Industry and Technology Committee on June 11th, 2026

[The Chair, Liberal, Ben Carr]

Mr. Bardeesy, I'm going to pause the clock for one second.

Mr. Paterson, if you can hear me, I'm trying to correct this problem. We have some folks from the tech side at the House of Commons trying to reach out to you. If you want to take a moment to check your phone or email, we're going to try to have you sign out and sign back in. I want to prompt you to keep an eye out for that.

Mr. Bardeesy, you have three minutes remaining.

[Karim Bardeesy, Liberal, Taiaiako'n—Parkdale—High Park, ON]

Thank you, Ms. Corrigall-Brown. We'd love to get some written recommendations on that with your further thoughts.

Mr. Pinto, I understand that Interac is the exchange solution provider for real-time rail. Coming into that project, what are the questions Payments Canada is asking of Interac—which also runs the e-transfer network, which is well known by Canadians—with respect to some of the potential vulnerabilities that could emerge from the partnership you have? What do you think needs to be attended to?

[Jude Pinto]

Are you referring to technical vulnerabilities or something wider?

[Karim Bardeesy, Liberal, Taiaiako'n—Parkdale—High Park, ON]

Take it where you will.

[Jude Pinto]

Payments Canada is the owner and operator of the total RTR solution. It's made up of several components. It's made up of a clearing and settlement component. It's made up of a brand new exchange. That exchange has leveraged Interac's expertise in e-transfer for the last 22 years by putting a modern architecture to it and having Interac as a provider in that regard. Interac's e-transfer will convert to use the new clearing and settlement engine that has been built.

It's not so much a vulnerability as it is an opportunity we have here. The protection against fraud covers even the in-market solution that's been there for 24 years, including building on what we've learned from e-transfer and giving it an uplift with the types of extra features we're adding to it. Our rules allow for a wide scope of those mandatory fraud controls.

[Karim Bardeesy, Liberal, Taiaiako'n—Parkdale—High Park, ON]

I'll just pick up Mr. Falk's question from earlier. E-transfer is, unfortunately, one of those vectors that social media.... Social media, as a vector to e-transfer, is the mechanism by which social media-enabled frauds are executed. Are there any specific questions you're asking of Interac with respect to this project, given that reality?

[Jude Pinto]

Our participants in RTR, in both cases, are the banks, financial institutions, credit unions and PSPs. The social media interaction happens at that layer. Again, the direct participants are where that intersection with their customers and social media and telcos, etc., will happen.

What we've put in place with Interac, where we can help as things flow through exchange, clearing and settlement, is a greater degree of mandatory reporting against a common taxonomy. That helps trends and sees movement to that, and that can feed back to Interac participants and ours, as required.

The risk list will help everybody. If one institution identifies a confirmed scam, seven others can prevent that from happening and use it to actually stop a payment. We're a bit at the middle to the back end of the thing, but we're adding tools that will help the participants at the front end, where scams and fraud are occurring.

[Karim Bardeesy, Liberal, Taiaiako'n—Parkdale—High Park, ON]

Thank you.

[The Chair, Liberal, Ben Carr]

Thank you, Mr. Bardeesy.

Mr. Ste-Marie, you have two and a half minutes.

[Gabriel Ste-Marie, Bloc, Joliette—Manawan, QC]

Thank you, Mr. Chair.

Mr. Pinto, I'd like to continue with you. Could a bank or financial institution decide not to use the real-time payment system at all, or does it have no right to opt out of using it?

[Jude Pinto]

It's a great question. You're talking about using the four fraud controls.

It's mandatory that they consume it, but once they consume it, their internal risk policies are what guide their individual thresholds on what to pass and what to fail. All of them have supplementary tools. For example, they might be absorbing four different scores, including the one we're providing, which has some network-level efficacy to add to what they're using today. For that part of it, they'll choose which score and threshold to use, from amongst the number of tools, to decide to let the payments through or to stop them, and that's because they bear the liability as the sender. They do the checks before and, generally, they have to deal with the fraud that arises between their own fraud losses and customer fraud losses, so that's where it leads to.

The parts of the solution that are mandatory, via our rules, are the contribution to the risk list and the contribution to the standard reporting nationally.

[Gabriel Ste-Marie, Bloc, Joliette—Manawan, QC]

Okay. Thank you very much.

Let me make sure I've understood this correctly. Your real-time payment system aims to implement the process with the anti-fraud services we discussed. It is not intended to further speed up payment systems that are already very fast, but rather to improve security. That is why you say that, with this, Canada would be among the first to launch a system with these security features. Is that correct?

[Jude Pinto]

It's a great question.

We saw that other countries launched their instant payment rails without direct attention to the types of new and different frauds that can accompany real-time payments. We have seen the types of solutions they've put in place, and then we worked with our members. I think there were a couple of dozen different things that could be done at the national level. They ended up picking these four and said, “Well, let's make sure that goes out on day one as part of the solution.”

It is available for all of the incumbent banks using e-transfer or all of the new participants that will use either e-transfer or RTR direct. It is available to all. Whether you've had 20 years of history in banking or you're a two-year-old fintech, it is available to you, with a network level of protection and insight.

[Gabriel Ste-Marie, Bloc, Joliette—Manawan, QC]

Thank you.

[The Chair, Liberal, Ben Carr]

Thank you, Mr. Ste-Marie.

Mr. Lawton, the floor is yours for five minutes.

[Andrew Lawton, Conservative, Elgin—St. Thomas—London South, ON]

Thank you very much, Mr. Chair. It's great to be here at this committee for the first time.

I'd like to start with you, Mr. Paterson. Hopefully, we've had the technical issues worked out here. One thing I understand about safeguarding against frauds and scams is that it's very much a multi-layered effort. There are individual decisions people can make to protect themselves. Then, at the system level, we also have protections that are needed.

I'm just wondering, given the security work you do, what caution could be given to the government, in the context of Bill C-22, the lawful access act, which actually requires the insertion of back doors into what are, right now, secure.... I'm just thinking of how that would affect people's vulnerability to bad actors, instead of just law enforcement, using those same back doors.

[Ian Paterson]

I apologize for the Internet connectivity issue.

I'm very concerned about proposed back doors. We have seen in the industry, for decades now, well-intended efforts to create vulnerabilities inside systems, which, inevitably, are used by bad guys to get access to that data. We saw this, most recently, in the United States, when a nation-state was able to compromise the lawful access in the telephony system in the United States.

I would focus the government's attention more toward how to build stronger systems across the board. There are definitely technologies. I mentioned pass-keys as well as phishing-resistant or spoofing-resistant communication channels. There are, absolutely, newer technologies that can make a material impact on reducing fraud. I think that we should start there as opposed to trying to weaken systems.

[Andrew Lawton, Conservative, Elgin—St. Thomas—London South, ON]

If I extrapolate from what you're saying or, perhaps, try to tighten it up in a way that other people could draw from this, any vulnerability that might exist for the good guys is also there for the bad guys. Is that an accurate summation of what you're saying there?

[Ian Paterson]

It's very accurate, sir.

[Andrew Lawton, Conservative, Elgin—St. Thomas—London South, ON]

In terms of the way that we navigate these and other related issues, I'm just a bit confused. We have done so much, I think, to try to prevent people from being targeted by this. One of the things that strike me as so interesting is that we have, basically, this game of whack-a-mole, in which the technology is evolving more quickly than the education. What role do you think literacy plays in safeguarding against fraud?

[Ian Paterson]

I think that literacy is crucially important. I would also say that not only is it a whack-a-mole game from a technology perspective, but it's also a whack-a-mole game from a legislation perspective.

I don't believe that fraud can be legislated away. It has to be a team effort, with public agencies as well as private corporations and individual citizens all taking responsibility for their respective areas to address these issues. That sounds like a hard thing to do, but I am [Technical difficulty—Editor] renewed focus on this issue, we can have a material impact on reducing fraud for Canadians.

[Andrew Lawton, Conservative, Elgin—St. Thomas—London South, ON]

Thank you very much, Mr. Paterson.

I'm going to take that glitch as my cue to move on to my other questions for Ms. Corrigall-Brown.

Ms. Corrigall-Brown, you're obviously representing the B.C. Securities Commission. I know that the overall structure of the securities system in Canada is outside of the scope of this study. From a fraud and scam prevention perspective, and with just looking at things that fall under securities regulators, I wonder whether there is a problem we're facing in Canada, in that we have a patchwork of regulators and regulations when so many of these frauds and scams are national in nature, or global even.

[Sarah Corrigall-Brown]

I think we absolutely recognize it. Because they're national and global is why Canadian securities regulators work so closely together in our enforcement efforts. There can be circumstances in which there are victims in multiple jurisdictions, and in such cases our enforcement teams work closely together.

As you said, the fact that it is national and the fact that the federal government, under the federal Criminal Code, has a role to play are also why—as I've said here, representing the BCSC but also the CSA—we are very excited about and strongly committed to working with the federal government in terms of the focused role that the federal government will play.

[Andrew Lawton, Conservative, Elgin—St. Thomas—London South, ON]

Is it your view that there is no inefficiency or nothing falling through the cracks by having multiple securities regulators in Canada?

[Sarah Corrigall-Brown]

I think that, in Canada, we work very well together in terms of the areas that are regulated by the provincial regulators. We're mostly harmonized in our rules. We enforce together, and we work regularly on almost all activities together.

There are always gaps. There are always possibilities for improvement. However, in terms of providing a strong regulatory regime for the Canadian capital markets, I think the provincial regulators work very well and strive to serve the Canadian markets well.