The United States-Mexico-Canada Agreement (USMCA), announced on September 30, 2018, looks to remove certain record-keeping requirements for financial institution sectors. The USMCA is a new treaty between Canada, Mexico and the U.S., which will replace the North American Free Trade Agreement

The USMCA addresses several digital trade issues, including data localization. Among other things, once ratified, the USMCA will require changes to Canadian legislation to provide federally regulated financial entities (FREs) from the U.S. and Mexico with the flexibility to house data at computing facilities in their home jurisdiction. This is a much-anticipated change, particularly for FREs based in the U.S.

The USMCA will not take effect immediately. The next steps are for the leaders of the three parties to sign the agreement, and for each country to ratify and implement the USMCA. It is anticipated that the USMCA will take effect on January 1, 2020. An additional year following the entry into force of USMCA is allowed for Canadian compliance with the new data location requirement.

CURRENT RECORD LOCATION REQUIREMENTS

Currently, FREs are subject to data localization requirements, meaning that specified records must be maintained in Canada. For example, see sections 239(1) and 597(2) of the Bank Act.

This requirement has been interpreted by the Office of the Superintendent of Financial Institutions (OSFI) to mean that the specified records must be maintained (or at least backed up) on computer facilities located in Canada. In addition, the FRE must have effective means to access and use the records on such computer facilities in the event the records are required by OSFI, or to continue the operations of the FRE in Canada. These requirements have resulted in expensive redundant facilities and processes for foreign financial institutions with a regulated presence in Canada (whether a branch or a subsidiary).

Guidance from OSFI emphasizes that the specified records of FREs must be maintained in Canada in order to assist OSFI's mandate to conduct a periodic examination of the business of a FRE. For example, see OSFI Guideline E-4A: Role of the Chief Agent and Record Keeping Requirements (E-4A), OSFI Guideline E-4B: Role of the Principal Officer and Record Keeping Requirements (E-4B), and OSFI Guideline B-10: Outsourcing of Business Activities, Functions and Processes.

Under its Revised Corporate Governance Guideline issued on September 18, 2018, OSFI indicates that a review and amendment of E-4A and E-4B is forthcoming. While it would be helpful if the long overdue revision of these guidelines would address the expected relief from the current "in Canada" record-keeping requirement, OSFI may be reluctant to do so prior to any legislative change. Hopefully this will not further delay other necessary updates to these guidelines.

AMERICAN VIEWPOINT ON DATA LOCALIZATION

Data localization has become an increasingly important topic in trade agreements. The U.S. characterizes data localization practices as a non-tariff barrier to trade. The 2018 National Trade Estimate Report on Foreign Trade Barriers makes specific reference to the Canadian requirement that financial institutions in Canada mirror any data that relates to the Canadian operations of the financial institution that is transferred outside of Canada. The U.S. views this requirement as a barrier to trade and made it a priority in the negotiations to have such requirements removed, stating that regulators may have immediate and direct access to data irrespective of the location of the stored information.

LOCATION OF COMPUTING FACILITIES UNDER THE USMCA

Under Chapter 17 – Financial Services, Article 17.20 (Location of Computing Facilities) of the USMCA, a new digital trade provision was added, stating:

"No Party shall require a covered person to use or locate computing facilities in the Party's territory as a condition for conducting business in that territory, so long as the Party's financial regulatory authorities, for regulatory and supervisory purposes, have immediate, direct, complete, and ongoing access to information processed or stored on computing facilities that the person uses or locates outside the Party's territory."

For this purpose, a covered person includes both a Canadian financial institution controlled by persons of the U.S. or Mexico and a Canadian branch of a foreign financial institution controlled by persons of the U.S. or Mexico. Access to information includes access to information of a financial institution that is processed or stored on computing facilities of the financial institution or on computing facilities of a third-party service supplier.

However, the USMCA recognizes that access to information is critical to financial regulation and Article 17.20 allows a Party to require regulatory approval prior to allowing a covered person to take advantage of this provision.

Implementation of this commitment will require changes to the "in Canada" record-keeping requirements of the Canadian legislation governing FREs and related OSFI guidance. It remains to be seen whether the federal government will require a prior regulatory approval and what will be the other terms on which an FRE will be permitted to take advantage of this change. Ensuring OSFI has, for regulatory and supervisory purposes, "immediate, direct, complete, and ongoing access" to information processed or stored on computing facilities located outside of Canada (whether owned or third party) may be challenging. It is also open as to whether this relief will be extended to FREs based in countries other than the U.S. and Mexico.

NEXT STEPS

As noted above, the USMCA will not take effect immediately. First, it must be signed by the leaders of the three parties and then be ratified by U.S. Congress in 2019. Following ratification, each country will undergo implementation measures. The USMCA is expected to take effect on January 1, 2020 and Article 17.20 will not take effect in Canada for a further year. This will allow time for the federal government to amend the FRE statutes and for OSFI to develop any necessary requirements and guidance.

For permission to reprint articles, please contact the Blakes Marketing Department.

© 2018 Blake, Cassels & Graydon LLP.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.