7 New Canada Rules To Protect Against Banking Fraud

Last Updated On 6 July 2026, 7:23 PM EDT (Toronto Time)

The federal government has moved to overhaul how Canadian banks handle electronic transfers, account security features, and fraud data reporting in one of the most significant consumer protection actions in years.

Finance Canada published proposed regulations on June 27, 2026 that would require all banks operating under the Bank Act to obtain express consent from customers before activating electronic funds transfer capabilities on personal deposit accounts.

The proposed changes target wire transfers, global money transfers, and Interac e-Transfers, which are the three primary channels that fraudsters use to drain accounts after gaining unauthorized access.

These account capabilities are currently enabled by default on most personal deposit accounts across Canada, leaving consumers exposed to high-value unauthorized transactions even when they have never used those features.

The regulations are now in a 30 day public comment period and would take effect on July 1, 2027 if finalized as proposed.

Canada reported $704 million in fraud losses in 2025 alone, but the Canadian Anti-Fraud Centre estimates that figure represents only 5% to 10% of actual losses.

That means the true annual cost of fraud in this country could exceed $7 billion when unreported cases are included.

Here is a complete breakdown of every major provision in the proposed rules, who they affect, when they take effect, and what Canadians should do to prepare.

Why These Banking Fraud Rules Are Being Proposed Now

The scale of consumer-targeted fraud in Canada has reached a point where voluntary industry measures are no longer considered sufficient by the federal government.

Reported fraud losses climbed from $165 million in 2020 to $704 million in 2025, representing a nearly 300% increase over five years according to the Canadian Anti-Fraud Centre.

The government’s own analysis estimates that Canadians lost approximately $2.1 billion to wire transfer fraud and $489 million to Interac e-Transfer fraud in 2024 alone when adjusting for the massive underreporting gap.

Advances in artificial intelligence have made it substantially easier for criminals to use deepfake videos, AI generated phone calls, and convincing phishing messages to compromise bank accounts, a trend also reflected in rising scam activity targeting people across Canada.

The proposed regulations are required to operationalize legislative amendments to the Bank Act introduced through the Budget Implementation Act, 2025, No. 1, which have not yet come into force.

Industry groups representing banks advocated for a voluntary approach during three rounds of public consultations, but consumer groups and the Department of Finance determined that voluntary measures would not provide adequate protection.

How Fraud Losses Have Escalated In Canada

Year	Reported Losses	Estimated Actual Losses	Year Over Year Change
2020	$165 million	$1.7 billion to $3.3 billion	Baseline
2021	$380 million	$3.8 billion to $7.6 billion	+130%
2022	$531 million	$5.3 billion to $10.6 billion	+40%
2023	$578 million	$5.8 billion to $11.6 billion	~+10%
2024	$643 million	$6.4 billion to $12.9 billion	~+10%
2025	$704 million	$7.0 billion to $14.1 billion	~+10%

The cumulative reported losses from 2022 through 2025 now surpass $2.4 billion, according to data published by the Government of Canada during Fraud Prevention Month 2026.

Investment fraud accounted for the largest share of losses at $351 million in 2025, followed by relationship scams at over $63 million and job scams exceeding $50 million.

Individuals under 50 are statistically more likely to be defrauded, but those over 50 lose significantly more money on average when they are targeted, a pattern that underscores why these new banking protection rules apply broadly across all age groups.

What The Proposed Banking Rules Would Actually Change

The proposed regulations address six distinct areas of consumer protection, each targeting a specific vulnerability in the current banking framework.

Express Consent Before Enabling Electronic Transfers

Banks would be required to obtain express consent from consumers before enabling any capability that allows for the electronic transfer of funds from personal deposit accounts.

This covers wire transfers, global money transfers, and Interac e-Transfers.

Before enabling any of these features, the bank must provide the account holder with information about the nature and potential uses of each capability and must verify the identity of the person making the request.

Express consent must be obtained independently for each capability, meaning a single blanket authorization during account opening would not be sufficient.

Banks would not be required to retroactively obtain consent for capabilities already enabled on existing accounts at the time the rules take effect.

Transactions Exempt From The Consent Requirement

Not every type of electronic transaction falls under the new consent rules.

Requires Express Consent	Exempt From Consent Requirement
Wire transfers	Transfers between your own accounts at the same bank
Global money transfers	ATM withdrawals
Interac e-Transfers	Debit and prepaid card payments
	Pre-authorized debits
	Direct bill payments

The exemption for same-bank internal transfers and card-based payments means routine daily banking activities would not be disrupted by the new consent framework, a distinction that matters for the millions of Canadians who rely on direct deposit for CRA benefit payments and automatic bill payments.

Ability To Disable Electronic Transfer Capabilities

Banks would be required to allow consumers to disable wire transfers, global money transfers, and Interac e-Transfers on their accounts at any time.

This is a critical protection for Canadians who do not regularly use these features but currently have them enabled by default.

The government estimates that approximately 75% of Canadians would choose to disable global money transfers and 25% would disable wire transfers if given the option, based on usage data from Payments Canada and Interac.

Disabling unused capabilities prevents fraudsters from exploiting them even if they gain access to an account, which is particularly relevant given the CRA My Account breach settlement that demonstrated how credential stuffing attacks can compromise government and banking accounts.

Transaction Limit Adjustments With Verification Safeguards

The proposed rules introduce a two-tier system for processing requests to increase transaction limits on personal deposit accounts.

Scenario	When Limit Increase Takes Effect
Bank has verified the requester is the genuine account holder	Without delay (immediately)
Bank has not verified the requester’s identity	The following business day

The next business day delay when identity is not verified is designed to frustrate a fraudster’s ability to immediately maximize theft from a compromised account.

Banks are already required under the Bank Act to notify consumers when their limits are adjusted, which provides an additional safety net for account holders to detect unauthorized changes.

Mandatory Fraud Policies And Procedures

All 79 banks and authorized foreign banks operating in Canada would be required to establish formal policies and procedures for detecting, investigating, and preventing consumer-targeted fraud.

These policies must include the criteria each bank uses to investigate transactions it has flagged as suspicious and the criteria it uses to decide whether to notify an account holder of a suspicious request to enable a capability or increase a transaction limit.

Banks must review these policies at least once per year and update them as necessary to address evolving fraud tactics.

The Financial Consumer Agency of Canada will supervise compliance and can issue administrative monetary penalties for violations, creating an enforcement mechanism that did not previously exist for fraud prevention in Canada’s banking sector.

Mandatory Fraud Data Reporting To The Government

One of the most consequential provisions in the proposed rules is the requirement for banks to collect and report detailed fraud data to the FCAC on an annual basis.

For each instance of consumer-targeted fraud, whether confirmed by the bank or alleged by the consumer, the proposed regulations published in the Canada Gazette require banks to report 13 specific data points.

#	Required Data Point
1	The date the bank became aware of the fraud instance
2	Whether the fraud was attempted or actually committed
3	Whether the instance was confirmed by the bank or alleged by a consumer
4	The type of consumer-targeted fraud involved
5	The tactic used to commit that type of fraud
6	The means of communication used to contact the victim
7	The transaction method used to execute the fraud
8	The amount of funds lost by the consumer or sought by the fraudster
9	The amount of funds reimbursed by the bank to the victim
10	Whether the transaction was unauthorized or authorized through coercion or deception
11	Whether the bank delayed the transaction on suspicion of fraud
12	Whether the bank stopped the transaction on suspicion of fraud
13	The age range, gender, and first three digits of the postal code of the victim

Banks must submit their annual fraud report to the FCAC Commissioner within 135 days after the end of each calendar year, and the FCAC must then submit a compiled report to the Minister of Finance by September 30 of the following year.

The first report covering January 1 to December 31, 2028 data must be submitted by May 15, 2029, giving banks six months after the rules take effect to build the necessary collection systems.

This mandatory reporting will replace the current system where the government relies almost entirely on voluntary reports to the Canadian Anti-Fraud Centre, which captures an estimated 5% to 10% of all fraud.

Account Opening Disclosure Requirements

When a consumer opens a new personal deposit account, banks would be required to disclose three pieces of information related to the new fraud protections.

First, banks must inform the consumer which account capabilities require express consent to activate.

Second, they must explain which capabilities can be deactivated at the consumer’s request.

Third, they must disclose which capabilities allow the consumer to increase or decrease withdrawal and transfer limits.

This disclosure requirement ensures that every new account holder understands their rights under the updated framework from the first day they bank in Canada.

Who Will Be Affected By These Rules

The proposed regulations would apply to every institution defined as a bank or authorized foreign bank under the Bank Act.

As of December 31, 2025, that includes 35 Schedule I banks, 15 Schedule II banks, and 29 authorized foreign banks, totalling 79 financial institutions operating in Canada.

Virtually every Canadian with a bank account will be touched by these changes, given that 99% of adult Canadians hold a bank account according to data from the Canadian Bankers Association.

Newcomers to Canada will encounter these protections immediately upon opening their first personal deposit account after the rules take effect.

The regulations do not apply to credit unions, provincial trust companies, or other financial entities that are not regulated under the federal Bank Act, which means some Canadians banking with provincial institutions may not receive the same protections in their accounts.

The $2.3 Billion Net Benefit The Government Projects

The Department of Finance conducted a full cost-benefit analysis projecting the financial impact of these regulations over a 10 year period from 2027 to 2036.

Category	10 Year Present Value	Annualized Value
Total benefits (consumer fraud reduction)	$2.9 billion	$411 million
Total costs (banks, government, consumers)	$611 million	$87 million
Net benefit	$2.3 billion	$324 million

All monetized benefits flow to consumers through reduced fraud losses.

The costs are distributed across three groups: banks bear implementation and ongoing compliance costs estimated at $230 million over the decade, the FCAC absorbs $39 million in supervision costs, and consumers face $342 million in friction costs from enabling features and verifying identity.

Even under a conservative scenario where actual fraud is only 10 times reported levels rather than 13 to 20 times, the regulations still produce a net benefit exceeding $1.68 billion, which the Budget 2025 framework described as a significant consumer protection improvement.

How Canada’s Approach Compares To Other Countries

Canada is not acting in isolation on banking fraud prevention.

Australia recently introduced its Scams Prevention Framework, a multisector initiative that requires financial institutions, telecommunications companies, and digital platforms to prevent, detect, and respond to fraud.

The United Kingdom implemented a liability model that splits responsibility for fraudulent transactions equally between the sending and receiving banks at 50% each.

Singapore adopted a limited liability framework where financial institutions and telecommunications providers can be held responsible when they fail to meet their fraud prevention obligations.

Canada’s approach focuses on prevention through the consent and disable framework rather than assigning shared liability after fraud occurs, though the National Anti-Fraud Strategy may introduce broader liability provisions as it develops.

The requirement for consumers to adjust account capabilities does not appear to exist in other surveyed jurisdictions, making this element of the Canadian proposal distinct in the global regulatory landscape.

Key Dates And Implementation Timeline

Date	Milestone
June 27, 2026	Proposed regulations published in Canada Gazette Part I
July 27, 2026	30-day public comment period closes
July 1, 2027	Proposed coming into force date for all rules
January 1, 2028	Banks begin collecting fraud data for first annual report
May 15, 2029	Deadline for first annual fraud report submission to FCAC
September 30, 2029	FCAC submits compiled report to Minister of Finance

The 12 month lead time between publication and the proposed July 1, 2027 coming-into-force date gives banks the ability to update their IT systems, disclosure documents, and internal procedures, while the FCAC prepares its supervision and enforcement framework.

What These Rules Mean For Newcomers To Canada

Newcomers to Canada who open their first personal deposit account after July 1, 2027 will interact with the new consent framework from the moment they begin banking.

They will be informed at account opening about which capabilities require express consent, which can be disabled, and how to adjust transfer limits on their own terms.

This is particularly important because newcomer families are often targeted by fraud at disproportionate rates according to survey data from Interac, which found that more than half of new Canadian families feel they face a heightened risk of being defrauded.

For newcomers managing their immigration applications and processing timelines, understanding these protections adds an important layer of financial security during the settlement period.

What Banks Must Prepare Before July 2027

The estimated first-year implementation cost for the 79 affected banks is approximately $3 million collectively, covering IT system updates, disclosure document revisions, and policy development.

IT specialists at each bank will need approximately 500 hours to build systems that allow consumers to enable, disable, and adjust transfer capabilities and to collect fraud data.

Senior analysts and managers will spend approximately 200 hours per bank updating account opening documents, fraud policies, and internal procedures.

Ongoing annual costs after the first year are estimated at $26 million across all banks in 2028, rising to $55 million by 2036 as fraud reporting volumes increase with population growth and account activity.

How Canadians Can Protect Themselves Right Now

The proposed rules do not take effect until July 2027 at the earliest, but Canadians can take several immediate steps to reduce their fraud exposure today.

Contact your bank and ask whether you can disable wire transfer and global money transfer capabilities on your personal deposit account, as some banks already allow this on a voluntary basis.

Review the default transaction limits on every account and request that they be lowered to amounts that reflect your actual banking needs, especially if you do not regularly send large transfers.

Enable two-factor authentication on all banking apps and CRA My Account to prevent unauthorized access.

Turn on real-time transaction alerts for every bank account, credit card, and investment account so you are immediately notified of any activity you did not initiate.

Report any suspicious activity to the Canadian Anti-Fraud Centre at 1-888-495-8501 or through their online portal, because even unsuccessful fraud attempts contribute to data that shapes future protections.

Never share banking credentials, passwords, or one-time codes with anyone who contacts you by phone, text, or email, even if they claim to represent your bank, the CRA, or Service Canada.

How To Submit Public Comments On The Proposed Rules

Interested Canadians, consumer groups, and industry stakeholders have 30 days from June 27, 2026 to submit written comments on the proposed regulations.

Comments should be submitted through the online commenting feature on the Canada Gazette website or by email to the Department of Finance contact Mark Radley, Director of Consumer Affairs, at consumer.consommateur@fin.gc.ca.

The comment period is a meaningful opportunity for Canadians to influence the final version of these rules, and the government has historically made adjustments based on public input received during regulatory consultation processes.

These proposed regulations represent the first concrete step in what the federal government envisions as a broader multi-sector assault on consumer-targeted fraud across Canada.

The Department of Finance is simultaneously developing the National Anti-Fraud Strategy that will bring together financial institutions, telecommunications companies, and technology platforms to build a coordinated cross-sector response.

The consent and disable framework for bank accounts will become law on July 1, 2027 if the regulations are finalized as proposed, and every Canadian with a personal deposit account will feel the changes in how their bank communicates, verifies identity, and processes electronic transfers.

For a country where unreported fraud losses may exceed $7 billion annually, these rules are not arriving a moment too soon.

The 30 day comment period is open now, and any Canadian who wants to shape the final version of these protections should submit their input before the window closes.

Frequently Asked Questions (FAQs)

---

---

You may also like: 6 New CRA Benefit Payments Coming In July 2026

10 New Canada Laws and Rules Taking Effect In July 2026

New Ontario Laws And Rules In July 2026

4 New CRA Benefit Payments For Ontario Residents In July 2026