16 April 2026
Changes under Bill C-15 affecting the Bank Act
As consumer fraud continues to rise across Canada, the federal government is moving to strengthen protections in the financial sector through the Budget 2025 Implementation Act, No. 1 (Bill C-15). Bill C-15 amends the Bank Act to establish new requirements to combat “consumer-targeted fraud”, including policies for banks to address fraud risks, options for consumers to adjust certain account capabilities, and procedures to report fraud data to the Financial Consumer Agency of Canada. These measures aim to protect all Canadians, who remain vulnerable to evolving forms of fraud ranging from conventional phone-based scams that disproportionately affect seniors to increasingly sophisticated, digitally enabled schemes targeting younger individuals.
The changes
Bill C-15, Division 16 of Part 5, amends the Bank Act, introducing new obligations for financial institutions in relation to consumer protection and account management. Bill C-15 received Royal Assent on March 26, 2026, and the following amendments come into force on a day to be fixed by order of the Governor in Council.
First, the amendments introduce a definition of “consumer-targeted fraud”, encompassing both unauthorized transactions and transactions that are authorized as a result of coercion or deception in connection with products or services offered, sold, or provided by an institution to a natural person in Canada.
The amendments also establish new requirements governing account capabilities. In particular, institutions are prohibited from enabling a prescribed capability for a personal deposit account in Canada without first obtaining, in accordance with the regulations, the express consent of the person who requested the opening of the account or in whose name it is maintained. Correspondingly, institutions are required to allow account holders to deactivate prescribed account capabilities.
In addition, institutions are required to allow account holders to modify certain limits applicable to withdrawals or transfers from their accounts. These include the maximum amount per transaction, the number of transactions permitted within a given period, the maximum amount of all transactions permitted within a given period, and any other prescribed limits. Any such modification may not exceed limits established by the institution, and institutions must ensure that changes to these limits take effect within a prescribed timeframe.
The amendments further impose notification obligations on institutions. Specifically, an institution is required to notify, without delay and by electronic means, the person in whose name a personal deposit account is held whenever a prescribed account capability is enabled or disabled, or where a transaction limit is modified.
Under the new framework, financial institutions are required to implement and maintain policies and procedures to detect and prevent consumer-targeted fraud and to mitigate its impacts. These policies guide how institutions identify suspicious transactions, decide whether to suspend, cancel, or take other actions, and communicate those decisions to affected individuals. They also set out how to determine if a person has been a victim of consumer-targeted fraud, whether a remedy is appropriate, the types of remedies that may be offered, and how those remedies are communicated. Institutions are expected to follow any additional criteria as prescribed.
Institutions are also required to provide initial and ongoing training to employees, representatives, agents, or mandataries, and other intermediaries who deal with customers in Canada on both the detection and prevention of consumer-targeted fraud and the institution’s policies and procedures.
Finally, the amendments require both institutions and the Commissioner of the Financial Consumer Agency of Canada to prepare annual reports respecting consumer-targeted fraud.
Conclusion
This development underscores the federal government’s increasing focus on strengthening consumer protection in banking and points to evolving regulatory expectations for financial institutions in detecting, preventing, and responding to consumer‑targeted fraud. If you are concerned that your business may be impacted, contact a member of our Financial Services or Compliance team for assistance.
The changes
Bill C-15, Division 16 of Part 5, amends the Bank Act, introducing new obligations for financial institutions in relation to consumer protection and account management. Bill C-15 received Royal Assent on March 26, 2026, and the following amendments come into force on a day to be fixed by order of the Governor in Council.
First, the amendments introduce a definition of “consumer-targeted fraud”, encompassing both unauthorized transactions and transactions that are authorized as a result of coercion or deception in connection with products or services offered, sold, or provided by an institution to a natural person in Canada.
The amendments also establish new requirements governing account capabilities. In particular, institutions are prohibited from enabling a prescribed capability for a personal deposit account in Canada without first obtaining, in accordance with the regulations, the express consent of the person who requested the opening of the account or in whose name it is maintained. Correspondingly, institutions are required to allow account holders to deactivate prescribed account capabilities.
In addition, institutions are required to allow account holders to modify certain limits applicable to withdrawals or transfers from their accounts. These include the maximum amount per transaction, the number of transactions permitted within a given period, the maximum amount of all transactions permitted within a given period, and any other prescribed limits. Any such modification may not exceed limits established by the institution, and institutions must ensure that changes to these limits take effect within a prescribed timeframe.
The amendments further impose notification obligations on institutions. Specifically, an institution is required to notify, without delay and by electronic means, the person in whose name a personal deposit account is held whenever a prescribed account capability is enabled or disabled, or where a transaction limit is modified.
Under the new framework, financial institutions are required to implement and maintain policies and procedures to detect and prevent consumer-targeted fraud and to mitigate its impacts. These policies guide how institutions identify suspicious transactions, decide whether to suspend, cancel, or take other actions, and communicate those decisions to affected individuals. They also set out how to determine if a person has been a victim of consumer-targeted fraud, whether a remedy is appropriate, the types of remedies that may be offered, and how those remedies are communicated. Institutions are expected to follow any additional criteria as prescribed.
Institutions are also required to provide initial and ongoing training to employees, representatives, agents, or mandataries, and other intermediaries who deal with customers in Canada on both the detection and prevention of consumer-targeted fraud and the institution’s policies and procedures.
Finally, the amendments require both institutions and the Commissioner of the Financial Consumer Agency of Canada to prepare annual reports respecting consumer-targeted fraud.
Conclusion
This development underscores the federal government’s increasing focus on strengthening consumer protection in banking and points to evolving regulatory expectations for financial institutions in detecting, preventing, and responding to consumer‑targeted fraud. If you are concerned that your business may be impacted, contact a member of our Financial Services or Compliance team for assistance.