A Canadian bank receives a wire transfer instruction from a correspondent. The originator has a name that matches a party on the Consolidated Canadian Autonomous Sanctions List (CASL – the Canadian list of designated persons and entities). The compliance officer has minutes to decide. Is the match real? Does the payment have to stop? What happens next? As of August 2026, Canadian sanctions obligations under the Special Economic Measures Act (SEMA – Canada's primary autonomous-sanctions statute) have expanded in both breadth and enforcement focus, meaning the cost of an incorrect decision – in either direction – has risen sharply.
Payment-processing controls under Canada require a firm to screen every payment party against the CASL, assess ownership and control (the test for whether a non-listed entity is caught through a listed person's stake), and refuse or freeze transactions involving designated persons. The governing authority is Global Affairs Canada (GAC), which administers SEMA and issues permits. Record-keeping obligations attach immediately and the window to report is short. This guide walks the process from pre-payment screening to post-transaction obligations, with a cross-regime comparison at each stage.
This guide follows a step-by-step structure: the legal basis, the screening obligation, the ownership and control test, cross-border interaction with OFAC and other regimes, the documentation and reporting framework, common risk flags, and when to involve counsel.
Step 1: Understand the legal basis and governing authority
Canada's payment-processing obligations flow from SEMA and, in some programmes, from the United Nations Act (UNA – implementing UN Security Council mandated measures). Both instruments empower the Governor in Council to issue regulations that list designated persons, prohibit transactions with them, and require reporting of assets held or controlled on their behalf. GAC administers the programmes and maintains the CASL.
The payment prohibitions in the relevant thematic regulations under SEMA are broad. They typically cover dealing in property, providing financial services, making property available, and facilitating any such transaction. A financial institution or payment processor that routes a payment to a designated person – or to an entity owned or controlled by one – commits a breach. Ignorance of the designation is not a complete defence under the applicable regime, which is why a systematic screening process is the first line of protection.
Unlike OFAC under the US International Emergency Economic Powers Act (IEEPA), GAC does not operate a dedicated licensing portal with the same volume of public guidance. Permit applications under SEMA are submitted directly to GAC and are assessed on a case-by-case basis. The criteria and timelines can be less transparent than OFAC practice. In our experience, this means that a firm relying on a permit to process a payment should build a meaningful lead time into its workflow and not assume that SEMA permits move as quickly as OFAC-specific licences under comparable programmes.
The position above covers the standard case. Your facts – the counterparty's jurisdiction, the nature of the payment instruction, the programme in force, the route through the correspondent network – change the analysis. For a review of your screening obligations under the applicable Canadian regime, contact Calder & Vance at info@caldervance.com.
Step 2: Build and maintain the screening layer
Effective payment-processing controls under the Canadian regime begin with a screening layer that checks every payment instruction – originator, beneficiary, intermediaries, and any named reference parties – against the current CASL and applicable UN Security Council lists. The CASL is updated on a rolling basis; a list that was current at the start of a payment cycle may not be current when the payment settles.
Screening must cover all legs of the payment. A common gap is screening the direct counterparty but ignoring correspondent banks, payment-service providers, or sub-custodians in the chain. Under SEMA, facilitating a transaction ultimately benefiting a designated person is itself prohibited, even where the firm's immediate counterparty is not listed. Facilitation exposure does not require that the firm complete the payment; a firm that processes the first leg and then corrects can still face scrutiny over the uncorrected originating instruction.
The technology requirement is not prescribed by the applicable regime, but in our cross-border practice we routinely see firms underinvest in name-matching quality. Fuzzy-matching parameters that are set too narrowly produce false negatives that later become enforcement issues. Parameters set too broadly generate alert volumes that overwhelm human review, producing a different kind of exposure – a missed true-positive buried in the queue. Calibrating the two is a substantive compliance-design question, not a vendor-configuration detail.
Firms operating in multiple jurisdictions must also screen against the OFAC SDN List (OFAC's list of Specially Designated Nationals and blocked persons), EU Council lists, the UK Office of Financial Sanctions Implementation (OFSI) consolidated list, and relevant UN lists. Canada's CASL is not identical in composition to any of these. A counterparty that is not on the CASL may appear on the SDN List; a US-dollar payment clearing through a US correspondent will then trigger a US blocking obligation independently of the Canadian position. Firms must maintain concurrent multi-regime screening rather than treating the CASL as a proxy for other lists.
How does the ownership and control test work in Canada?
The Canadian ownership and control test asks whether a non-listed entity is owned or controlled by a designated person to such a degree that the entity is effectively caught by the prohibition, even though it does not itself appear on the CASL. The test is broader than a simple share-count and extends to effective control in fact – a distinction that differs materially from the mechanical 50 percent or more ownership threshold applied by OFAC under IEEPA.
OFAC's 50 percent rule is binary: aggregate blocked-person ownership at or above that threshold means the entity is blocked, full stop. The analysis under SEMA-programme guidance and corresponding practice is more functional. A designated person holding a minority stake may nonetheless exercise effective control through board composition, veto rights, contractual arrangements, or economic dependence. That means a compliance team cannot simply verify that no designated person holds fifty percent or more and close the file. It must assess whether a designated person exercises meaningful decision-making authority over the entity through any route.
What does this mean for a payment processor? It means that a clean-name hit on the CASL is necessary but not sufficient. For higher-risk counterparties – those in sectors or jurisdictions that are the subject of a thematic Canadian sanctions programme – the firm should look behind the registered ownership to assess functional control. In our experience, this expanded analysis is most commonly needed for complex holding structures where the designated person's ownership of any single entity may sit below obvious thresholds, but where the network of entities is operationally unified under that person's direction.
The UK and EU regimes take a similarly functional approach to control, though the terminology and the procedural context differ. OFSI in the United Kingdom assesses both ownership and control, and the EU Council regulations contain parallel language. A cross-border transaction that moves through a UK or EU correspondent may therefore be assessed under both the functional Canadian test and the analogous OFSI or EU test. The stricter prohibition governs – a principle that requires each regime's analysis to run independently before a firm concludes that a payment may proceed.
Step 3: Assess the transaction and apply the decision sequence
Once a screening alert fires, the decision sequence moves through four questions in order: Is the match a true positive? If yes, is the designated person a party to this specific transaction or a beneficiary of it? If yes, what obligation applies – a block, a freeze, a refusal, or a reporting duty? And finally, does a permit or other authorisation exist that would allow the transaction to proceed?
True-positive assessment requires the analyst to compare the alert data against the designation record on the CASL and any underlying regulation. Name, date of birth, nationality, identifying numbers, and any aliases listed in the designation should be checked against the data in the payment instruction. A mismatch on multiple data points, properly documented, supports a conclusion that the match is a false positive. A partial match on name alone, without corroborating data to confirm or exclude, should be escalated rather than cleared on the analyst's individual judgment.
Where the match is confirmed as a true positive, the payment must stop. Under the applicable regime, transacting with a designated person without a permit is prohibited. The firm should freeze the funds and document the basis for doing so. It should not return the funds to the originator without first considering whether doing so would itself constitute making property available to a designated person. This is a technical question that turns on the specific programme terms and the identity of the originator; it is one of the junctions at which specialist counsel adds the most immediate value.
The decision matrix in brief: a confirmed true positive with no applicable permit → hold and report; a confirmed true positive with a valid permit → process within the permit's terms and document the permit authority; a probable false positive documented on multiple data points → clear and document the basis; a match that cannot be resolved on the available data within the firm's review window → escalate to compliance leadership and consider involving external counsel before acting.
Step 4: Manage cross-border interaction with OFAC and other regimes
For any business with cross-border payment flows, the Canadian sanctions obligation does not operate in isolation. A payment that triggers no concern under the CASL may nonetheless be caught by a concurrent US, UK, or EU obligation – and the reverse is equally true. Understanding how the regimes interact is not optional; it is the functional requirement of operating a compliant cross-border payment operation.
The US extraterritorial reach of OFAC sanctions is the most significant intersecting exposure. US-dollar clearing, US correspondent banks, and US-person involvement anywhere in the ownership chain can pull a transaction within OFAC jurisdiction. Secondary-sanctions risk – the risk that non-US entities face OFAC measures for conduct outside US jurisdiction in connection with certain programmes – adds a further layer. A Canadian payment processor that is not itself a US person may still face secondary-sanctions consequences if it processes transactions that OFAC has designated as a concern under a relevant programme. The analysis here is programme-specific; not every SEMA programme creates secondary-sanctions exposure under OFAC, but a firm cannot assume it does not without programme-by-programme review.
The UK's OFSI administers financial sanctions under the Sanctions and Anti-Money Laundering Act (SAMLA). OFSI maintains its own consolidated list, which overlaps substantially with but is not identical to the CASL. A firm with UK-regulated operations or a UK-clearing correspondent faces OFSI obligations that run concurrently with its Canadian SEMA obligations. OFSI's enforcement posture has become markedly more active over recent years, with a reporting obligation that applies to relevant firms discovering that they hold or control funds or economic resources of a designated person. The reporting window under OFSI guidance is short, and late reporting is itself a potential breach.
Switzerland (through SECO), Australia (through DFAT under the Autonomous Sanctions regime), and other jurisdictions with independent lists create further concurrent obligations for firms with operations or correspondent relationships in those markets. The principle that the stricter prohibition governs means that a payment must satisfy every applicable regime before proceeding. A firm that clears on the Canadian analysis but does not check the OFSI or EU position has not completed its due diligence.
See also our related practice on payment-processing controls in cross-border transactions, which addresses the multi-regime interaction in depth, and our further analysis of cross-border payment controls for complex structures.
If a transaction has already been flagged under one regime, or if a correspondent has raised a query about a pending payment, an early review across all relevant regimes can preserve options that narrow with delay. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
Step 5: Document, report, and maintain records
Sanctions compliance does not end when a payment decision is made. The applicable Canadian regime imposes documentation and record-keeping requirements that are the evidentiary foundation of any enforcement defence. A firm that made the right decision but cannot demonstrate it faces the same exposure as a firm that made no decision at all.
Record-keeping under the applicable SEMA regulations requires that firms retain documentation of designated-person assets they hold or control, of any reporting made to GAC, and of the basis for decisions taken on specific transactions. The retention period under the applicable regime should be verified against current GAC guidance, as it differs across programme-specific regulations. As a working practice, firms should operate to a minimum retention standard that is at least as long as the applicable limitation period for enforcement proceedings, plus a margin. Anything that cannot be recovered from retained records at the point of an investigation creates a gap in the defence.
Reporting obligations under SEMA require a person in Canada or a Canadian entity anywhere who holds or controls property of a designated person to report that fact to GAC without delay. The obligation is proactive; it does not wait for a regulatory enquiry. A firm that identifies a CASL match in its payment queue must assess whether the funds already received or held constitute property of the designated person, and if so, must make the required report. Delay in reporting is a separate potential breach from the underlying holding.
Cross-regime documentation requires careful management. Where a firm is subject to both Canadian and OFSI reporting obligations on the same asset, the two reports follow different templates, different addressees, and potentially different timelines. Managing them through a single workflow creates a risk of one report being correctly filed while the other is missed. Firms with concurrent obligations should design their incident-response procedures to address each regime's reporting path independently, with a single case manager coordinating to avoid duplication and to ensure nothing falls between the two processes.
Common risk flags and when to involve counsel
Certain transaction patterns and counterparty structures recur in enforcement matters and warrant heightened scrutiny under any payment-processing control programme. Recognising them early is the practical difference between a controlled escalation and an uncontrolled breach.
The first pattern is layered beneficial ownership. A payment from an entity in a jurisdiction that does not require public registration of beneficial owners, or that allows nominee directors and bearer structures, is harder to clear conclusively. Where ownership data is incomplete and the counterparty operates in a sector or geography associated with a thematic Canadian programme, the firm should seek additional know-your-customer information before processing. The functional control test means that a missing ownership layer is not simply a documentation gap – it is a substantive risk that the designated person exercises control through the undisclosed route.
The second pattern is a mismatch between the stated purpose of a payment and the counterparty's known business. An invoice for commercial services from a counterparty that has no obvious capability to provide those services, or that operates in a sector inconsistent with the stated purpose, raises a due-diligence question that bears on facilitation risk. The question is not simply whether the counterparty is listed; it is whether the transaction in economic substance benefits a designated person through a non-listed intermediary.
A common myth in cross-border payment compliance is that a firm's obligation is exhausted by running the names through a screening tool and clearing the alert. That is the start of the analysis, not the end. The ownership and control test, the facilitation prohibition, and the concurrent multi-regime obligations all require judgment that extends beyond a binary list-match. A negative screen result tells you the counterparty's name does not appear on the list. It does not tell you that no designated person exercises effective control behind that name, or that the payment does not benefit a designated person at one remove.
Counsel should be involved at any of the following junctions: a confirmed true positive that requires a permit application or a reporting decision; a transaction where the ownership or control analysis cannot be resolved on available data; a situation where a correspondent or counterparty has placed the payment on hold and is seeking a legal opinion; a voluntary self-disclosure (VSD – a proactive disclosure of a potential breach to the regulator before an investigation commences) following an identified processing error; or any communication from GAC, FINTRAC, or a foreign regulator touching on the firm's payment operations. Early involvement at these junctions consistently produces better outcomes than late instruction after the fact.
Related practices
- Compliance Audit and Testing – Australia – Structured compliance testing and audit support under the Australian autonomous-sanctions regime.
- Payment-Processing Controls: Cross-Border Guide – Multi-regime interaction for complex international payment flows.