A Canadian bank receives a wire instruction from a correspondent. The originator's name is clean. The beneficiary passes screening. But an intermediate payment-service provider sits in a jurisdiction where a designated person holds a significant – though not majority – interest. Does that payment proceed? Does it freeze mid-chain? Canadian sanctions law, administered under the Special Economic Measures Act ("SEMA") and the Justice for Victims of Corrupt Foreign Officials Act ("JVCFOA") by Global Affairs Canada ("GAC"), has its own answer. It is not the same answer OFAC would give, and it is not the same answer the EU Council regulation would give.
Payment-processing controls under Canada's sanctions regime require financial institutions and payment-service businesses to identify, freeze, and report property belonging to or controlled by designated persons – with no de minimis threshold on the value of blocked assets. GAC administers the regime; the Royal Canadian Mounted Police and the Canada Border Services Agency share enforcement responsibility. The ownership-and-control test under SEMA captures entities controlled by a designated person even where direct ownership falls below fifty percent, which diverges materially from OFAC's purely mechanical fifty-percent threshold.
This page explains the governing regime, the payment-specific obligations that bite, where the Canadian rules diverge from OFAC, OFSI, and the EU, the risk flags that most frequently cause problems in practice, and how Calder & Vance assists businesses managing these exposures.
What governs payment-processing obligations under Canadian sanctions?
Canadian sanctions obligations in payments derive principally from SEMA and the JVCFOA, with separate thematic regulations issued for each designated country or programme. GAC maintains the consolidated list of designated persons. Any person in Canada, and any Canadian person or entity wherever located, is prohibited from dealing in the property of a designated person, facilitating such a dealing, or making property available to a designated person.
"Dealing" is defined broadly. It covers payments, transfers, wire instructions, electronic funds transfers, cheque clearing, and any step in a correspondent-banking chain that moves value to or from a designated person's property. The obligation is not limited to the first-level counterparty. An institution in the payment chain that processes a transaction through which a designated person ultimately receives value can be caught, even if the institution itself has no direct relationship with that person.
The obligation to freeze arises immediately upon designation. There is no grace period for pending transactions. In our experience, this is the point where payment-system operators – particularly those running high-volume batch processes – face the most acute operational exposure: a designation published after the payment instruction enters the queue but before settlement can produce a mid-flight compliance problem for which the institution must account.
Reporting obligations run in parallel. A person who knows or has reason to believe that they hold property of a designated person must report that fact to the Commissioner of the RCMP and to the Director of CSIS. The reporting obligation is distinct from the freeze obligation. Both apply concurrently.
How does the Canadian ownership-and-control test apply in payments?
Canada's ownership-and-control test is the principal source of complexity in payment-chain due diligence, and it is the feature that most frequently surprises institutions that have calibrated their programmes to OFAC's fifty-percent rule alone.
Under SEMA, the prohibition extends to entities that are owned or controlled by a designated person. "Control" is not defined solely by equity stake. A person may control an entity through contractual arrangements, through the ability to direct its management, or through other means that produce effective control over decisions – even where direct ownership sits below any numerical threshold. This is structurally closer to the EU's ownership-and-control approach than to OFAC's mechanical aggregation test.
What does this mean in practice? A payment-service business screening a counterparty corporate cannot rely exclusively on a share-registry search. If the counterparty's board composition, its operating agreements, or its funding arrangements give a designated person effective influence over its decisions, the entity can be caught even if the designated person owns no shares. The screening programme must look beyond the cap table.
Compare the positions across the major regimes. OFAC applies the fifty-percent rule: if blocked persons own, in aggregate, fifty percent or more of an entity, that entity is treated as blocked regardless of control. OFSI and the EU General Court have addressed the control limb in a series of decisions and guidance notes: entities controlled by a designated person are caught whether or not the designated person holds a majority interest. Canada's SEMA position is broadly aligned with the OFSI and EU approach on control, but the specific Canadian guidance documents – and GAC's own practice in enforcement referrals – have their own interpretive nuances that are not always reflected in cross-border compliance programmes designed primarily around OFAC.
In our cross-border practice, we regularly advise institutions that discover their OFAC-calibrated fifty-percent screening logic was not catching control-only relationships under SEMA. Recalibrating to the control test adds diligence depth but also adds time to counterparty onboarding – a trade-off that must be managed through tiered risk-based procedures.
What are the specific payment-chain risk flags under Canada's regime?
Not every payment presents the same risk profile. Several patterns recur in our experience as the most likely sources of a compliance failure under Canadian sanctions.
Correspondent-banking chains are the first. A Canadian bank processing a US-dollar payment through a correspondent may be the third or fourth institution in the chain. The originator and beneficiary may both screen clean, but an intermediate institution – a correspondent, a sub-custodian, or a clearing bank in a third market – may itself be controlled by a designated person. That intermediate's participation in the chain does not automatically render the entire payment prohibited, but it does trigger an obligation to assess whether value is moving through or to a designated person's property.
Trade-finance instruments present a second concentration of risk. Letters of credit, documentary collections, and guarantee structures involve multiple parties with roles that are not always apparent from the headline instrument. A presenting bank, a confirming bank, and an advising bank each have independent compliance obligations. If any counterparty in the structure is linked – through ownership or control – to a designated person, the obligation to freeze falls on each party in its own right.
Virtual-asset service providers registered or operating in Canada face the same obligations. SEMA applies to dealings in property without carve-outs for asset type. Crypto-denominated transfers that route through a wallet address associated with a designated person, or through a VASP that is controlled by one, are caught by the same freeze-and-report obligation as fiat transfers.
Payment aggregators and embedded-finance platforms – businesses that sit between merchants and acquiring banks – need to map their own position in the transaction chain carefully. In our experience, these businesses sometimes characterise themselves as technology intermediaries rather than payment processors, and on that basis treat their Canadian sanctions obligations as belonging to their banking partners. That characterisation is legally insecure under SEMA. The obligation attaches to any person who facilitates a dealing in the property of a designated person, irrespective of how the commercial contract allocates compliance responsibility.
Finally, cross-border payroll and treasury functions can produce unexpected exposure. A corporate treasury operation making payroll transfers across multiple jurisdictions will pass funds through multiple payment rails. If even one payroll recipient in a non-Canadian entity is a designated person, the Canadian entity making the transfer is potentially caught – even though the transfer is a routine employment payment and not a financial transaction in the ordinary commercial sense.
How does the Canadian regime interact with OFAC, OFSI, and the EU?
A business processing payments across the US, UK, and Canadian markets simultaneously faces three distinct legal regimes, each with its own designated-person lists, its own ownership-and-control tests, and its own reporting and record-keeping requirements. Divergences between them create two categories of practical problem.
The first is the false-clean problem. A counterparty or payment instruction that is clean under OFAC may be caught under SEMA. OFAC's fifty-percent rule may not flag an entity that Canada treats as controlled by a designated person through non-equity means. A screening programme built exclusively around the SDN List will miss designations that appear on GAC's list but not OFAC's. Canada maintains its own autonomous sanctions programmes, some of which target individuals and entities not designated by the United States. Multi-list screening is not optional for a Canadian-nexus business.
The second is the double-obligation problem. A single payment that triggers obligations under both OFAC and SEMA does not produce one compliance obligation that satisfies both regimes. The reporting timelines, the competent authority, the record-keeping requirements, and the licensing regimes are all separate. An institution that correctly freezes and reports to the RCMP under SEMA has not thereby discharged any OFAC reporting obligation, and vice versa.
OFSI presents a third layer for businesses with a UK presence. OFSI's ownership-and-control test, like Canada's, looks beyond equity to effective control. The UK regime's licensing process is administered separately from both OFAC and GAC. A payment blocked simultaneously under SEMA and the relevant UK sanctions regulations requires two separate licence applications, two separate reporting chains, and two separate legal analyses – the Canadian position under GAC and the UK position under OFSI.
For financial institutions that also have EU-regulated entities, the EU Council regulations add a fourth set of obligations. The EU's approach to ownership and control is the closest comparator to Canada's on the control limb, but the specific designated-person lists, the procedural requirements, and the enforcement posture of EU member-state competent authorities differ country by country across the EU, adding a further layer of complexity for any pan-European operation with a Canadian node.
The position above covers the standard multi-regime case. Your specific facts – the payment rails used, the jurisdictions of the parties, the nature of the underlying transaction, and the precise designation status of any linked person – change the analysis materially.
For a confidential review of your payment-processing exposure under Canadian sanctions and its interaction with other regimes, contact Calder & Vance at info@caldervance.com.
What does an effective payment-processing compliance programme look like under SEMA?
An effective programme under SEMA has five operational components that must be documented, tested, and kept current as the designated-person list changes.
First, multi-list screening must cover GAC's designated-person list as a primary source, not as a supplementary list screened after the SDN and HM Treasury lists. GAC publishes updates without a fixed notice period. A designation can become effective immediately. The screening configuration must be set to pick up additions to the GAC list on the day of publication, not on a weekly or batch-refresh cycle.
Second, the ownership-and-control mapping must go beyond first-level ownership data. For higher-risk counterparties – those in sectors or geographies that appear frequently in GAC's thematic programmes – the due-diligence file should include documentation of the control structure: shareholder agreements, director appointment rights, material contracts that grant a third party veto or direction rights over key decisions.
Third, the freeze procedure must be pre-scripted for mid-flight payments. The compliance team should not be improvising when a designation drops while a batch of wire instructions is in transit. The procedure must specify who has authority to pause the processing queue, what the escalation chain is, and what documentation is required before a frozen transaction is either reported or released under a licence.
Fourth, the reporting procedure must be calibrated to the dual-reporting obligation. The institution must report to both the RCMP Commissioner and the CSIS Director. These are not alternative reporting routes. Both reports are required. Internal compliance procedures that route the report solely to a designated internal compliance officer and treat that as sufficient are inadequate under SEMA.
Fifth, record-keeping must cover the full compliance decision, not just the payment record. When a payment is assessed and cleared – when the institution determines that the counterparty is not a designated person and that no control relationship exists – that determination and the evidence underpinning it must be retained. In the event of a later regulatory review, the institution needs to demonstrate not only what it screened but how it reached its conclusion.
We regularly advise payment-service businesses and financial institutions on building and stress-testing each of these components. A programme that passes a GAC audit is not automatically adequate for OFAC or OFSI; each regime must be addressed on its own terms, with common infrastructure where possible and bespoke procedures where the rules diverge.
Common myths and objections in payment-processing compliance
A prevalent misconception we encounter – particularly among businesses entering the Canadian market from the United States – is that SEMA operates as a substantially similar regime to OFAC, differing only in which persons are designated. This understates the divergence materially. The control test, the dual-reporting obligation, the lack of a de minimis threshold, and the distinct licensing regime under GAC all mean that an OFAC-compliant programme requires specific adaptation before it meets Canadian standards. Running the SDN List and calling it done is not a defensible position before GAC or the RCMP.
A second myth is that the Canadian regime is less actively enforced than OFAC, and that enforcement risk is therefore lower. Enforcement posture changes. GAC has signalled increased attention to financial-sector compliance. Enforcement referrals from GAC to the RCMP have increased in volume, and the RCMP has the authority to pursue criminal sanctions for wilful violations. The risk calculus that applied several years ago is not reliable today.
A third objection, common among payment aggregators and fintech businesses, is that the freeze-and-report obligation belongs to the regulated financial institution at the top of the payment chain, not to the underlying platform. This is inconsistent with SEMA's drafting. The obligation attaches to any person who "facilitates" a dealing in designated property. A platform that routes, aggregates, or initiates payment instructions is facilitating within that definition, regardless of whether it holds client funds directly or routes them through a partner bank.
If a transaction has already been flagged – by a correspondent bank, by a GAC inquiry, or by an internal screening alert – an early legal review can preserve options that narrow with time. Acting before a formal enforcement referral significantly changes the available response options.
Contact Calder & Vance at info@caldervance.com for an assessment of your exposure and an early review of any payment that has been flagged or held under Canadian sanctions.
How Calder & Vance assists with payment-processing controls under Canada
Calder & Vance advises payment-service businesses, banks, virtual-asset service providers, and corporate treasury functions on the full scope of Canadian sanctions obligations in payment processing. Our work in this area covers the compliance cycle from programme design through to enforcement response.
On programme design, we test the screening logic against the GAC designated-person list and the control-test obligations under SEMA, map ownership and control for high-risk counterparties, and redesign compliance procedures to the documented five-element standard described above. We identify where an OFAC-calibrated programme falls short of Canadian requirements and specify the precise procedural adaptations required.
On transaction-specific advice, we assess eligibility, prepare the analysis underpinning a licence application to GAC, and manage the authority's queries through the licensing process. Where a payment has been frozen mid-chain, we advise on the reporting obligation and on the evidence package required for the freeze record.
On cross-regime coverage, we address the interaction between SEMA and OFAC, OFSI, and the EU Council regulations in a single advisory engagement, so that a payment-service business does not receive four separate single-regime opinions that do not speak to each other. The multi-regime position is where we see most firms expose themselves to gaps.
In a recent matter, a payment aggregator with a Canadian entity discovered – during a counterparty review prompted by a correspondent-bank inquiry – that a beneficial owner of one of its merchant clients held a position in a business that was controlled, rather than majority-owned, by a person on the GAC list. We mapped the control relationship, advised on the freeze and reporting obligations under SEMA, and built the documentation package for the compliance record. The matter was managed before any enforcement referral arose.
For enforcement matters – whether a voluntary self-disclosure is under consideration or a formal inquiry has commenced – we scope the apparent violation, advise on the disclosure decision, and prepare the penalty response. Early action on enforcement matters consistently produces better outcomes, though no specific result can be promised.
Related practices
- Compliance audit and testing – Australia – sanctions compliance programme audit and stress-testing under the Australian autonomous sanctions regime.
- Payment-processing controls – EU – payment-chain obligations under EU Council regulations, ownership-and-control analysis, and licensing.
- Payment-processing controls – OFAC – OFAC fifty-percent rule, SDN screening, and secondary-sanctions risk in US-dollar payment chains.