A payment processing company responsible for approximately one in three payment transactions across Canada will soon be owned by an American private equity firm.
The Royal Bank of Canada and Bank of Montreal announced earlier this week they would be selling jointly owned Moneris, one of Canada’s largest commerce solutions providers, to Francisco Partners for $2 billion.
So far, it’s been positive for both RBC and BMO, with the companies’ shares jumping after the deal’s announcement. RBC expects to gain about $475 million from the sale after tax, and BMO $600 million.
However, some industry analysts are raising concerns the move could have negative repercussions for Canada’s digital sovereignty amid the country’s ongoing trade war with the U.S.
Broadly speaking, digital sovereignty refers to the power of a country, or individual, to retain control over its own digital assets.
In September, AI Minister Evan Solomon said that Canada needs to create a sovereign digital economy that is “free from coercion.”
‘The moment is here’ to modernize Canada’s privacy laws: AI minister
That same month, dozens of experts and academics penned an open letter urging Prime Minister Mark Carney to swiftly “defend Canada’s digital sovereignty” and protect the country from the whims of the Trump administration.
It’s a sentiment Sharon Polsky, president of the Privacy and Access Council of Canada, shares.
“Canadians should be concerned because this is their information,” she said.
“We’re now going to have what has been a Canadian data-processing company that has access to everybody’s purchasing habits … available to other governments.”
Thousands of businesses in Canada use Moneris. The processor services more than 325,000 points of commerce and processes more than $5 billion in transactions every year, according to a press release from the company.
Polsky said the deal means Canadians’ data could be available, not only to foreign governments, but foreign law enforcement agencies.
She gave an example of U.S. border agents potentially checking an individual’s transaction history before allowing them to enter the country.
“Will you be stopped at the border because your purchase records indicate that you bought something with THC?” she said, referring to a chemical compound found in cannabis, which remains illegal in the U.S. under federal jurisdiction.
“It’s possible these days, much more possible than ever before.”
That the deal is happening as the countries grapple with a trade war only heightens Polsky’s concerns.
“It’s easy to foresee that the rich data that comes from millions of Canadians’ purchases could easily be leveraged to inform trade negotiations,” said Polsky, who has advised corporations and governments for more than 30 years on privacy and access matters.
Colin Deacon, an Independent Canadian senator, is also concerned about how the U.S. government could use Canadians’ data.
“[Data] under force and under request from the U.S. government could be then shared on an individual basis,” said Deacon during an interview with CBC’s Power and Politics.
Canadian senator concerned by U.S. purchase of BMO, RBC payment processor
“There’s a number of ways in which [U.S. President Donald Trump] has absolute control over services that Canadians rely on every day.”
Both BMO and RBC pointed to press releases announcing the deal, refusing to provide further comment when contacted by CBC News.
“As ownership transitions to FP, Moneris’s commitment to serving Canadian businesses will remain unchanged,” read a separate press release from Moneris.
Canada’s legislation meant to protect digital privacy isn’t where it needs to be, according to Polsky, who said this comes at Canadians’ “collective peril.”
“Canada isn’t ready,” she said.
Polsky argues there’s a clear outcome if a company based in Canada is compelled by the U.S. to supply data as a result of this deal.
“If the choice is either to comply with the American law or go to jail, or comply with Canadian legislation that really is nowhere near as stringent … it’s a no-brainer. They will comply with the American legislation.”
The Canadian government has taken steps to address digital sovereignty. In June, the government introduced Bill C-36, the Protecting Privacy and Consumer Data Act.
New privacy bill would give Canadians right to request companies delete AI deepfakes
It proposes a major overhaul of Canada’s private sector privacy framework, updating language to establish privacy as a “fundamental right” and replace parts of the Personal Information Protection and Electronic Documents Act (PIPEDA), which sets out rules for how businesses, including tech, airlines and banks, collect and use customers’ data.
The bill also requires companies to conduct a “privacy impact assessment” before transferring personal data outside of Canada.
At the time, government officials said the legislation would cover any company that has a “substantial connection” to Canada.
But Polsky said C-36, and the Liberals’ other attempts to update Canada’s digital privacy laws, only “dance around the issues.”
“They don’t really speak to data being retained in Canada as a matter of national security or as a matter of data sovereignty,” she said.
Bill C-36 represents the Liberal government’s third attempt to update privacy regulations, following failed attempts in 2020 and 2023. It underwent its first reading in June, but has a number of steps to go before becoming law.
Meanwhile, the sale of Moneris still requires regulatory approvals, including clearance under the Competition Act, and is expected to close by the end of the banks’ fiscal first quarter in 2027.
Where does that leave Canada?
“Behind the eight ball,” said Polsky.
“[Canada is] trying to look tough, but we have a ways to go.”
