A payment-services firm operating between Toronto and Singapore processes a routine trade-finance instruction. The beneficiary's ultimate parent is not on any list. But a sanctions match fires three days later when a compliance analyst traces the ownership chain. Canada's rules under the Special Economic Measures Act ("SEMA") and its regulations, administered by Global Affairs Canada ("GAC"), require an immediate freeze – not a review, not an escalation meeting, not a filing request. The question is whether the firm's payment-processing controls were designed to catch that scenario in the first place.
Payment-processing controls under Canada's sanctions regime are governed primarily by SEMA and the associated thematic regulations administered by GAC. The regime prohibits dealing in, or facilitating transactions involving, property of designated persons, and it extends to payments routed through Canadian financial infrastructure regardless of where the processing entity is incorporated. Most businesses miss two structural features: the breadth of the "facilitation" limb, and the absence of a standalone licensing pathway comparable to those available under OFAC or OFSI.
This analysis sets out the governing authority, the key procedural tests, where Canada diverges from OFAC and OFSI, the risk flags that compliance programmes most commonly overlook, and when to involve counsel.
What is the governing authority for payment-processing controls in Canada?
Canada's payment-processing prohibitions flow from SEMA as the primary statute, supplemented by the United Nations Act ("UNA") for UN Security Council-mandated measures, and the Proceeds of Crime (Money Laundering) and Terrorist Financing Act for the financial-intelligence layer. GAC administers and enforces the SEMA-based thematic regulations; FINTRAC administers the financial-intelligence reporting obligations that run alongside them. The two regimes are legally distinct but operationally inseparable for a payments business.
Each thematic sanctions programme – for a particular country or situation – sits in a separate statutory instrument under SEMA. That instrument carries a list of designated persons and a set of prohibitions. A payment-processing firm must screen against every active instrument, not just a single consolidated list. In our experience, firms that maintain a single master list and assume it covers all Canadian designations discover gaps precisely when a match emerges under an instrument they had not loaded into their system.
GAC publishes the Consolidated Canadian Autonomous Sanctions List, which aggregates designated persons across the SEMA instruments. That list is the practical starting point. But it does not always capture UN-listed persons who are caught under the UNA route, which requires a separate check against the UN Security Council Consolidated List. The two lists are not identical, and the obligations differ.
The position above covers the standard structure. Your institution's geography, its correspondent relationships, and the currencies it clears change the analysis materially. If you process Canadian dollars or use Canadian correspondent banks, SEMA's reach applies regardless of where your entity is domiciled.
For a review of how your screening programme addresses these structural gaps, contact Calder & Vance at info@caldervance.com.
What does "dealing" and "facilitation" mean for a payments business?
The prohibition on "dealing" in the property of a designated person is the core of SEMA's payment-processing obligation. It captures making, accepting, or processing a payment where the funds are, or are derived from, property of a designated person. "Property" is defined broadly: it includes funds, financial instruments, securities, and economic resources. A payment instruction that passes value to or from a designated person is a dealing in that person's property.
Facilitation extends the prohibition beyond direct dealings. Providing financial services that assist another party to deal in sanctioned property is caught. For a correspondent bank, a payment processor, or a clearing participant, the facilitation limb is the greater operational exposure. Consider: your institution clears a payment from a respondent bank whose customer is a designated person. You did not initiate the transaction. Under the facilitation test, however, the question is whether your processing of the correspondent instruction provided material assistance to the dealing. That is not a settled line, and GAC has not published guidance as detailed as OFAC's on the point.
The practical consequence is that "screen only your direct customers" is not a sufficient control design. A payments business must consider the counterparty, the ultimate beneficiary, and – where obtainable – the source of funds. This is technically demanding when the instruction arrives through a multi-bank chain and the originator information is incomplete. Under international messaging standards, certain payment message types carry the originator and beneficiary in structured fields; others do not. Where fields are missing or truncated, GAC's regulations do not provide a safe harbour comparable to OFAC's guidance on "straight-through processing" scenarios.
How does Canada compare with OFAC and OFSI on payment-processing controls?
Canada, the United States, and the United Kingdom share the same general design – a prohibition on dealings in the property of listed persons, extended by an asset-freeze to any entity sufficiently owned or controlled by a listed person – but the detailed implementation differs in ways that directly affect a cross-border payments business.
On the ownership and control test, OFAC applies the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked). The test is arithmetic and applies regardless of control. SEMA's instruments typically refer to persons "owned or controlled" by a designated person, without a fixed numeric threshold equivalent to OFAC's. GAC's published guidance addresses the concept but does not reduce it to a single percentage trigger. In practice, Canadian courts and counsel have applied a functional analysis that looks at both ownership and effective control. An entity that a designated person controls through voting rights, board composition, or contractual arrangements may be caught even when the direct equity stake is below fifty percent. OFSI uses a similar ownership-and-control test under UK financial-sanctions regulations: the UK rules look at ownership of more than fifty percent or control through other means, which is closer to the Canadian approach than to OFAC's purely arithmetic rule.
On licensing, the difference is significant. OFAC operates an active specific-licence programme: an applicant submits a detailed request, OFAC evaluates it, and – where the policy criteria are met – issues a licence that authorises the otherwise-prohibited transaction. OFSI similarly operates a specific-licence regime and publishes licensing grounds in its guidance. Canada has a more limited licensing mechanism under SEMA. The Minister of Foreign Affairs may issue certificates permitting otherwise-prohibited activity, but the programme is narrower in scope and the published process is less detailed than its US or UK counterparts. In our cross-border practice, this asymmetry regularly surprises clients: a transaction that could be licensed under OFAC or OFSI may have no equivalent pathway in Canada, requiring either a structural redesign or a decision not to proceed.
On voluntary self-disclosure, all three regimes encourage reporting of potential violations, and all treat good-faith, prompt disclosure as a mitigating factor in enforcement. Canada does not have a formalised VSD programme equivalent to OFAC's, but GAC assesses disclosure conduct in determining its response. Record-keeping obligations under SEMA instruments require firms to maintain documentation of the measures taken on a match, in a form and for a period specified in the applicable regulation. Confirm the current record-keeping requirements for each instrument you are subject to before relying on a single standard.
For a detailed comparison of how the EU regime treats equivalent transactions, see our analysis at Payment-processing controls under the EU. For the OFAC position specifically, see Payment-processing controls under OFAC.
Where do businesses most commonly miss Canada's payment-processing controls?
The most common gap is instrument coverage. A payments firm sets up SEMA screening against the Consolidated Canadian Autonomous Sanctions List but does not load the UN Consolidated List for UNA-route obligations. The two lists differ. A person designated by the Security Council but not separately replicated in a SEMA instrument may still be caught under Canada's UNA obligations, and a payment processed to that person generates a potential violation that no SEMA-only screen would catch.
The second gap is the facilitation perimeter. Firms draw their screening logic around customers – "know your customer" controls – and assume that a clean customer file satisfies the sanctions obligation. It does not. The question is whether the transaction, wherever it originates and wherever it terminates, involves property of a designated person. A clean customer can be the conduit for a sanctioned beneficiary or originator. The control must follow the transaction, not just the relationship.
Third, correspondent and intermediary relationships are inconsistently managed. A Canadian payments business that relies on a respondent bank's "we screen our customers" assertion without independently testing the plausibility of that assertion is not, in our view, operating an effective control. The appropriate standard is a documented risk-based assessment of the respondent's screening capability, not a reliance letter.
Fourth, update frequency. GAC and the UN Security Council designate persons without advance notice. A screening database refreshed weekly may be stale for days after a designation. That gap is measurable and known to regulators. Payments businesses processing high volumes should assess whether their refresh cycle is commensurate with the designation velocity of the regimes they are subject to.
Fifth – and this is the myth most frequently encountered in the mid-market – the Canadian regime is sometimes assumed to apply only if the payment clears through a Canadian bank or involves a Canadian counterparty. That is incorrect. SEMA applies to any person in Canada and to Canadians wherever located. A Canadian financial institution operating through a foreign branch, or a foreign entity that is a Canadian person, is subject to SEMA's prohibitions on each payment it processes. The "we are not in Canada" argument does not eliminate exposure for a business with Canadian corporate presence or Canadian personnel approving transactions.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact us at info@caldervance.com to discuss your situation on a confidential basis.
What is the procedure when a payment-processing match occurs under SEMA?
When a screening match identifies a potential designated person, the required response under the applicable SEMA instrument is to freeze the property immediately – meaning to refrain from processing the payment – and to report the match to GAC and, where applicable, to FINTRAC. The precise reporting obligation, including the channel and any applicable window, is set in the relevant regulation and in FINTRAC's reporting requirements; verify the current requirements before a match occurs, not after.
The practical sequence a payments business should follow:
- Halt the transaction pending review. Do not release the funds while the match is unresolved.
- Escalate to the sanctions compliance officer immediately. Document the time and the basis for the hold.
- Conduct the match review: is the matched person the same individual or entity as the designated person? False positives are common. The review must be documented and defensible.
- Where the match is confirmed, freeze the property and notify GAC in accordance with the applicable regulation. Retain all records of the transaction, the screening result, and the action taken.
- Assess whether a FINTRAC suspicious-transaction report is also required under the parallel AML obligations. SEMA and FINTRAC obligations are independent; satisfying one does not satisfy the other.
- Assess whether any licensing pathway exists for the blocked funds if the counterparty or customer has a legitimate claim. As noted, the Canadian mechanism is narrower than OFAC's or OFSI's, but it exists.
- Consider voluntary disclosure to GAC if there is any question that a prior payment may have been processed in error. The timing and form of that disclosure matter.
The cross-regime dimension is critical at step one. If your institution also processes US dollars or has US nexus, OFAC obligations run concurrently. The stricter prohibition governs: where SEMA requires a freeze and OFAC independently requires a block, both must be satisfied. Neither regime's compliance excuses a failure under the other.
How does the Canadian regime interact with US secondary-sanctions risk?
Secondary sanctions are the category that cross-border payments businesses most consistently underestimate when they focus on Canadian primary obligations. The United States asserts extraterritorial reach under certain of its sanctions programmes, subjecting non-US persons to the risk of OFAC designation or other consequences for engaging in transactions with persons or in sectors subject to US sanctions, even where those transactions involve no US nexus in the traditional sense.
For a Canadian payments business, this creates a layered exposure. SEMA compliance – screening against Canadian designations, freezing property of SEMA-designated persons – does not address secondary-sanctions risk. A counterparty that is not SEMA-designated may nonetheless be subject to US secondary sanctions. Processing a payment involving that counterparty without a US-sanctions screen may expose the Canadian entity to consequences under a US regime to which it has not directed its compliance programme.
The practical implication is that a Canadian payments firm operating in sectors or corridors where US secondary sanctions are active – energy, financial services, certain trade routes – should maintain a US-sanctions screen alongside its SEMA screen. Those screens are not identical: the designation lists differ, the ownership-and-control tests differ, and the licensing mechanisms differ. Running one and not the other is a gap that regulators on both sides of the border can identify.
We regularly advise Canadian firms on aligning their SEMA compliance programme with the secondary-sanctions posture of their correspondent relationships and their payment corridors. The interaction is not theoretical: a Canadian firm that loses a correspondent banking relationship because its SEMA-only screen was insufficient for the correspondent's US-sanctions expectations has suffered a real commercial consequence, not a hypothetical one.
For firms operating across multiple regimes, our compliance-audit and testing work in other jurisdictions is directly relevant. See our service on compliance audit and testing for the parallel approach we apply.
What should a cross-border payments business do to address these controls?
A payments business with Canadian nexus should treat its SEMA compliance programme as a distinct strand, not a subset of its OFAC or EU screening. The lists differ, the facilitation perimeter differs, and the licensing mechanism differs. A programme designed around one regime will miss material obligations under another.
The priority actions, in the order we recommend:
- Instrument audit: confirm that every active SEMA thematic instrument is loaded into the screening system, alongside the UN Consolidated List for UNA obligations. Do not rely on the Consolidated Canadian Autonomous Sanctions List alone.
- Facilitation perimeter review: map the payment flows, not just the customer relationships. Identify where the firm processes transactions as an intermediary or correspondent, and ensure the screening logic covers the beneficiary and originator, not only the direct counterparty.
- Correspondent due diligence: document the risk-based assessment of each respondent bank's screening capability. A reliance letter is not a control; it is a record. The assessment must consider the respondent's designation-list coverage, refresh frequency, and escalation procedures.
- Refresh-cycle assessment: compare the firm's screening-database update frequency against the designation velocity of the regimes it is subject to. Where the gap is material, a business case for more frequent refresh should be documented.
- Secondary-sanctions mapping: identify the payment corridors and sectors where US secondary sanctions are active and ensure a US-sanctions screen runs alongside the SEMA screen in those corridors.
- Response-procedure testing: test the match-escalation procedure at least annually. A procedure that has never been exercised will fail under the pressure of a live match.
- Legal review of the licensing position: understand, before a transaction is blocked, what licensing pathways exist under SEMA and whether the facts would support an application. The answer is not always "no," but the process is different from OFAC's.
Is your programme designed around the regime you are actually subject to, or around the regime you know best? That question – and the answer to it – is often what separates a firm that manages a match cleanly from one that escalates it into an enforcement matter.
Related practices
- Compliance audit and testing – structured programme review, gap analysis, and remediation across sanctions regimes.
- Payment-processing controls under the EU – how EU Council regulations treat payment-processing obligations, with cross-regime comparison.
- Payment-processing controls under OFAC – the US position on payment-processing prohibitions, licensing, and enforcement posture.