The Banking Fine Print: What Canadian Banks Must Tell You — and What They Keep Private

Canada's banking system is among the most stable and well-regulated in the world. The five major banks — RBC, TD, Scotiabank, BMO, and CIBC — operate under a framework that includes federal oversight by OSFI (the Office of the Superintendent of Financial Institutions), consumer protection oversight by the FCAC (Financial Consumer Agency of Canada), and privacy obligations under PIPEDA (the Personal Information Protection and Electronic Documents Act). This framework is genuinely protective of consumers in many respects. But it also contains provisions that surprise — and sometimes concern — customers who encounter them for the first time.

Understanding what your bank can and cannot do with your information, and what you can and cannot find out about your own account, is practical knowledge. It affects how you manage complaints, how you respond to financial difficulty, and how you approach decisions about where to keep your money. What follows is a factual account of the rules as they currently stand.

What Banking Confidentiality Actually Means

Canadian banks have a duty of confidentiality toward their customers, established through common law and reinforced by PIPEDA and, in provinces with substantially similar legislation, by provincial privacy laws. In practice, this means a bank cannot share your account details, transaction history, or financial behaviour with third parties without your consent — in ordinary circumstances.

The phrase "in ordinary circumstances" carries significant weight. There are several well-established situations in which that duty is overridden entirely, and most customers are never clearly informed about them when they open an account.

When a Bank Is Legally Required to Disclose Your Information

There are four main circumstances under which a Canadian bank will share customer data without asking permission:

1. CRA requests. The Canada Revenue Agency has broad legal powers to require financial institutions to provide account and transaction data as part of tax compliance and audit processes. Banks are legally obliged to comply and are generally not permitted to notify the customer that a request has been made. The CRA can request this data without a court order in many circumstances under the Income Tax Act.
2. Court orders. A Canadian court can compel a bank to produce financial records in both civil and criminal proceedings, covering the account holder and in some cases connected third parties. Production orders under the Criminal Code are commonly used by law enforcement in financial crime investigations. The bank typically cannot inform you that a production order has been served.
3. Suspicion of financial crime. Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, banks are required to submit Suspicious Transaction Reports (STRs) to FINTRAC when they suspect a customer of money laundering, fraud, or terrorist financing. Informing the customer that a report has been filed — known as "tipping off" — is a criminal offence under Canadian law. The bank cannot tell you if an STR has been filed about your account.
4. Regulatory oversight. OSFI and the FCAC both have powers to access bank records as part of their supervisory and consumer protection functions. The Bank of Canada may also access certain data in its role overseeing systemic financial stability.

Automatic International Data Sharing: The CRS and FATCA

Canada participates in the Common Reporting Standard (CRS), a global tax transparency framework under which financial institutions automatically exchange account information with the tax authorities of over 100 participating countries each year. If you hold accounts in Canada and are a tax resident elsewhere — or hold accounts abroad and are a tax resident of Canada — that information is shared automatically, without any individual request being required.

Canada also participates in FATCA (Foreign Account Tax Compliance Act) reporting obligations with the United States. If you are a US citizen or green card holder living in Canada, your Canadian bank accounts are reportable to the IRS through the Canada-US Intergovernmental Agreement on FATCA. Canadian banks are required to identify US persons among their customers and report their account information annually. This affects an estimated one million Canadians with US citizenship.

For anyone with international financial connections, the assumption that a Canadian bank account is a strictly private matter no longer holds in any practical sense.

What Your Bank Must Tell You Directly

Fees Your Bank Rarely Highlights Proactively

While banks are required to disclose fee schedules, those schedules are long, technical documents that few customers read. The following charges exist at one or more of Canada's major banks and are commonly misunderstood or entirely unknown to account holders:

International Transaction Fees

Most Canadian credit cards charge a foreign transaction fee of 2.5% on purchases made in foreign currencies, in addition to the card network's currency conversion rate. This is disclosed in the cardholder agreement but rarely communicated clearly at the point of application. Cards from credit unions and some newer fintech lenders — such as Scotiabank's Passport Visa, or Wealthsimple Card — have eliminated this fee entirely, representing meaningful savings for frequent travellers.

Mortgage Prepayment Penalties

Canadian fixed-rate mortgages typically carry an Interest Rate Differential (IRD) penalty for early repayment that can run to thousands of dollars. The calculation method varies by lender and is notoriously difficult to understand. FCAC requires lenders to provide a prepayment charge disclosure, but the complexity of the calculation means many borrowers are surprised by the actual figure when they try to refinance or sell. Always request a written prepayment penalty estimate before making decisions that would trigger it.

Account Inactivity and Dormancy Fees

Accounts that receive no customer-initiated activity for a specified period can be classified as dormant. After a further period, unclaimed balances may be transferred to the Bank of Canada under the Bank of Canada Act. Customers can reclaim these funds at any time through the Bank of Canada's unclaimed balances website, but the process requires proof of ownership and can be slow.

Credit Bureau Reporting Thresholds

Banks report late payment and account status information to Equifax and TransUnion, but the timing of reporting varies. A payment that is 30 days late has a different impact on a credit score than one that is 60 or 90 days late. Banks are not required to warn you before a missed payment is reported — and they generally do not. Knowing your billing cycle and payment due date precisely is the simplest protection against inadvertent credit score damage.

Big Five Banks vs. Credit Unions: What Differs

Canada's credit unions are provincially regulated rather than federally regulated, which means they operate under provincial privacy legislation rather than PIPEDA in many provinces. The practical differences for consumers are modest, but there are some worth noting:

• Credit unions often have lower fee structures and are more likely to negotiate on NSF charges or mortgage terms with long-standing members
• Deposits at credit unions are protected by provincial deposit insurance schemes (such as DICO in Ontario or Credit Union Deposit Insurance Corporation in BC), which in some provinces offer higher limits than CDIC's $100,000 per category
• Credit unions are member-owned and return profits through dividends or improved rates rather than to shareholders
• PIPEDA still applies to credit union activities involving personal information used in federal commercial activities, but provincial oversight can vary in enforcement intensity

How to Request Your Full File: A Practical Walkthrough

Any Canadian bank customer can submit a personal information access request under PIPEDA. Here is exactly how to do it:

1. Write a brief letter or email stating that you are making a formal PIPEDA access request for all personal information the bank holds about you. Include your full name, account numbers, and date of birth for identification purposes.
2. Address it to the bank's Chief Privacy Officer (CPO). The name and contact details of the CPO must be publicly available under PIPEDA — it is typically listed on the bank's website under "Privacy" or "Legal."
3. Send the request by email with a read receipt, or by registered mail. Keep a copy.
4. The bank has 30 days to respond with the full disclosure. If they need more time (for complex requests), they must notify you within the 30-day window and explain the reason for delay.
5. The response should include transaction records, internal notes made about your account, credit assessments, risk classifications, and any correspondence related to your account held in their systems.
6. If you are refused access, or if the response seems incomplete, you can file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca. The OPC can investigate and make findings, though it cannot levy financial penalties directly on banks under the current version of PIPEDA.

Filing a Complaint: FCAC and the Ombudsman Process

If you have a complaint about a federally regulated bank that the bank has not resolved to your satisfaction, the process in Canada runs through two levels:

Step 1: The Bank's Internal Complaints Process

All federally regulated banks are required to have a formal complaints process with a designated ombudsman or complaints officer. You must complete this step before escalating. Most banks must acknowledge the complaint within 5 days and provide a final response within 90 days.

Step 2: External Escalation

If the bank's response does not resolve the issue, you have two options: the Banking Ombudsman (OBSI — Ombudsman for Banking Services and Investments) or FCAC. OBSI handles disputes about financial products and services and can recommend (but not compel) compensation of up to $350,000. FCAC handles complaints about a bank's compliance with federal consumer protection laws and regulations — it does not award compensation, but its findings can compel corrective action.

What Banks Are Not Required to Reveal

Certain categories of information remain legitimately protected even from customer access requests. Internal fraud investigation processes, the specific algorithms used in automated credit scoring, and the details of any Suspicious Transaction Report filed with FINTRAC about you are all shielded from disclosure. Banks are legally prohibited from notifying customers that an STR has been filed.

Banks will also not share information about other customers, even where those customers appear in transactions within your own account history. Internal risk classifications and watchlist designations may be withheld if disclosing them would reveal the bank's fraud detection methodology. Third-party commercial information provided to the bank in confidence may also be withheld.

In practice, the most useful information available through a PIPEDA access request is the internal notes and assessments that bank staff have added to your account over time. These can reveal how your account is categorised, any flags that may be affecting your ability to access credit, and how your relationship with the bank has been documented internally. For customers who have experienced unexplained credit refusals or account restrictions, this information can be genuinely clarifying.

The Practical Takeaway

Canada's banking framework is designed to balance institutional stability, regulatory oversight, and consumer protection. In practice, it tilts more toward institutional interests than most customers assume — particularly around the disclosure of regulatory reporting activities. But consumers who know their rights under PIPEDA, FCAC regulations, and the Bank Act are considerably better positioned than those who do not.

The most actionable steps available to any Canadian bank customer are: know the fees that apply to your specific account; understand that seven years of transaction records are yours on request; exercise your PIPEDA access right at least once to understand what your bank holds about you; and use the formal complaints process when something goes wrong, rather than accepting the first response you receive. These are not exotic rights. They are standard consumer protections that most Canadians simply do not know exist.