Canada

Covered entities (listed on a Canadian stock exchange, or with a place of business, doing business or holding assets in Canada, and meeting two of three thresholds: $20 million in assets, $40 million in revenue, or 250 employees) must report to the Minister of Public Safety on steps taken in the previous financial year to reduce the risk of forced or child labour in their operations and supply chains.

Sections 3.5 to 3.8 of the Quebec private-sector privacy Act require an enterprise that has cause to believe a confidentiality incident has occurred to take reasonable measures to reduce the risk of injury and, where there is a risk of serious injury, to promptly notify the Commission d'accès à l'information and the persons concerned (s. 3.5). Section 3.8 requires a register of incidents, a copy of which goes to the Commission on request. The section sets no fixed deadline.

The OPC lists ten principles that private-sector organisations must follow: accountability (including naming a person responsible), identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. On request, individuals can learn what information is held, access it and ask for corrections.

PCMLTFA s. 9.6(1) and PCMLTFR s. 156(1) require a compliance programme with a compliance officer (para. 156(1)(a)), written policies and procedures kept up to date (para. 156(1)(b)), a documented risk assessment (para. 156(1)(c), s. 156(2)), a training programme and plan (paras. 156(1)(d)-(e)) and a two-year effectiveness review (para. 156(1)(f)). Each effectiveness review must start no later than 24 months after the previous one began (subss. 156(3)-(4)), and written findings go to a senior officer within 30 days after the review is completed.

Disclosures are annual and are expected to be published publicly within 180 days after fiscal year-end, with prior-period disclosures archived. Expectations phase in for fiscal periods ending on or after 1 October 2024, 2025 or 2026 depending on the item and institution type; some items are still to be determined. This is a guideline expectation, and OSFI is updating B-15 for the final CSSB standards.

OSFI's detailed instructions require a technology or cyber security incident to be reported within 24 hours, or sooner if possible, to the Technology Risk Division and the lead supervisor. The page lists banks, foreign bank branches, life, fraternal and property and casualty insurers and trust and loan companies. This is a supervisory expectation set by guidance.

RPAA s. 17 requires a risk management and incident response framework and s. 18 requires notice of incidents that materially affect end users, other providers or a clearing house. The Bank's reminder states the initial notice is due without delay and no later than 48 hours after the provider determines the incident is material, with a final notice once cause and impact are known.

RPAA s. 23 requires a payment service provider to be registered with the Bank before it performs any retail payment activities. The Bank keeps a public PSP registry.

RPAA s. 20 requires a provider that holds end-user funds to hold them in a trust account used for no other purpose, in a prescribed account or manner, or in a dedicated account backed by insurance or a guarantee at least equal to the balance. No set-off may be claimed against the funds (s. 20(3)). The Bank says the safeguarding framework requirement applies from 8 September 2025.

A report is due when a reporting entity receives virtual currency worth $10,000 or more in a single transaction, or two or more amounts totalling $10,000 or more within 24 consecutive hours that it knows are by or for the same person or beneficiary (PCMLTFR s. 129(1)). Paragraph 30(1)(f) and s. 7(1)(d) are among the provisions cited for this report.

PCMLTFA s. 9.5 and PCMLTFR ss. 124 (electronic funds transfers) and 124.1 (virtual currency transfers) require originator and beneficiary name, address and account or reference number to accompany the transfer. Recipients and intermediaries must take reasonable measures to confirm the information is included, and must have risk-based written policies for transfers where it is missing.