Canada is moving to close long criticized information-sharing gaps in its AML regime. Alongside steps to strengthen public-private channels flagged by the 2022 Cullen Commission, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) has now published guidance enabling private-to-private sharing under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA s.11.01) for reporting entities that join an approved code of practice.

FINTRAC explained that reporting entities may exchange certain personal information, without the individual’s knowledge or consent, with other reporting entities to detect or deter money laundering, terrorist financing, and sanctions evasion within a code of practice approved by the Office of the Privacy Commissioner of Canada (OPC) and submitted to FINTRAC.

Participation in the information sharing regime is voluntary and limited to reporting entities. Stakeholders have long been interested in the ability to freely share information about potential threats in situations where seeking consent would risk compromising the investigation.

Codes of practice and regulatory approval

According to the guidance, information sharing cannot occur until participating firms establish and implement a code of practice describing participants (legal names and FINTRAC reporting entity numbers), the categories of personal information that may be disclosed/collected/used, the purposes and methods of sharing, and the safeguards, retention, and recordkeeping procedures in place.

The code must demonstrate protections equal to or stronger than the Personal Information Protection and Electronic Documents Act (PIPEDA).

Boundaries and limitations

Only reporting entities may share information, and only with other reporting entities that are participants in the same approved code. The information must have been collected during the entity’s activities, and sharing without consent is only allowed when seeking consent would risk compromising detection.

Sharing must also be reasonable for the detection of money laundering, terrorist financing and sanctions evasion. Financial entities, life insurers, and securities dealers that have intra-affiliate exchange duties under PCMFTFA s.9.8, do not require a code, the guidance noted.