Is a bank, in Canada

Bank Act, S.C. 1991, c. 46, s. 465 · Read the law's page

• It reaches you if you operate as a bank under the Bank Act; section 581 of the Act states the same kind of duty for an authorized foreign bank.
• Have the directors of the bank establish investment and lending policies, standards and procedures that a reasonable and prudent person would apply in respect of a portfolio of investments and loans, to avoid undue risk of loss and obtain a reasonable return.
• Adhere to those investment and lending policies, standards and procedures.

Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 17, 18 and 136 · Read the law's page

• This does not bind anyone yet: the Act is not in force, and it binds a designated operator, being a person, partnership or unincorporated organization that belongs to a class of operators the Governor in Council adds to Schedule 2 in respect of a vital service or vital system named in Schedule 1 (telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within federal authority, banking systems, and clearing and settlement systems), reached by declaring that you operate an essential service, provide telecommunications services or provide financial services.
• Report a cyber security incident in respect of any of your critical cyber systems to the Communications Security Establishment, in accordance with the regulations, within the period the regulations prescribe, which may not exceed 72 hours (section 17).
• Immediately after reporting, notify the appropriate regulator that the report was made, in the form and manner the regulations prescribe, and give it a copy of the report (section 18).
• Keep records of every cyber security incident you reported under section 17 (section 30).

Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 7-9, 12, 15 and 137 · Read the law's page

• This does not bind anyone yet: the Act is not in force, and it binds a designated operator, being a person, partnership or unincorporated organization that belongs to a class of operators the Governor in Council adds to Schedule 2 in respect of a vital service or vital system named in Schedule 1 (telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within federal authority, banking systems, and clearing and settlement systems), reached by declaring that you operate an essential service, provide telecommunications services or provide financial services.
• Within 90 days after you become a member of a class of operators set out in Schedule 2, establish a cyber security program in respect of your critical cyber systems, with steps to identify and manage organizational cyber security risks, protect those systems from being compromised, detect cyber security incidents and minimize their impact (section 9(1)).
• Notify the appropriate regulator in writing, immediately after the program is established, that it has been established, and provide the program to the regulator within 90 days after you become a member of the class (sections 9(2) and 10).
• Implement the program by taking the steps it includes, and maintain the program (section 12).
• Review the program each year, or on the dates the regulations prescribe, and notify the appropriate regulator whether changes were made (section 13).
• Mitigate any cyber security risk in your supply chain or your use of third-party products and services as soon as it has been identified (section 15).

Office of the Superintendent of Financial Institutions Act, R.S.C. 1985, c. 18 (3rd Supp.), s. 4; Bank Act, S.C. 1991, c. 46, s. 645 · Read the law's page

• It reaches you if you operate as a bank under the Bank Act, a financial institution that the Office of the Superintendent of Financial Institutions supervises.
• If the Superintendent directs the bank under section 645 of the Bank Act, cease or refrain from the act or course of conduct that the direction identifies as an unsafe or unsound practice in conducting the business or affairs of the bank, and perform the acts the direction requires to remedy the situation.
• Have adequate policies and procedures to protect the bank against threats to its integrity or security, and adhere to them; this is the standard that subsection 645(1.1) of the Bank Act applies when it lets the Superintendent direct remedial measures.