibited for any individual or entity to disclose any confidential information referred to in subsection (1) except for the purposes of subsection (3) or section 59 or 63 or in accordance with any conditions that the Minister may specify. If the Minister specifies under subsection (1) that information is confidential, the Minister must, within 30 days after the day on which the order in question is made under section 55 or 56 or subsection 60(1) or (3) or 61(1) or (3), notify Court enforcement If an individual or entity is not complying with an undertaking required by an order made under section 55, terms and conditions imposed by an order made under section 56 or an order made under subsection 60(1) or (3) or 61(1) or (3), the Minister may, in addition to any other action that may be taken under this Act, apply to a superior court for an order requiring the individual or entity to comply with the undertaking, terms and conditions or order. Powers of court The court may make the order and any other order that it thinks fit. Appeal An appeal from an order made under subsection (2) lies in the same manner and to the same court as an appeal from any other order of the court. Notice of intent — directive to revoke The Minister may issue to the Bank a notice of the Minister’s intent to issue a directive to the Bank to revoke a participating entity’s or accredited third-party service provider’s accreditation if the participating entity or accredited third-party service provider has failed to provide additional information in accordance with section 71; an order made under section 55, or an undertaking required under that section, that relates to the participating entity or accredited third-party service provider has not been complied with; a term or condition imposed under section 56 that relates to the participating entity or accredited third-party service provider has not been complied with; the participating entity or accredited third-party service provider has provided false or misleading information to the Bank, the Minister or a designated person or government authority; or the participating entity or accredited third-party service provider or a director, officer or agent or mandatary of the participating entity or accredited third-party service provider has not complied with an order made under subsection 60(1) or (3). The Bank must, as soon as feasible, notify in writing the participating entity or accredited third-party service provider in question of the notice of intent. A participating entity or accredited third-party service provider that has been notified under subsection 66(2) may, within the period provided for in the regulations, request a review of the notice of intent by the Minister. The request must be submitted to the Bank, which must then, as soon as feasible, transmit it to the Minister. Temporary suspension If, in the Minister’s opinion, the length of time required for a review of the notice of intent might be prejudicial to the public interest, the Minister may issue a directive to the Bank to immediately suspend the participating entity’s or accredited third-party service provider’s accreditation while the review is being undertaken. Suspension and notice The Bank must immediately suspend the participating entity’s or accredited third-party service provider’s accreditation if the Minister issues a directive to that effect under subsection (2). The Bank must then, as soon as feasible, notify the participating entity or accredited third-party service provider in writing that its accreditation has been suspended in accordance with a directive issued by the Minister. The Bank must immediately include a reference to the suspension in the registry. Effect of suspension — participating entity A participating entity that is notified that its accreditation has been suspended under subsection (3) must immediately cease all consumer-driven banking activities that it performs under this Act. Effect of suspension — accredited third-party service provider An accredited third-party service provider that is notified that its accreditation has been suspended under subsection (3) must immediately cease all activities for which it is accredited. On completion of the review and after giving the participating entity or accredited third-party service provider an opportunity to make representations, the Minister must withdraw the notice of intent or issue a directive to the Bank to revoke the accreditation. If the Minister decides to withdraw the notice of intent, the Minister must notify the Bank, which must then immediately notify the participating entity or accredited third-party service provider in writing, end any suspension and remove any reference to the suspension from the registry. If a participating entity or accredited third-party service provider that has been notified under subsection 66(2) does not request a review of the notice of intent within the period provided for in the regulations, the Minister must withdraw the notice of intent or issue a directive to the Bank to revoke the accreditation. Revocation of accreditation The Bank must revoke a participating entity’s or accredited third-party service provider’s accreditation if the Minister issues a directive to that effect under subsection 67(7) or section 68. Notice of revocation The Bank must, as soon as feasible, notify the participating entity or accredited third-party service provider in writing that its accreditation has been revoked in accordance with a directive issued by the Minister. The Bank must, as soon as feasible, include a reference to the revocation in the registry. A participating entity whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection (2), comply with its duties under this Act and, in accordance with the regulations, notify in writing any consumers that used the services that it provided in accordance with this Act and provide those consumers with any other information that is provided for in the regulations. A third-party service provider whose accreditation has been revoked must, as soon as feasible after being notified of the revocation under subsection (2), comply with its duties under this Act and, in accordance with the regulations, notify in writing any participating entities on whose behalf it was performing, at the time of the revocation, any of the activities for which it was accredited and provide those participating entities with any other information that is provided for in the regulations. Within 30 days after the day on which the Minister issues a directive under subsection 67(2), the Minister must notify A participating entity or accredited third-party service provider must provide the Minister and any designated person or government authority with any additional information that the Minister or the designated person or government authority requests, for reasons related to national security, in relation to the participating entity or the activities that it performs under this Act or in relation to the accredited third-party service provider or the activities for which it is accredited. A request for information under subsection (1) must be submitted to the Bank, which must then, as soon as feasible, transmit it to the participating entity or accredited third-party service provider. The participating entity or accredited third-party service provider, as the case may be, must, within the period provided for in the regulations, provide the requested information to the Bank, which must then, as soon as feasible, provide it to the Minister and any designated person or government authority. If the Bank gives notice under subsection 67(3) or (8) or 69(2) to a participating entity that is a provincial financial institution, the Bank must, as soon as feasible, notify the appropriate provincial authority that regulates or supervises the provincial financial institution. The Minister is not authorized to make a request or an order under section 54, 55, 56, 60, 61 or 71 requiring an individual, a participating entity, an accredited third-party service provider or any other entity to provide the Minister or any designated person or government authority with a consumer’s personal information. Decisions and orders final Decisions and orders made by the Minister under this Act are final and binding and, except for judicial review under the Federal Courts Act, are not subject to appeal or to review by any court. Advice and information to Minister The Bank must, at least once every year, provide the Minister with advice and information on matters relating to national security and the integrity or security of the financial system in Canada, as those matters relate to the Minister’s exercise of powers or performance of duties and functions under this Act. Consultation — Superintendent of Financial Institutions The Bank must consult the Superintendent of Financial Institutions before providing the Minister with advice or information that relates to a federal financial institution. Sharing as directed by consumer Unless otherwise prohibited by law and subject to the regulations, a participating entity must share a consumer’s data with other participating entities as directed by the consumer. Technical standard A participating entity that shares a consumer’s data must do so in compliance with the technical standard referred to in subsection 125(1). No condition Subject to the regulations, a participating entity must not impose any conditions on another participating entity for the sharing of a consumer’s data in accordance with this Act. Unless otherwise prohibited by law, a participating entity must notify the Bank, within the time and in the manner specified by the Bank, if the participating entity does not share a consumer’s data as required by subsection (1). No charge for sharing A participating entity must not impose a charge for sharing a consumer’s data in accordance with this Act, including for obtaining or renewing a consumer’s consent or for withdrawing that consent. Credit or refund If a participating entity imposes a charge on a consumer for sharing the consumer’s data in accordance with this Act, the participating entity must credit the amount of the charge to the consumer or, if the amount was collected, refund it. Interest The amount referred to in subsection (1) bears interest beginning on the day on which the charge is imposed, at a rate equal to the Bank’s overnight rate on that day, and ending on the day on which the amount is refunded or credited. Security safeguards A participating entity must implement the security safeguards that are provided for in the regulations. A participating entity must notify the Bank, as soon as feasible and in the manner specified by the Bank, of any change that has a significant impact on the participating entity’s compliance with the security safeguards. Designated officer or employee A participating entity must designate one of its officers or employees to be responsible for the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act. Mitigating harm A participating entity must establish policies and procedures to mitigate the harm to consumers that may result from a breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act. Report to Bank A participating entity must report to the Bank any breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act if the breach involves consumer data that is under the participating entity’s control. Report requirements The report must contain the information that is provided for in the regulations and must be made, in the form and manner specified by the Bank, immediately after the participating entity determines that a breach of the security safeguards has occurred. Notice to consumer Unless otherwise prohibited by law, a participating entity must notify a consumer of any breach of the security safeguards that involves the consumer’s data that is under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the consumer. Contents of notice The notice must contain sufficient information to allow the consumer to understand the significance of the breach to them and to take steps, if any are possible, to reduce the risk of harm that could result from the breach or to mitigate that harm. The notice must contain any other information that is provided for in the regulations. Manner of notice The notice must be conspicuous and must be given to the consumer in the manner provided for in the regulations. Timing of notice The notice must be given as soon as feasible after the participating entity determines that the breach has occurred. Definition of significant harm For the purposes of this section, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, of business or of professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property. Real risk of significant harm — factors The factors that are relevant to determining whether a breach of security safeguards creates a real risk of significant harm to a consumer include the sensitivity of the consumer data involved; the probability that the consumer data has been, is being or will be misused; and any other factor provided for in the regulations. Duty to investigate A participating entity must investigate every breach of the security safeguards that it implements with respect to the sharing of consumer data in accordance with this Act, for the purposes of identifying any significant, recurring or systemic problems and remedying the problems identified. The participating entity must report the conclusions of every investigation to the Bank in accordance with the regulations. If a participating entity identifies a significant, recurring or systemic problem that may have an impact on the consumer-driven banking system, the participating entity must, as soon as feasible, notify the Bank, which may then notify other participating entities. Express consent required A participating entity must obtain a consumer’s express consent before requesting that another participating entity provide it with the consumer’s data. Use not consent Use by the consumer of a product or service does not constitute express consent for the purposes of subsection (1). Oral consent — written confirmation If the express consent is given orally, the participating entity must immediately confirm the consumer’s express consent in writing. Information to consumer The participating entity must provide a consumer with the following information before obtaining the consumer’s express consent: a description of the data in respect of which it is seeking the consumer’s express consent; a description of how it will use the data; the period during which the consumer’s consent will be valid, which must not exceed the period referred to in section 86; and any other information that is provided for in the regulations.

Clear, simple and not misleading Any communication from a participating entity seeking to obtain a consumer’s express consent to have the participating entity receive the consumer’s data, including for the purposes of providing information under subsection (4), must be made in a manner, and using language, that is clear, simple and not misleading. Consent — use of data Subject to the regulations, a participating entity must use the data of a consumer that it receives from another participating entity only for the uses described in the information that is provided to the consumer under paragraph (4)(b). Use of data — product or service A participating entity must not require a consumer to consent to the sharing of the consumer’s data beyond what is necessary for the participating entity to provide the consumer with a product or service. Record of consent A participating entity must keep a record of each express consent obtained. Clarification Nothing in this section renders ineffective any federal or provincial legislative or regulatory provision requiring a participating entity that provides data to obtain a consumer’s express consent. Duration of consent A consumer’s express consent may be valid for a period of not more than 12 months after the day on which a participating entity obtains it. Renewal of consent A participating entity must renew a consumer’s express consent within seven days after the day on which the period for which the consumer’s consent was last obtained or renewed ends or within seven days after the day on which the participating entity becomes aware of any circumstance provided for in the regulations. Requirements Subsections 85(2) to (9) apply to a renewal of express consent. Suspension of receipt of data A participating entity that is required to renew a consumer’s express consent under subsection (1) must immediately stop receiving the consumer’s data until it has renewed the consumer’s consent to do so. If the participating entity fails to renew the consumer’s consent within the period referred to in subsection (1), it must, immediately after the end of the period, inform the consumer of the consequences of not renewing their consent; inform the consumer that they may request that the participating entity delete the data in respect of which consent was not renewed and of the manner in which that request may be made; and provide the consumer, in accordance with the regulations, with any information provided for in the regulations. Duty to delete data Unless otherwise prohibited by law and subject to the regulations, the participating entity must, at the request of the consumer, delete the data in respect of which consent was not renewed. Consent obtained by deception A participating entity must not obtain or renew, or attempt to obtain or renew, a consumer’s express consent by providing false or misleading information or using deceptive or misleading practices. Undue pressure or coercion A participating entity must not obtain or renew, or attempt to obtain or renew, a consumer’s express consent by imposing undue pressure on the consumer or coercing them. Withdrawal of consent A consumer may withdraw their consent, in whole or in part, by notifying the participating entity that obtained the consent. If the consumer notifies the participating entity of their intention to withdraw their consent, the participating entity must immediately inform the consumer of the consequences of withdrawing their consent; inform the consumer that they may request that the participating entity delete the data in respect of which consent was withdrawn and of the manner in which that request may be made; and Effect of withdrawal If the consumer confirms that they withdraw their consent after receiving the information referred to in subsection (2), the participating entity must, immediately or at any later date that is specified by the consumer, stop receiving the data in respect of which consent was withdrawn and notify the participating entity that was providing the data of the withdrawal of consent. Unless otherwise prohibited by law and subject to the regulations, the participating entity must, at the request of the consumer, delete the data in respect of which consent was withdrawn. Request to stop providing data A consumer may request that a participating entity stop providing their data, in whole or in part, to another participating entity. Duties If a consumer requests that a participating entity stop providing their data, the participating entity must immediately stop providing the consumer’s data in accordance with the request; inform the consumer that there might be consequences for stopping the provision of the data and that the consumer should contact the participating entity that was receiving the data; and inform the participating entity that was receiving the data that it has stopped providing the data at the consumer’s request. Authentication requirements Before providing a consumer’s data to another participating entity, a participating entity must confirm the consumer’s authentication information; the period for which the consumer’s express consent is valid; and the products and services in respect of which the data is to be provided. Prohibited conditions A participating entity must not, as a condition of providing a consumer’s data to another participating entity, require the consumer to consent to being provided with a product or service; or require the consumer to consent to the participating entity receiving their data from the other participating entity. In the circumstances and within the period provided for in the regulations, a participating entity that is providing a consumer’s data to another participating entity must request that the other participating entity renew the consumer’s express consent in accordance with section 87. Display of sign A participating entity must, in the form specified by the Bank, prominently display a sign indicating that it is a participating entity at each of the locations in Canada at which it offers services in accordance with this Act; and on the home page of each of its websites and on each application through which it offers services in accordance with this Act. Information in consumer dashboard A participating entity must, in a single location on its website or application, provide a consumer with up-to-date information about any other participating entities with which it is sharing the consumer’s data, the period for which the consumer’s consent to the sharing of their data is valid, and the data that is being shared; provide the consumer with the option to renew their consent, if applicable; and provide the consumer with the option to withdraw their consent or to request that their data stop being provided, as the case may be. A participating entity must provide consumers with information in a manner, and using language, that is clear, simple and not misleading. Principles of accessibility A participating entity must take principles of accessibility into account when providing consumers with information. Policies and procedures A participating entity must establish policies and procedures respecting the manner in which it provides consumers with information related to the activities that it performs under this Act. Review and evaluation The Bank must, from time to time, review and evaluate the policies and procedures referred to in subsection (3) to ensure that the participating entity is complying with this section. False or misleading information A participating entity must not provide false or misleading information to consumers or the public respecting the activities that it performs under this Act. Notice of change A participating entity must notify the Bank of any change provided for in the regulations that relates to the participating entity or the activities that it performs under this Act. The notice must be given as soon as feasible after the participating entity becomes aware of the change but before the change takes effect. However, if a different period is provided for in the regulations, the notice must be given within that period. Notice to Minister The Bank must, as soon as feasible, notify the Minister and any designated person or government authority of any notice given under subsection (1). Request for information A participating entity must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act. Annual reporting Following the end of its financial year, a participating entity must, within the time and in the form and manner specified by the Bank, submit a report to the Bank that includes the information that is provided for in the regulations. Policies and procedures — integrity or security A participating entity must establish policies and procedures to protect itself against threats to its integrity or security, including foreign interference, and must adhere to those policies and procedures. Duty to keep records A participating entity must keep all records that are provided for in the regulations. Consumer not liable Subject to the regulations, unless a consumer has demonstrated gross negligence or, in Quebec, gross fault, in safeguarding their authentication information, the consumer is not liable for any financial loss that arises directly from a loss of, unauthorized access to or unauthorized use of their data that occurs in relation to the sharing of data in accordance with this Act. Report If a consumer reports to a participating entity that their authentication information has been lost or stolen or is otherwise at risk of being used in an unauthorized manner, the consumer is not liable for any financial loss that is incurred, after the participating entity receives the report, as a result of the unauthorized use of their authentication information in relation to the sharing of data in accordance with this Act, unless the participating entity demonstrates, on a balance of probabilities, that the consumer contributed to the unauthorized use. Authentication information The unauthorized use of a consumer’s authentication information in relation to the sharing of data in accordance with this Act does not by itself establish that the consumer demonstrated gross negligence or, in Quebec, gross fault, in safeguarding their authentication information. Responsibility for safeguarding data A participating entity is responsible for safeguarding consumer data that is within its control in the course of the sharing of data between participating entities in accordance with this Act. Third-party service provider Consumer data continues to be within the control of a participating entity even if the participating entity uses a third-party service provider or an affiliate entity to perform its activities under this Act. Liability to consumer A participating entity is liable to a consumer for any financial loss that arises directly from a loss of, unauthorized access to or unauthorized use of the consumer’s data that results from a breach of the participating entity’s security safeguards that occurs in the course of the sharing of data in accordance with this Act. A participating entity remains liable to a consumer under subsection (3) even if it uses a third-party service provider or an affiliate entity to perform its activities under this Act. Procedures for dealing with complaints A participating entity must establish procedures that are satisfactory to the Bank for dealing with complaints; designate one of its officers or employees in Canada to be responsible for implementing those procedures; and designate one or more of its officers or employees in Canada to receive and deal with those complaints. Misleading terms A participating entity must not use any misleading term with respect to its procedures or designated officers or employees, including any term that suggests that the procedures, officers or employees are independent of the participating entity — such as the term “ombudsperson” or any other term with a similar meaning — or any term that is provided for in the regulations. A participating entity must provide the Bank with a copy of its most recent procedures, within the time and in the manner specified by the Bank. Information to complainant A participating entity must provide a person who makes a complaint with a written acknowledgment of the date on which it received the complaint; the information referred to in paragraphs 111(a) to (c); and any information that is necessary to enable the person to meet the requirements of the procedures referred to in paragraph 111(a). Time for dealing with complaint A participating entity must deal with a complaint within 56 days after the day on which it receives the complaint. Duty to inform complainant A participating entity must keep the person who made the complaint informed of the progress made in dealing with the complaint. Record of complaint A participating entity must, with respect to each complaint, make a record that is to be retained for at least five years and that contains in the case of a complaint made in writing, the original version of the complaint; in the case of a complaint made orally, the recording or a transcript of the recording, if the complaint was recorded, or the details of the complaint, if the complaint was not recorded; the name of the person who made the complaint; the name of the consumer whose data the complaint relates to, if the consumer is not the person who made the complaint; the contact information provided by the person who made the complaint; the date on which the participating entity received the complaint; a description of the nature of the complaint; the date on which the complaint was resolved, if, in the participating entity’s opinion, it was resolved to the satisfaction of the person who made the complaint; a description of any actions that the participating entity took to attempt to resolve the complaint; a description of any compensation provided to the person who made the complaint or to the consumer referred to in paragraph (d); confirmation that the participating entity provided the person who made the complaint with the information referred to in paragraphs 111(a) to (c), if it did so; and any other information provided for in the regulations. Access to Bank A participating entity must ensure that any record retained under section 108 is accessible to the Bank. Annual information Following the end of each financial year, a participating entity must, within the time and in the form and manner specified by the Bank, provide the Bank with the following information for that year: the number and nature of any complaints that were dealt with by the officer or employee designated by the participating entity to deal with complaints who holds the most senior position identified for that purpose in the procedures established by the participating entity; the average length of time taken to deal with the complaints received by that officer or employee; the number of complaints that, in the participating entity’s opinion, were resolved by that officer or employee to the satisfaction of the persons who made them; and Complaints procedures A participating entity must disclose to its consumers and the public its procedures for dealing with complaints established under paragraph 105(1)(a); the name of the external complaints body and the manner in which that body may be contacted; and the Bank’s mailing address, website address and telephone number. Disclosure — consumers and public A participating entity must disclose information to its consumers and the public under section 111 by displaying the information prominently at each of the locations in Canada at which it offers services in accordance with this Act, and on each of its websites and applications through which it offers services in accordance with this Act; and providing the information to any person who requests it, in a commonly used format that is acceptable to the person. The purpose of sections 114 to 118 is to enhance the process for dealing with complaints by establishing a regime composed of a sole external complaints body that performs its functions and activities in a transparent, effective, timely and fair manner based on the principles of accessibility, accountability, impartiality and independence. Designation of corporation The Minister may, on the recommendation of the Bank, designate a corporation incorporated under the Canada Not-for-profit Corporations Act or under a provincial Act equivalent to that Act to be the external complaints body responsible for dealing with complaints referred to in paragraph 105(1)(a) that have not been resolved by its member participating entities to the satisfaction of the persons who made the complaints or that have not been dealt with within the period set out in section 106. Matters for consideration Before designating a corporation, the Minister must take into account all factors that the Minister considers relevant, including whether the corporation has the reputation required under paragraph 115(a); and policies and procedures and terms of reference that would enable it to perform its functions and activities in a manner that is consistent with the purpose set out in section 113 and to comply with paragraphs 115(b) to (u). Obligation to be member Every participating entity must be a member of the external complaints body. Not agent of His Majesty The external complaints body is not an agent of His Majesty. Designation to be published A designation made under subsection (1) must be published in the Canada Gazette. The external complaints body must maintain a reputation for being operated in a manner that is consistent with the standards of good character and integrity; make its services available across Canada in both official languages and offer those services free of charge to persons who make complaints; establish policies, procedures and terms of reference that are satisfactory to the Bank with respect to, among other things, dealing with complaints and consulting, at least once a year, its member participating entities and consumers to allow them to raise concerns about the external complaints body; establish the manner of calculating, to the satisfaction of the Bank, the fees it charges to each of its member participating entities for its services; make information available to consumers about their rights and responsibilities in relation to the external complaints handling regime, respond to their inquiries and requests for information and offer them assistance in making complaints; inform the parties to a complaint about the external complaints body’s terms of reference and procedures for dealing with complaints and, on request, provide the parties with any additional information and assistance to enable them to understand the requirements of those terms of reference and procedures; deal with complaints in a manner that affects only the parties to the complaints; inform the Bank in writing within 30 days after the day on which the external complaints body determines that a complaint raises a potential systemic issue; if it determines that all or part of a complaint is not within its terms of reference, provide the person who made the complaint with written reasons for that determination and the name of any entity to which the person may make a complaint, within 30 days after the day on which it receives the complaint; obtain confirmation from the member participating entity to which each complaint relates regarding whether the period set out in section 106 has ended, unless the person who made the complaint has provided the external complaints body with the written acknowledgment referred to in paragraph 105(4)(a); impartially deal with complaints referred to in paragraph 105(1)(a) that have not been resolved by its member participating entities to the satisfaction of the persons who made the complaints or that have not been dealt with within the period set out in section 106; no later than 120 days after the day on which it has all of the information that it requires to deal with a complaint, make a final written recommendation to the parties; immediately inform the Bank, in writing, of cases in which a member participating entity does not comply with a final recommendation; within 90 days after making a final recommendation, make available on its website free of charge a summary of the final recommendation that includes a description of the nature of the complaint that is the subject of the final recommendation, the name of the member participating entity that received the complaint, a description of any compensation provided to the person who made the complaint or to the consumer referred to in paragraph 108(d), the reasons for the final recommendation, and any other information that is provided for in the regulations; within 60 days after the end of each quarter, submit to the Bank, in a form satisfactory to the Bank, in relation to all investigations completed during the quarter, a copy of the record of the complaint, and within 60 days after the end of each financial year, meet with the Bank to discuss, among other things, complaints, operations and market trends and issues respecting consumer-driven banking that have the potential to impact consumers; within 135 days after the end of each financial year, file with the Bank a written report on the performance of its functions and activities in respect of consumer-driven banking for that year, which report is to include information about its constitution, governance and terms of reference and the identity of its member participating entities, all sources of funding for its functions and activities, including the fees charged to each of its member participating entities for its services and the manner in which those fees are calculated, and the results of the most recent evaluation referred to in paragraph (s), a summary of the results of any consultation with its member participating entities and with persons who made complaints, in respect of each of its member participating entities, the number and nature of complaints that it received, the number of complaints that it determined were within its terms of reference, the number of final recommendations that it made and the number of complaints that, in its opinion, were resolved to the satisfaction of the persons who made them, the average length of time taken to deal with complaints, the number of complaints that it determined were not within its terms of reference and the reasons for that determination, the number of complaints for which a member participating entity did not comply with a final recommendation, the number of final recommendations in which compensation was recommended, and the average and total compensation provided with respect to complaints that it determined were within its terms of reference; immediately after the report referred to in paragraph (q) is filed with the Bank, make that report available on its website free of charge and provide any person who requests it with a copy; submit, every five years, to an evaluation of the performance of its functions and activities in respect of consumer-driven banking that is conducted, at the discretion of the Bank, by the Bank or a third party in accordance with terms of reference that the external complaints body establishes in consultation with the Bank; accept as a member any participating entity that makes a request to it for membership, other than a participating entity that is exempted or is a member of a class that is exempted under subsection 119(1); and meet any other requirements that are provided for in the regulations. Provision of information — external complaints body A participating entity must provide the external complaints body with all information in its possession or control that relates to a complaint immediately after the external complaints body notifies it that the complaint has been received. If a participating entity or the external complaints body is required under sections 105 to 116 to provide information, it must do so in a manner, and using language, that is clear, simple and not misleading. The external complaints body must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act. Minister’s order If the Minister is of the opinion that a participating entity is a member of or is otherwise supervised by — or that the members of a class of participating entities are members of or are otherwise supervised by — a body that exercises powers and performs duties and functions that are substantially similar to those that are conferred on the external complaints body under this Act, the Minister may, by order, exempt the participating entity or the class of participating entities from the application of subsection 114(3). Effect of order A participating entity that is exempted or is a member of a class that is exempted under subsection (1) must not be a member of the external complaints body for the purposes of this Act and the provisions of this Act respecting the external complaints body do not apply in respect of the participating entity or class. An accredited third-party service provider must notify the Bank of any change provided for in the regulations that relates to the accredited third-party service provider or the activities for which it is accredited. The notice must be given as soon as feasible after the accredited third-party service provider becomes aware of the change but before the change takes effect. However, if a different period is provided for in the regulations, the notice must be given within that period. An accredited third-party service provider must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act. An accredited third-party service provider must keep all records that are provided for in the regulations. Disclosure — employee of participating entity An employee of a participating entity who has reasonable grounds to believe that the participating entity or any individual or other entity has committed or intends to commit a wrongdoing may report the particulars of the matter to the Bank, a government authority, a regulatory body or a law enforcement agency. Disclosure — employee of technical standards body An employee of the technical standards body who has reasonable grounds to believe that the technical standards body or any individual or other entity has committed or intends to commit a wrongdoing may report the particulars of the matter to the Bank, a government authority, a regulatory body or a law enforcement agency. Confidentiality The Bank, government authority, regulatory body or law enforcement agency must keep confidential the identity of the employee and any information that could reasonably be expected to reveal their identity. Exception — investigation Despite subsection (3), the Bank, government authority, regulatory body or law enforcement agency may disclose to one another the employee’s identity and information that could reasonably be expected to reveal the employee’s identity for purposes related to an investigation. If the Bank, government authority, regulatory body or law enforcement agency discloses the identity of the employee or information under subsection (4), they must make every reasonable effort to inform the employee of the disclosure. Definition of wrongdoing In this section, wrongdoing means a contravention of this Act or the regulations and, with respect to a participating entity, a contravention of a policy or procedure established by the participating entity in relation to its compliance with this Act. At the request of a provincial minister who has responsibilities that are similar to those of the Minister, the Minister may, by order, designate a department or agency of a province to, in the place of the Bank, supervise a participating entity that is a provincial financial institution or a class of participating entities that are provincial financial institutions for the purposes of any of sections 79 to 93, 95 to 97 and 103 to 112. Provisions and participating entities In the order, the Minister must specify the provisions, from among those referred to in subsection (1), to which the designation relates and the participating entity or class of participating entities in respect of which it applies. Agreement or arrangement The Minister may only make an order if the Bank has entered into an agreement or arrangement with the department or agency of a province respecting the sharing of information and the supervision of participating entities. Revocation The Minister may revoke an order made under subsection (1) and must do so at the request of the provincial minister referred to in that subsection. Designation of body The Minister may, by order, designate a body to be the technical standards body that is responsible for establishing the technical standard that is to be used for the sharing of data by participating entities in accordance with this Act. Factors In designating the technical standards body, the Minister must take into account the following factors: the need to ensure the safe, secure and efficient sharing of data among participating entities; fairness, accessibility, transparency and good governance; whether the body is incorporated, formed or otherwise organized in Canada; the independence of the body in exercising its powers and performing its duties and functions; the body’s ability to exercise its powers and perform its duties and functions in a manner that is consistent with the purposes of this Act; any other factor that the Minister considers relevant; and Publication in Canada Gazette The Minister must publish the order in the Canada Gazette. The Minister must review the designation every three years. The Minister may, by order, revoke the designation, including in the following circumstances: the Bank advises the Minister to do so; the Minister is of the opinion that the designation is no longer consistent with any factor referred to in subsection 125(2); the Minister is of the opinion that the designation poses a risk to national security; or the Minister is of the opinion that the designation poses a risk to the integrity or security of the financial system in Canada. Annual report The technical standards body must submit an annual report to the Bank in accordance with the regulations. Change that has significant impact The technical standards body must notify the Bank of any change that has a significant impact on the technical standards body or the technical standards, including any change to the operation of the technical standard referred to in subsection 125(1) or the governance, composition or decision making of the technical standards body, as soon as feasible but no later than the seventh day after the day on which the change takes effect. The technical standards body must, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank requires for a purpose related to verifying compliance with this Act. Information obtained by Bank Subject to subsections (2) and (3), information that is obtained under this Act by the Bank, and any information prepared from that information, is confidential and must be treated accordingly. Disclosure permitted The Bank may disclose information that is obtained under this Act if it is required to make the information public under subsection 7(1) or section 44 or if it does so under subsection 7(2) or section 168. Disclosure permitted — government authority or regulatory body The Bank may disclose information that is obtained under this Act to the Minister or to any government authority or regulatory body that agrees to treat the information as confidential. Information obtained by Minister Subject to subsection (2), information that is obtained under this Act by the Minister or by a designated person or government authority, and any information prepared from that information, is confidential and must be treated accordingly. The Minister or the designated person or government authority may disclose information that is obtained under this Act to a government authority or regulatory body that agrees to treat the information as confidential. Evidentiary privilege Information provided for in the regulations that relates to the supervision of participating entities or accredited third-party service providers under this Act must not be used as evidence in any civil proceedings and is privileged for that purpose. No testimony or production An individual or entity must not by an order of any court, tribunal or other body be required in any civil proceedings to give oral testimony or to produce any document relating to any information referred to in subsection (1). Exception to subsection (1) Despite subsection (1), the Minister, the Governor, the Bank or the Attorney General of Canada may, in accordance with the regulations, use information referred to in that subsection as evidence in any proceedings. Despite subsection (1), a participating entity or accredited third-party service provider may, in accordance with the regulations, use information referred to in that subsection as evidence in any proceedings in relation to the administration or enforcement of this Act, the Bankruptcy and Insolvency Act or the Companies’ Creditors Arrangement Act that are commenced by the participating entity, the accredited third-party service provider, the Minister, the Governor, the Bank or the Attorney General of Canada. Exceptions to subsections (1) and (2) Despite subsections (1) and (2), a court, tribunal or other body may, by order, require the Minister, the Governor, the Bank, a participating entity or an accredited third-party service provider to give oral testimony or produce any document relating to any information referred to in subsection (1) in any civil proceedings in relation to the administration or enforcement of this Act that are commenced by the Minister, the Governor, the Bank, the Attorney General of Canada, a participating entity or an accredited third-party service provider. No waiver The disclosure of any information referred to in subsection (1), other than under subsection (3), (4) or (5), does not constitute a waiver of the privilege referred to in subsection (1). Advisory and other committees The Bank may establish advisory and other committees to advise or assist the Bank on matters relating to consumer-driven banking and may provide for their membership, duties, functions and operation. Remuneration and expenses Members of a committee may be paid for their services the remuneration and expenses that the Bank may determine. Advisory committee There is established an advisory committee to provide advice to the Minister and the Bank on matters relating to consumer-driven banking. The advisory committee consists of one representative appointed by the Minister; one or two representatives designated by each province; and one representative designated by the Bank. Co-chairperson — Minister The representative appointed by the Minister is a co-chairperson of the advisory committee. Co-chairperson — provincial representative The other co-chairperson is to be chosen, from among the members who are designated by the provinces, by those members to hold office for a one-year term. That co-chairperson is not authorized to hold that office for consecutive terms. Co-chairperson absent or unable to act If the co-chairperson chosen under subsection (3) is absent or unable to act, the members who are designated by the provinces may choose another one of those members to act as co-chairperson. The advisory committee must report, at least once every calendar year, to the Minister and the relevant provincial ministers who have responsibilities that are similar to those of the Minister. No liability — Bank No action lies against His Majesty, any officer, employee or director of the Bank or any person acting under the direction of the Governor for anything done or omitted to be done in good faith in the administration or discharge of any powers, duties or functions that under this Act are intended or authorized to be exercised or performed. No liability — Minister No action lies against His Majesty, the Minister, any designated person or government authority or any person acting under the direction of the Minister for anything done or omitted to be done in good faith in the administration or discharge of any powers, duties or functions that under this Act are intended or authorized to be exercised or performed. Not compellable — Bank An officer, employee or director of the Bank or any person acting under the instructions of the Governor is not a compellable witness in any civil proceedings in respect of any matter coming to their knowledge as a result of exercising any of their powers or performing any of their duties or functions under this Act. Not compellable — Minister The Minister, a designated person or government authority or any person acting under the instructions of the Minister or the designated person or government authority is not a compellable witness in any civil proceedings in respect of any matter coming to their knowledge as a result of exercising any of their powers or performing any of their duties or functions under this Act. Bank to ascertain expenses The Bank must, before September 30 of each year, ascertain the total amount of expenses incurred by it during the immediately preceding calendar year for or in connection with the administration of this Act and deduct from that amount any accreditation fees paid to it in that preceding calendar year. Amount conclusive The amount ascertained is final and conclusive for the purposes of this section. Assessment As soon as feasible after ascertaining the amount, the Bank must, in the manner and to the extent provided for in the regulations, assess a portion of the total amount of expenses against each participating entity, each accredited third-party service provider and the external complaints body, in accordance with the regulations. Interim assessment The Bank may, during each calendar year, prepare an interim assessment against any participating entity, any accredited third-party service provider or the external complaints body. Assessment binding Every assessment and interim assessment is final and conclusive and binding on the participating entity or accredited third-party service provider against which it is made or the external complaints body. Recovery Every assessment and interim assessment constitutes a debt due to the Bank, is immediately payable and may be recovered as a debt in any court of competent jurisdiction. Interest may be charged on the unpaid amount of an assessment or interim assessment at a rate equal to the rate prescribed under the Income Tax Act for amounts payable by the Minister of National Revenue as refunds of overpayments of tax under that Act in effect from time to time plus 2%. The Bank may request in writing that a participating entity, an accredited third-party service provider or the external complaints body provide the Bank, within the period provided for in the regulations, with any information that the Bank considers necessary for the purposes of subsection 140(3) or (4). Compliance with request The participating entity, accredited third-party service provider or external complaints body must comply with the request. The Bank may request in writing that an individual or entity, within the time and in the manner specified by the Bank, provide the Bank with any information that the Bank considers necessary for a purpose related to verifying compliance with an undertaking required under section 55 or terms and conditions imposed under section 56. The individual or entity must comply with the request. Examination and inquiry The Bank must, from time to time, make or cause to be made any examination and inquiry that the Bank considers necessary for the purposes of satisfying the Bank that participating entities, accredited third-party service providers, the external complaints body and the technical standards body are complying with this Act and, after the conclusion of each examination and inquiry, must report on it to the Minister. Access to records For the purposes of this section, the Bank has a right of access to any records of a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body; and may require the directors or officers of a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body to provide information and explanations, to the extent that they are reasonably able to do so, in respect of any matter subject to examination or inquiry under this section. Special audit The Bank may direct that a special audit of a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body be conducted, in accordance with any conditions that the Bank considers appropriate, if the Bank is of the opinion that the special audit is necessary for a purpose related to verifying compliance with this Act. The Bank may appoint an individual or entity to conduct the special audit. Duty to assist The participating entity, accredited third-party service provider, external complaints body or technical standards body must give all assistance that is reasonably required to enable the appointed individual or entity to conduct the special audit and must provide any documents or information, and access to any data, that are specified by the individual or entity. If a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body is the subject of a special audit, it must provide the Bank with the results of the audit. Expenses payable The expenses incurred in respect of any special audit are payable by the participating entity, accredited third-party service provider, external complaints body or technical standards body that is the subject of the audit. If the Bank makes or causes to be made any examination, inquiry or audit in respect of a participating entity that is a provincial financial institution, the Bank must, as soon as feasible, notify the appropriate provincial authority that regulates or supervises the provincial financial institution. The Governor may designate persons or classes of persons as authorized persons for the purposes of sections 145 and 146. Powers — authorized person An authorized person may, from time to time, examine the records and inquire into the business and affairs of a participating entity for the purpose of verifying compliance with this Act and for that purpose may enter any place in which the authorized person has reasonable grounds to believe that there are records relevant to verifying compliance with this Act; use any computer system in the place, or cause it to be used, to examine data contained in or available to it; reproduce any record or cause any record to be reproduced from the data, in the form of a printout or other intelligible output and remove the printout or other output for examination or copying; or use any copying equipment in the place or cause it to be used. The owner or person in charge of the place and every person in the place must give all assistance that is reasonably required to enable the authorized person to perform their functions under this section and must provide any documents or information, and access to any data, that are specified by the authorized person. Warrant to enter dwelling-house If the place is a dwelling-house, an authorized person may enter it without the occupant’s consent only under the authority of a warrant issued under subsection (2). Authority to issue warrant On ex parte application, a justice of the peace may issue a warrant authorizing an authorized person to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice is satisfied by information on oath that the dwelling-house is a place referred to in paragraph 145(1)(a); entry to the dwelling-house is necessary for a purpose related to verifying compliance with this Act; and entry was refused by the occupant or there are reasonable grounds to believe that entry will be refused by, or that consent to entry cannot be obtained from, the occupant. Compliance agreement The Bank may enter into a compliance agreement with a participating entity, an accredited third-party service provider, the external complaints body or the technical standards body for the purpose of implementing any measure that is designed to further its compliance with this Act. Directions — participating entity If, in the Bank’s opinion, a participating entity, or another entity or individual in conducting the business or affairs of the participating entity, fails to comply — or there are reasonable grounds to believe that the participating entity or the entity or individual will fail to comply — with a compliance agreement, the Bank may direct the participating entity or the entity or individual to comply with the compliance agreement and to take any measures that in the Bank’s opinion are necessary to do so. Directions — policies and procedures If, in the Bank’s opinion, a participating entity does not have adequate policies and procedures to protect itself against threats to its integrity or security or a participating entity is not adhering to its policies and procedures in that matter, the Bank may direct the participating entity to take any measures that in the Bank’s opinion are necessary to remedy the situation. Directions — accredited third-party service provider If, in the Bank’s opinion, an accredited third-party service provider, or another entity or individual in conducting the business or affairs of the accredited third-party service provider, fails to comply — or there are reasonable grounds to believe that the accredited third-party service provider or the entity or individual will fail to comply — with a compliance agreement, the Bank may direct the accredited third-party service provider or the entity or individual to comply with the compliance agreement and to take any measures that in the Bank’s opinion are necessary to do so. Directions — external complaints body If, in the Bank’s opinion, the external complaints body fails, or there are reasonable grounds to believe that it will fail, to comply with a compliance agreement or any of paragraphs 115(b) to (u) or to perform its functions and activities in a manner that is consistent with the purpose set out in section 113, the Bank may direct the external complaints body to comply, to so perform its functions and activities and to take any measures that in the Bank’s opinion are necessary to do so. Directions — technical standards body If, in the Bank’s opinion, the technical standards body fails to comply, or there are reasonable grounds to believe that it will fail to comply, with a compliance agreement, the Bank may direct the technical standards body to comply and to take any measures that in the Bank’s opinion are necessary to do so.

Subject to subsection (7), the Bank must not make a direction under any of subsections (1) to (5) unless the participating entity, accredited third-party service provider, entity or individual in question or the external complaints body or technical standards body is provided with an opportunity to make representations in respect of the matter. Temporary direction If, in the Bank’s opinion, the length of time required for representations might be prejudicial to the public interest, the Bank may make a temporary direction with respect to the matters referred to in any of subsections (1) to (5) that has effect for a period of not more than 15 days. Continued effect A temporary direction continues to have effect after the end of the 15-day period if no representations are made to the Bank within that period or, if representations have been made, the Bank notifies the participating entity, accredited third-party service provider, entity or individual, external complaints body or technical standards body that the Bank is not satisfied that there are sufficient grounds for revoking the direction. Court enforcement — participating entity If a participating entity, or another entity or individual in conducting the business or affairs of the participating entity, fails to comply with a compliance agreement or a direction made under section 148, contravenes a provision of this Act or the regulations or omits to do any thing that is required to be done under this Act, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the participating entity, entity or individual to comply with the compliance agreement or the direction, cease the contravention or do any thing that is required to be done. The court may make the order and any other order that it thinks fit. Court enforcement — accredited third-party service provider If an accredited third-party service provider, or another entity or individual in conducting the business or affairs of the accredited third-party service provider, fails to comply with a compliance agreement or a direction made under section 148, contravenes a provision of this Act or the regulations or omits to do any thing that is required to be done under this Act, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the accredited third-party service provider, entity or individual to comply with the compliance agreement or the direction, cease the contravention or do any thing that is required to be done. The court may make the order and any other order that it thinks fit. Court enforcement — external complaints body If the external complaints body fails to comply with a compliance agreement, any of paragraphs 115(b) to (u) or a direction made under section 148, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the external complaints body to comply with the compliance agreement, the paragraph or the direction. The court may make the order and any other order that it thinks fit. Court enforcement — technical standards body If the technical standards body fails to comply with a compliance agreement or a direction made under section 148, the Bank may, in addition to any other action that may be taken under this Act, apply to a court for an order requiring the technical standards body to comply with the compliance agreement or the direction. The court may make the order and any other order that it thinks fit. An appeal from a decision of a court under this section lies in the same manner and to the same court as an appeal from any other order of the court. If, in the Bank’s opinion, an individual or entity fails to comply, or there are reasonable grounds to believe that an individual or entity will fail to comply, with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3), the Bank must immediately notify the Minister. The Minister may designate persons or classes of persons as authorized persons for the purposes of sections 152 to 154. An authorized person may request in writing that an individual or entity, within the time and in the manner specified by the authorized person, provide the authorized person with any information that the authorized person considers necessary for a purpose related to verifying compliance with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3). An authorized person may, from time to time, examine the records and inquire into the business and affairs of an individual or entity for the purpose of verifying compliance with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3) and for that purpose may enter any place in which the authorized person has reasonable grounds to believe that there are records relevant to verifying compliance with the undertaking, terms and conditions or order; the dwelling-house is a place referred to in paragraph 153(1)(a); entry to the dwelling-house is necessary for a purpose related to verifying compliance with an undertaking required under section 55, terms and conditions imposed under section 56 or an order made under subsection 60(1) or (3); and Regulations The Governor in Council may make regulations designating as a violation the contravention of a specified provision of this Act or of the regulations or the non-compliance with orders made, undertakings required, compliance agreements entered into or directions made under this Act; establishing, having regard to subsection (2), a penalty or a range of penalties in respect of a violation; respecting the service of documents under sections 156 to 168, including the manner and proof of service and the circumstances under which documents are considered to be served; providing for the circumstances in which the Bank must not make public, under subsection 168(1), the name of the individual or entity that committed the violation; and generally, for carrying out the purposes and provisions of this section and sections 156 to 168. Maximum penalties The maximum penalty for a violation is $1,000,000 if the violation is committed by an individual and $10,000,000 if the violation is committed by a participating entity or accredited third-party service provider. Criteria for penalty Except if a penalty is fixed under paragraph 155(1)(b), the amount of a penalty must, in each case, be determined taking into account the degree of intention or negligence on the part of the individual or entity that committed the violation; the harm done by the violation; the duration of the violation; the ability of the individual or entity that committed the violation to pay the penalty; the history of the individual or entity that committed the violation with respect to any prior violation or conviction under this Act within the five-year period immediately before the violation; and any other criteria that may be provided for in the regulations. Purpose of penalty The purpose of a penalty is to promote compliance with this Act and not to punish. Violation or offence If a contravention or non-compliance that is designated under paragraph 155(1)(a) can be proceeded with either as a violation or as an offence, proceeding in one manner precludes proceeding in the other. Commission of violation Every contravention or non-compliance that is designated under paragraph 155(1)(a) constitutes a violation and the individual or entity that commits the violation is liable to a penalty determined in accordance with sections 155 and 156. Notice of violation If the Bank believes on reasonable grounds that an individual or entity has committed a violation, the Bank may issue a notice of violation and, in that case, must cause it to be served on the individual or entity. A notice of violation must name the individual or entity believed to have committed a violation, identify the violation and set out the penalty that the Bank proposes to impose; the right of the individual or entity, within 30 days after the day on which the notice is served or within any longer period that the Bank specifies, to pay the penalty or to make representations to the Governor with respect to the violation and the proposed penalty, and the manner for doing so; and the fact that, if the individual or entity does not pay the penalty or make representations in accordance with the notice, the individual or entity will be deemed to have committed the violation and the Bank may impose a penalty in respect of it. Payment If the individual or entity pays the penalty proposed in the notice of violation, the individual or entity is deemed to have committed the violation and proceedings in respect of it are ended. Representations to Governor If the individual or entity makes representations in accordance with the notice, the Governor must decide, on a balance of probabilities, whether the individual or entity committed the violation and, if so, may, subject to any regulations made under paragraph 155(1)(b), impose the penalty proposed in the notice, a lesser penalty or no penalty. Failure to pay or make representations An individual or entity that neither pays the penalty nor makes representations in accordance with the notice is deemed to have committed the violation and the Bank may, subject to any regulations made under paragraph 155(1)(b), impose the penalty proposed in the notice, a lesser penalty or no penalty. Notice — decision and right of appeal The Bank must cause notice of any decision made under subsection (2) or (3) to be issued and served on the individual or entity together with notice of the right of appeal under section 161. An individual or entity on which a notice under subsection 160(4) is served may, within 30 days after the day on which the notice is served or within any longer period that the Court allows, appeal the decision to the Federal Court. Court to take precautions against disclosing In an appeal, the Federal Court must take every reasonable precaution, including, if appropriate, conducting hearings in private, to avoid the disclosure by the Court or any person of confidential information referred to in section 131. Powers of Court On an appeal, the Federal Court may confirm, set aside or, subject to any regulations made under paragraph 155(1)(b), vary the decision. Debts to His Majesty A penalty constitutes a debt due to His Majesty in right of Canada that may be recovered in the Federal Court. Limitation period or prescription No proceedings to recover a debt referred to in subsection (1) may be commenced later than five years after the day on which the debt becomes payable. Receiver General A debt referred to in subsection (1) is payable to and must be remitted to the Receiver General. Certificate of default The unpaid amount of any debt referred to in subsection 162(1) may be certified by the Governor. Registration in Federal Court Registration in the Federal Court of a certificate has the same effect as a judgment of that Court for a debt of the amount specified in the certificate and all related registration costs. Violations not offences For greater certainty, a violation is not an offence and, accordingly, section 126 of the Criminal Code does not apply in respect of a violation. Due diligence available Due diligence is a defence in a proceeding in relation to a violation. Common law principles Every rule and principle of the common law that makes any circumstance a justification or excuse in relation to a charge for an offence applies in respect of a violation to the extent that it is not inconsistent with this Act. Admissibility In a proceeding in respect of a violation or a prosecution for an offence, a notice purporting to be issued under subsection 159(2) or 160(4) or a certificate purporting to be made under subsection 163(1) is admissible in evidence without proof of the signature or official character of the person appearing to have signed it. No proceedings in respect of a violation may be commenced later than two years after the day on which the subject matter of the proceedings became known to the Bank. Certificate A document appearing to have been issued by the Bank, certifying the day on which the subject matter of any proceedings became known to the Bank, is admissible in evidence without proof of the signature or official character of the person appearing to have signed the document and is, in the absence of evidence to the contrary, proof of the matter asserted in it. Publication Subject to any regulations, the Bank must make public the nature of a violation, the name of the individual or entity that committed it and the amount of the penalty imposed. Publication — reasons In making public the nature of a violation, the Bank may include the reasons for the decision, including the relevant facts, analysis and considerations that formed part of the decision. Use of phrase A participating entity, an accredited third-party service provider and the technical standards body are authorized to use the phrase “consumer-driven banking” to indicate or describe the activities that they perform under this Act. Claiming to be participating entity An individual or entity, other than a participating entity, must not use the term “participating entity” or a variation, abbreviation or equivalent of that term, or any words, name or designation — in any language — in a manner that leads to a reasonable belief that the individual or entity is a participating entity for the purposes of this Act; or represent themselves, in any way or by any means, to be a participating entity for the purposes of this Act. Screen scraping Subject to the regulations, an individual or entity must not, for the purposes of providing a consumer in Canada with a product or service, use an interface or application to gain direct access to the consumer’s data using the consumer’s authentication information. An individual or entity must not knowingly provide false or misleading information in relation to their participation under this Act. An individual or entity must not provide false or misleading information to the Bank, the Minister or a designated person or government authority. Offence Every individual or entity commits an offence that contravenes a provision of this Act, other than section 172, or of the regulations; fails to comply with an order made under section 55 or an undertaking required under that section; fails to comply with an order made under section 56 or subsection 60(1) or (3) or 61(1) or (3); fails to comply with a compliance agreement entered into under section 147; or fails to comply with a direction made under section 148. Offence — section 172 Every individual or entity that contravenes section 172 commits an offence. Penalty Every individual or entity that commits an offence under subsection (1) or (2) is liable on conviction on indictment, in the case of an individual, to a fine of not more than $1,000,000 or to imprisonment for a term of not more than five years, or to both, or in the case of an entity, to a fine of not more than $5,000,000; or on summary conviction, in the case of an individual, to a fine of not more than $100,000 or to imprisonment for a term of not more than one year, or to both, or in the case of an entity, to a fine of not more than $500,000. Due diligence defence An individual or entity is not to be found guilty of an offence under subsection (1) if they establish that they exercised due diligence to prevent the commission of the offence. Order to comply If an individual or entity is convicted of an offence under this Act, the court may, in addition to any punishment that it may otherwise impose, order the individual or entity to comply with the provisions of this Act or of the regulations in respect of which the individual or entity was convicted. Additional fine If an individual or entity is convicted of an offence under this Act, the court may, if it is satisfied that as a result of the commission of the offence the convicted individual or entity acquired any monetary benefits or that monetary benefits accrued to the convicted individual or entity or the individual’s spouse, common-law partner or other dependant, order the convicted individual or entity to pay, despite the maximum amount of any fine that may otherwise be imposed under this Act, an additional fine in an amount equal to three times the court’s estimation of the amount of those monetary benefits. Party to offence If an entity commits an offence under this Act, any director, any officer, any agent or mandatary or any principal officer of the entity who directed, authorized, assented to, acquiesced in or participated in the commission of the offence is a party to and guilty of the offence and is liable on summary conviction or on conviction on indictment to the punishment provided for an individual in respect of the offence, whether or not the entity has been prosecuted or convicted. Limitation period Proceedings by way of summary conviction in respect of an offence under this Act may be commenced at any time within, but not later than, two years after the day on which the subject matter of the proceedings became known to the Bank. The Governor in Council may, on the recommendation of the Minister, make regulations generally for carrying out the purposes and provisions of this Act and, in particular, may make regulations specifying the data that is excluded from the definition derived data in section 2; respecting accreditation; respecting fees for accreditation; respecting notifications and the provision of information in the case of the revocation of a participating entity’s or accredited third-party service provider’s accreditation; respecting the registry referred to in section 44; respecting the sharing of data under section 76 and providing for exceptions to the duty to share and to the prohibition on imposing conditions set out in that section; respecting security safeguards to be implemented for the purposes of section 79; respecting designations under section 80; respecting reports made and notices given under section 82; respecting the duty to investigate and report under section 83; respecting the express consent that must be obtained under section 85; respecting the information to be provided under subsection 85(4); respecting exceptions to the duty set out in subsection 85(6); respecting the record that must be kept under subsection 85(8); respecting the renewal of consent under subsection 87(1), providing for the circumstances referred to in that subsection and respecting the information to be provided under paragraph 87(4)(c); exempting participating entities, for the purposes of subsection 87(2), from any requirements under subsection 85(4); respecting exceptions to the duty set out in subsection 87(5); respecting the notice of withdrawal of consent referred to in subsection 90(1) and the information to be provided under paragraph 90(2)(c); respecting exceptions to the duty set out in subsection 90(4); respecting the duty set out in subsection 92(1); respecting the display of a sign under section 94; respecting the duties set out in section 96; respecting the duty to keep records under section 102; respecting the liability of consumers and participating entities under subsection 103(1); respecting the duties set out in subsection 105(4) or section 111; respecting the duty to keep records under section 122; respecting the annual report referred to in section 128, including the information that is to be included in the report and the form and manner in which, and the time within which, it is to be submitted; respecting the circumstances in which information referred to in subsection 133(1) may be used as evidence; respecting exceptions to the prohibition set out in section 171; and providing for anything that by this Act is to be provided for in the regulations. Statutory Instruments Act The Statutory Instruments Act does not apply in respect of an order made under any of subsections 13(1) to (3); a notice given under section 25; a notice given under section 38; a directive issued under section 51; an order made under any of sections 55 to 57; an order made under subsection 60(1) or (3) or 61(1) or (3); a notice issued under subsection 66(1); a directive issued under subsection 67(2) or (7) or section 68; a designation made under subsection 114(1); an order made under subsection 119(1); an order made under subsection 124(1); an order made under subsection 125(1) or 127(1); or a direction made under section 148. No later than the third anniversary of the day on which this section comes into force, and every five years after that, the Minister must cause a review of this Act and its operation to be commenced. Order in council The provisions of this Act, other than sections 1 to 9, 13, 14, 74 and 113, subsections 114(1), (2), (4) and (5), paragraph 115(a) and sections 117 to 119, 123 to 132, 136 to 139, 143, 147 to 149, 169, 170 and 172 to 179, come into force on a day or days to be fixed by order of the Governor in Council. [Note: The provisions of this Act, other than sections 1 to 9, 13, 14, 74 and 113, subsections 114(1), (2), (4) and (5), paragraph 115(a) and sections 117 to 119, 123 to 132, 136 to 139, 143, 147 to 149, 169, 170 and 172 to 179, not in force.]