Content Gen Dashboard

On July 9, 2026, the Office of the Privacy Commissioner of Canada (OPC) published guidance for financial reporting entities on submitting codes of practice for sharing personal information to detect or deter money laundering, terrorist activity financing, and sanctions evasion. The guidance applies to reporting entities subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), including banks, credit unions, trust companies, and providers of life insurance and loans. Following legislative changes in March 2025, these entities may now share personal information among one another without an individual's knowledge or consent in certain circumstances, provided they establish and obtain approval for a code of practice governing such information sharing. The OPC's guidance clarifies what information reporting entities must submit to satisfy the Privacy Commissioner that a proposed code of practice meets regulatory requirements for approval. The purpose of codes of practice is to enable better detection and prevention of money laundering, terrorist financing, and sanctions evasion while ensuring personal information receives the same or greater protection as provided under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law. Philippe Dufresne, Privacy Commissioner of Canada, said the new guidance will support organizations as they establish codes of practice that maintain strong privacy protections in the context of information sharing meant to detect and prevent money laundering, terrorist financing, and sanctions evasion. Reporting entities seeking to establish codes of practice should consult the OPC's published guidance on submitting codes of practice under the PCMLTFA regulations.

On July 9, 2026, the Office of the Privacy Commissioner of Canada (OPC) published new guidance for reporting entities on submitting codes of practice under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) . According to the OPC press release , reporting entities under section 5 of the PCMLTFA (including banks and other financial institutions) may share personal information without individual knowledge or consent in certain circumstances to detect or deter money laundering, terrorist financing, and sanctions evasion. However, to share personal information, entities must establish a code of practice governing the information sharing and have the code approved by the OPC. The new guidance clarifies the information required to meet the regulatory requirements for the OPC's approval. The guidance details the following requirements for codes of practice: Scope and accountability: Codes must identify all participating entities and limit scope to information disclosed, collected, or used under section 11.01(b) of the PCMLTFA, which must be reasonable and proportionate to detecting money laundering, terrorist financing, or sanctions evasion. Each entity must demonstrate responsibility through policies, training, and record-keeping, including documenting decisions and internal audit procedures. Identifying purposes and limiting collection: Codes must specify purposes for sharing and how they relate to detecting money laundering, terrorist financing, or sanctions evasion, with mechanisms to ensure appropriateness. Collection must be limited to what is necessary, with retention periods outlined and contextual information assessed against documented thresholds. Safeguards, accuracy, and individual rights: Codes must include measures for accuracy, safeguards against unauthorized access, and breach reporting procedures. Individuals must be informed of the use of their information, given access upon request, and provided with complaint procedures, including the ability to file a complaint with the OPC. Amendments and resubmission: Changes to an approved code must be notified to the OPC, which will determine if the revisions require a new application. Codes must be resubmitted for approval every five years. Applicants must submit codes to the OPC and notify the Financial Transactions and Reports Analysis Centre of Canada on the same day. The OPC has 120 calendar days to make a decision, with a possible 15-day extension. The clock may be paused if additional information is requested. The OPC will review applications based on the criteria set out in section 160 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations.

meta_id 3313153

Generated

Canada's Privacy Commissioner Publishes Guidance for Financial Reporting Entities on Codes of Practice

Agent draft

Published

Office of the Privacy Commissioner of Canada Issues Guidance on Submitting Codes of Practice Under Anti-Money Laundering Act