Federal Financial Institutions Legislative and Regulatory Reporter – June 2026

Published

Title and Brief Summary

Status (if applicable)

Office of the Superintendent of Financial Institutions (OSFI)

June 25, 2026

Streamlined Approvals Framework for Targeted New Entrants

OSFI has launched a streamlined approvals framework for targeted new entrants. It is intended to give eligible new entrants, including entities with innovative or emerging banking models and credit unions, a quicker, clearer, and more predictable path to becoming federally regulated financial institutions.

The new framework would move applicants through three phases, from an early readiness assessment to ministerial approval and commencement of operations. Each phase has a defined timeline. A public dashboard will show application status throughout the approval process.

OSFI has provided eligibility criteria for targeted new entrants, overviews of the application process and application assessment process, and an application toolkit of required documents, guides and forms.

June 19, 2026

OSFI Lowers Domestic Stability Buffer to 3.0 per cent so Canada's Largest Banks Can Deploy More Capital

OSFI has announced that it is lowering the Domestic Stability Buffer (DSB) to 3.0% from 3.5% of total risk-weighted assets. 
This is the first change in the DSB level since June 2023. In addition, OSFI is lowering the range of the DSB to 0 to 3% from 0 to 4%. OSFI expects all domestic systemically important banks (D-SIBs) to target a Common Equity Tier 1 ratio of at least 11.0% of total risk-weighted assets. In addition, OSFI is lowering the range of the DSB to 0% to 3% from 0% to 4%.

OSFI provides additional background information on the decision in a Decision Summary Note.

DSB took effect June 19, 2026.

June 4, 2026

Modernizing How We Collect Data From Institutions

OSFI’s Data Collection Modernization initiative, which runs from May 2023 to April 2028, is intended to modernize its regulatory data collection technology platform, and to advance prioritized data initiatives and enhance data quality. Its new platform, called Regulatory Data Hub (RDH), will go live late in the fall of 2026, and will be implemented in phases until spring 2028.

As part of its industry engagement initiative, OSFI is launching a Basel Capital Adequacy Reporting (BCAR) Working Group in September 2026; it is soliciting participation from stakeholders in banks and loan and trust companies.

Stakeholders interested in participating in BCAR Working Group should register by August 14, 2026.

Bank of Canada

June 29, 2026

Reminder: PSP Reporting Obligations Under the RPAA

The Bank of Canada has issued a communication to remind all payment service providers (PSPs) registered under the Retail Payment Activities Act (RPAA) of their ongoing reporting obligations. Responsibilities are listed under the following headings, with links to relevant policies and guidance:

• Incident reporting: PSPs must report any incident they become aware of that has a material impact on an end user, a payment service provider or a clearing house of a clearing and settlement system. 
• Significant change or new activity reports: PSPs are required to notify the Bank of any significant change to their operations if the change could reasonably be expected to have a material impact on operational risks or the manner in which end-user funds are safeguarded, or before performing a new retail payment activity. Notification is required at least 5 business days before the change is made.
• Reporting changes to registration information: PSPs must inform the Bank whenever there is a change, or anticipated change, to certain information the PSP provided during the registration process.
• Acquisitions of control and prescribed changes: PSPs are required to submit a new application for registration, and become re-registered under that new application, before making certain changes to their organizational structure.
• Annual reports: PSPs must submit an annual report to the Bank by March 31 of the year following the calendar year being reported on (reporting year). 

June 29, 2026

Reporting Changes to Registration Information

Under the Retail Payment Activities Act (RPAA) and the Retail Payment Activities Regulations (RPAR), registered payment service providers (PSPs) must inform the Bank when there are changes or anticipated changes to certain information that the PSP provided during the registration process. The timing requirements for informing the Bank of these changes vary depending on the nature of the information.

The Bank of Canada has issued an updated supervisory policy explaining how they expect registered PSPs to comply with requirements to provide updated registration information.

June 12, 2026

Bank of Canada to begin publishing Notices of Violation by Payment Service Providers

The Bank of Canada has announced that it will soon start publishing Notices of Violation related to Payment Service Providers (PSPs) that are subject to the Retail Payment Activities Act (RPAA) and the associated Retail Payment Activities Regulations. After a PSP has received a Notice of Violation, and once the period for making representations has expired, the notice will be published on the Enforcement decisions section of the Bank’s website. The enforcement decision will provide some details on the nature of the violation, as well as the amount of any administrative monetary penalty. The violation will also be noted on the PSP’s entry on the Bank of Canada’s Registry of PSPs.

Financial Transactions and Reports Analysis Centre of Canada (FINTRAC)

June 23, 2026

FINTRAC Guidance Related to the Ministerial Directive on Financial Transactions Associated With the Islamic Republic of Iran

This guidance explains the requirements of the Ministerial Directive on Financial Transactions Associated with the Islamic Republic of Iran. This Ministerial Directive includes requirements that:

• Enhance existing obligations of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations; and
• Extend the obligations of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations.

In section 3.3, “Additional measures required,” the following requirement has been added:

• Assess the client information to determine whether you have property in your possession or control that is owned or controlled by or on behalf of a listed person or entity, for which you are required to make a disclosure to the Royal Canadian Mounted Police or the Canadian Security Intelligence Service, and report a Listed Person or Entity Property Report to FINTRAC.

Information about Casino Disbursement Reports, which must be used after December 26, 2026, has been updated, and specific deadlines for reporting virtual currency transactions and casino disbursements have been added to the guidance.

Casino Disbursement Reports must be used after December 26, 2026.

June 22, 2026

Private-to-Private Information Sharing (Updated)

This guidance explains the requirements for reporting entities that voluntarily choose to engage in private-to-private information sharing the exchange of personal information without an individual’s knowledge or consent between reporting entities that participate in an approved code of practice) under section 11.01 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act.
The guidance has been updated with the addition of a new section 7, entitled “What FINTRAC Expects from Participants in an Approved Code of Practice.”

Payments Canada

June 22, 2026

PRD-002 -Procedures for foreign currency transfers within Canada
This procedure, part of the rules for Lynx, provides that members within Canada shall provide Swift transfer of U.S. funds and foreign currencies to other members within Canada in accordance with the procedures detailed in the following sections if the account of the beneficiary is domiciled in Canada. “Members” refers to both Canadian banks and non-bank financial institutions acting on their own behalf or on behalf of their foreign branches, affiliates and/or subsidiaries. A current list of members can be found in Appendix I. Members may request that all USD or foreign currency items be settled via Swift.

Bank for International Settlements (BIS)

June 2, 2026

Information and Communication Technology (ICT) Risk Management: Range of Practices
Information and Communications Technology (ICT) is a key component of operational risk management, playing a vital role in supporting the broader goal of achieving operational resilience. Banks’ operational resilience to ICT incidents has become increasingly important in an evolving and digitalised technology landscape.
The Basel Committee on Banking Supervision has analyzed ICT risk management practices across jurisdictions to address non-malicious ICT incidents. This report is part of an effort to strengthen banks' operational resilience to information and communication technology (ICT) incidents in an increasingly digitalised world; it complements the Committee’s 2018 report on cyber resilience.
The Committee will continue to monitor developments related to the digitalisation of finance and financial technology from a prudential perspective.

Financial Action Task Force (FATF)

June 23, 2026

International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation: The FATF Recommendations

The FATF Recommendations set out a comprehensive and consistent framework of measures which countries should implement in order to combat money laundering and terrorist financing, as well as the financing of proliferation of weapons of mass destruction. Countries have diverse legal, administrative and operational frameworks, and different financial systems, and so cannot all take identical measures to counter these threats.

New amendments include changes to Recommendation 6, which requires countries to implement targeted financial sanctions to comply with United Nations Security Council resolutions (UNSCRs) relating to the prevention and suppression of terrorism and terrorist financing. The updated Standards will require countries to comply with the humanitarian exemption contained in UNSCRs 2664 and 2761, as well as 2615. The updated Standards are intended to ensure that sanctions measures do not block the flow of funds, assets, resources, goods, and services necessary for humanitarian assistance and basic human needs in line with the UN framework.

This version is as amended June 2026.

June 23, 2026

FATF Launches Public Consultation on Guidance to Increase Payment Transparency

FATF is inviting the views of stakeholders on new guidance to support the implementation of strengthened FATF Standards on payment transparency when they come into effect. The revisions to FATF’s Recommendation 16, agreed upon in June 2025, are intended to keep pace with changes in the payment landscape, and strengthen the safety and security of the international payment system by increasing the transparency of information that accompanies cross-border payments and requiring the introduction of tools to protect against fraud and error. All countries around the world are expected to be ready to implement the changes by the end of 2030.

The FATF is soliciting feedback from stakeholders, including financial institutions worldwide with different business models and capacity, payment system operators, civil society and the research community. It has provided as support a Public Consultation Explanatory Memorandum and a copy of Draft R16. Guidance for consultation.

Comments are due August 21, 2026.

June 2026

2022 Methodology for Assessing Technical Compliance with the FATF Recommendations and the Effectiveness of AML/CFT/CPF Systems

The FATF assesses each member’s implementation of the FATF Recommendations and its actions to tackle money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction on an ongoing basis. The Methodology for Assessing Technical Compliance with the FATF Recommendations and the Effectiveness of AML/CFT/CPF Systems (The FATF Methodology in short) sets out the process by which the FATF assesses each member’s implementation of the FATF Recommendations and its actions to tackle money laundering, terrorist financing and the financing of proliferation of weapons of mass destruction on an ongoing basis. The FATF Methodology focuses on two distinct areas:

• Effectiveness: each assessment will have a significant focus on effectiveness, to ensure that countries are implementing and making use of the laws, regulations and policies that are being passed.
• Technical compliance: each assessment also looks at whether a country has all the necessary laws, regulations and legal instruments in place, in line with the technical requirements of the 40 FATF Recommendations.

The FATF commenced its 5th round of evaluations under this methodology in 2024, and FATF-Style Regional Bodies will also progressively use this methodology once they complete their previous round of evaluations.

This version is as amended June 2026.

Financial Stability Board (FSB)

June 10, 2026

Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation Report

This consultation report highlights the benefits and risks associated with AI use in the financial system. To facilitate responsible AI adoption by financial institutions, it proposes 12 sound practices that financial institutions could apply in their organisation-wide AI governance and management of the relevant stages of AI development and deployment (AI lifecycle). It draws upon case studies drawn from real-world AI implementation practices by financial institutions. 
FSB is soliciting comments on the consultation report and a set of questions.

Comments were due July 22, 2026.

International Association of Insurance Supervisors (IAIS)

June 23, 2026

Technical note – Credit Rating Agencies and ICS Rating Category Mapping

This technical note clarifies the Insurance Capital Standard (ICS) Rating Categories (RC) Mapping for the Credit Rating Agencies (CRAs) listed in Table 1, which originated during the monitoring period and was retained at ICS adoption for practical reasons. It also outlines the pathways under the ICS to recognize ratings from other CRAs.

June 17, 2026

FSI and IAIS Publish Joint Insights Note on the Cyber Insurance Market

Financial Stability Institute (FSI) and IAIS have jointly published a note on the cyber insurance market, entitled FSI Insights on policy implementation No 75: Cyber insurance unpacked: the corporate digital safety net. Based on desktop reviews and interviews with supervisors, insurers, reinsurers, brokers and other market participants, this note takes stock of the evolving cyber insurance landscape. In particular, it examines cyber insurance product coverage, pricing and underwriting practices, and explores the insurance protection gap. The note also highlights key considerations for supporting the sound and sustainable development of cyber insurance.

Legislation

June 27, 2026

[Proposed] Regulations Amending the Financial Consumer Protection Framework Regulations

The Budget Implementation Act, 2025, No. 1, introduced amendments to the Bank Act to combat consumer-targeted fraud. Once the relevant legislative amendments are in force, these amendments will require banks to have policies and procedures to address consumer-targeted fraud, allow consumers to adjust maximum transaction amounts, obtain express consent to enable certain prescribed account capabilities, allow consumers to disable certain account features, and require banks to collect and report prescribed fraud data to the Commissioner of the FCAC.

These proposed regulations would provide more specificity to support these legislative amendments, such as prescribing additional policies and procedures banks would need to have, the account capabilities that banks must allow consumers to enable and disable, how banks must obtain express consent before enabling these capabilities, when banks must enable transaction limit increases requested by consumers, and the specific data points banks will need to collect and report to the FCAC with respect to consumer-targeted fraud. The intention is for the consumer-targeted fraud legislative amendments to come into force on the same day as the proposed Regulations.

Closes for comments July 27, 2026.

June 27, 2026

[Proposed] Consumer-Driven Banking Regulations

The Consumer-Driven Banking Act (the Act), which received royal assent in March 2026, and the proposed Consumer-Driven Banking Regulations (the proposed Regulations), introduces a secure framework overseen by the Bank of Canada that enables Canadian individuals and businesses to share their financial data with accredited service providers of their choice. The proposed Regulations include requirements related to accreditation, security, national security, authentication and consent, reporting, record keeping, framework transparency, technical standards, assessments, and violations. The proposed Regulations also include the timelines and information requirements to support the national security review process related to the Minister of Finance’s national security authorities under the Act.

Closes for comments August 26, 2026.

June 18, 2026

Spring Economic Update 2026 Implementation Act, S.C. 2026, c. 22 (Bill C-30)

Among its provisions to implement the 2026 Spring Economic Update, the following measures of Bill C-30 affect federally regulated financial institutions:

• Division 1 of Part 3 amends the Bank Act to provide that the Investment Canada Act does not apply in respect of certain transactions made by foreign banks or entities associated with a foreign bank if the transactions are subject to an approval under the Bank Act, the Trust and Loan Companies Act or the Insurance Companies Act.
• Division 2 of Part 3 amends the Bank of Canada Act to combine into a single act the Bank of Canada’s powers, duties and functions related to the recovery of costs incurred by it for or in connection with the administration of certain acts. It also makes related amendments to other acts.

Division 3 of Part 3 amends the Canadian Payments Act to provide immunity for the Canadian Payment Association and certain individuals from any civil liability, other than in contract, for anything done or omitted to be done in good faith in the administration or discharge of any powers or duties conferred under that act.

House Third Reading June 18, 2026.

Senate First Reading June 18, 2026.

Senate Second Reading June 18, 2026.

Senate Third Reading June 18, 2026.

Royal Assent June 18, 2026.

Division 1 of Part 3 comes into force on October 16, 2026 (the 120th day after the day on which Bill C-30 receives Royal Assent).

Division 2 of Part 3 comes into force on proclamation but see coming into force provisions for section 20.

Division 3 of Part 3 is in force on Royal Assent.

June 18, 2026

Canadian Payments Association By-law No. 10 — RTR, SOR/2026-133

This new Canadian Payments Association by-law is being implemented in connection with the planned introduction of the Real-Time Rail, a real-time payment exchange, clearing and settlement system (the RTR system or RTR). The RTR by-law reflects the RTR’s financial risk framework, key operational requirements, and policy requirements governing how the system operates. These policy requirements include, for example, the provision of payment amounts to payees and participant obligations in processing payments.

The by-law also refers to the RTR rules, which will provide detailed technical and business process requirements for participants.

The RTR by-law focuses on Payments Canada’s operation of the RTR system and the rights and responsibilities of system participants. It establishes the general eligibility criteria for RTR participation. Participation is voluntary and any Payments Canada member is eligible to become an RTR participant if it meets the requirements set out in the RTR by-law and rules.

The RTR by-law establishes the classes of payment items acceptable for exchange, clearing, and settlement in the RTR. It also sets out the circumstances in which a payment will be cleared and settled in the RTR, key steps, and certain rights and obligations of participants related to the clearing and settlement process.

The RTR by-law requires a receiving participant to make the amount of an RTR payment available to the payee (such as an individual customer) according to the time frames and procedures established in the rules, except under certain circumstances. It contemplates the possibility that the RTR, or a participant’s use of the RTR, may be disrupted. The by-law allows the President of Payments Canada to take a variety of actions to respond to disruptions or other emergencies. In conjunction with the RTR rules, the emergency provisions in the by-law will enable Payments Canada, working with the Bank of Canada and system participants, to safely and effectively respond to potential disruptions.

In force August 24, 2026.

June 18, 2026

Bill C-29, Financial Crimes Agency Act

Bill C-29 establishes the Financial Crimes Agency (FCA) as a specialized federal law enforcement agency whose mandate is to investigate financial crimes and to contribute to the recovery of proceeds of crime. It also makes consequential amendments to certain acts and regulations.

The FCA will be headed by a commissioner, employ its own staff and have powers to investigate serious and complex financial crimes. It will also participate in international efforts to combat these crimes and report on its operations. In addition, the bill provides a role and specific powers to the Attorney General of Canada regarding certain financial crime prosecutions that would normally fall under the authority of the provincial attorneys general. The bill also makes consequential amendments to a number of acts and regulations, in part to authorize the sharing and disclosure of information between the FCA and certain federal ministers and entities.

House Second Reading June 18, 2026.

In force on Royal Assent, except for section 27, which comes into force on the first anniversary of the day on which Bill C-30 received Royal Assent.

Section 29 comes into force on the day on which section 33 of the Public Complaints and Review Commission Act comes into force or, if it is later, on the day on which this Act receives Royal Assent.

June 17, 2026

Bill S-6, Federal Law–Civil Law Harmonization Act, No. 4

Bill S-6 is the fourth in a series of enactments drafted in the course of the harmonization of federal statutes by the Department of Justice of Canada resulting from the coming into force of the Civil Code of Québec in 1994. Among the acts amended by Bill S-6 are acts governing financial institutions: the Bank Act, the Cooperative Credit Associations Act, the Insurance Companies Act and the Trust and Loan Companies Act. The amendments are made in order to ensure that each language version takes into account the common law and the civil law.

Senate Third Reading June 17, 2026.

June 15, 2026

Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts

Bill C-36 enacts the Protecting Privacy and Consumer Data Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. Consequently, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act.

As a consequential amendment, it replaces references in the Bank Act, Insurance Companies Act, Cooperative Credit Associations Act and Trust and Loan Companies Act to Personal Information Protection and Electronic Documents Act with Electronic Documents Act.

House First Reading June 15, 2026.

Act, except sections 1 and 51 and Part 3, to come into force on proclamation (but that day must not be before the day on which that Part 3 comes into force). See also s. 52(1) with respect to the coming into force of Bill C-34, Safe Social Media Act.

June 15, 2026

An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts, S.C. 2026, c. 9 (Bill C-8)

Bill C-8 establishes a regulatory framework to protect systems and services essential to public safety or national security.

Part 1 amends the Telecommunications Act to add the promotion of the security of the Canadian telecommunications system as an objective of the Canadian telecommunications policy and to authorize the governor in council and the minister of Industry to direct telecommunications service providers to do anything, or refrain from doing anything, that is necessary to secure the Canadian telecommunications system.

Part 2 enacts the Critical Cyber Systems Protection Act (CCSPA) to provide a framework for the protection of the critical cyber systems of services and systems that are vital to national security or public safety and that are delivered or operated as part of a work, undertaking or business that is within the legislative authority of Parliament. The CCSPA imposes onerous cyber security obligations on “designated operators” of federally regulated critical cyber systems. These operators carry out vital services or systems (that is, infrastructure essential to preserving national security and public safety). These obligations include, among others:

• Developing, maintaining, and regularly reviewing cyber security programs (CSPs);
• Reporting material changes in ownership, control, or use of third-party products and services to the appropriate regulator, as to mitigate supply-chain and third-party risks; and preserving detailed records of cyber security programs and incidents.

The CCSPA delegates broad, sector-specific powers to the appropriate regulators, including banking systems overseen by OSFI and the clearing and settlement systems overseen by the Bank of Canada.

The CCPSA will allow the regulators to, inter alia, enter any place (subject to limitations) to examine records and data, order internal audits, and issue compliance orders.

The CCPSA also introduces significant administrative monetary penalties for violations. While the proposed regime is designed to promote compliance, fines could amount to $15 million per violation, per day, for organizations, and $1 million per violation, per day, for individuals. Moreover, directors and officers of designated operators could be held personally liable if they were complicit in committing a violation.

Senate Third Reading June 4, 2026.

Royal Assent June 15, 2026.

Part 2 (Critical Cyber Systems Protection Act) in force on proclamation.

Remainder of Act in force on Royal Assent.

June 3, 2026

Bill C-31, Budget 2025 Implementation Act, No. 2

Bill C-31 implements certain measures put forward in the November 4, 2025, Budget.

Division 1 of Part 4 amends the Trust and Loan Companies Act, the Bank Act and the Insurance Companies Act to prohibit financial institutions from issuing documents in bearer form and provide for the replacement of documents that are currently in bearer form.

Division 2 of Part 4 amends the Trust and Loan Companies Act, the Bank Act and the Insurance Companies Act to provide that no action lies against His Majesty in right of Canada and federal government officials for any acts or omissions made in good faith under those acts.

Division 3 of Part 4 amends the Bank Act to require an institution to offer or sell deposit products in a non-discriminatory manner in certain circumstances.

Division 6 of Part 4 amends Schedule II to the Access to Information Act to prohibit the disclosure of confidential information obtained under the Retail Payment Activities Act or prepared from information obtained under that act.

House Second Reading June 3, 2026.

Division 1 of Part 4 in force on Royal Assent.

Division 2 of Part 4 in force on Royal Assent.

Division 3 of Part 4 in force on proclamation.

Division 6 of Part 4 in force on Royal Assent.