Ottawa is making payments security a top priority for Canada’s sovereignty

Canadians process tens of billions of payments transactions every day, a constant financial flow that operates on the assumption the money from those card taps and electronic transfers will change hands without interruption.

But if any part of Canada’s payments system were to come to a standstill – whether by another country shutting off access to critical networks or by a cyberattack causing an outage – the impact on the economy could be debilitating.

As geopolitical tensions escalate and the trade relationship with the United States becomes increasingly volatile, Prime Minister Mark Carney has added security of Canada’s payments system to the top of his to-do list, placing it alongside major priorities including defence and critical minerals.

Canada’s payments system is made up of multiple parts, both foreign and domestic. The country’s debit card and digital money-transfer system, Interac Corp., is domestically owned and operated, which is not the case for similar networks in some other countries.

However, Canada depends heavily on U.S. giants, such as Visa Inc. and Mastercard Inc., for other parts of its payments infrastructure, as well as U.S. banks for cross-border transactions.

Canada, EU plan to link next-gen payment systems, easing transactions

“Payments infrastructure is economic infrastructure. How money moves is increasingly tied to how Canada trades, competes and protects its economic sovereignty,” Deloitte global head of payments Todd Roberts said in an interview.

“I don’t think people really understood this before because we just took a whole bunch of things, including our place in the world, for granted.”

Mr. Carney has made financial services a central fixture of his plan to improve the resilience of Canada’s economy. In past federal budgets, Ottawa has committed to launching an open-banking regime aimed at improving competition and reducing fees in the sector.

The federal government has also been signalling its growing concern over financial data sovereignty, which broadly refers to Canada’s ability to control the financial services infrastructure and data generated in the country.

Ottawa’s new national security strategy, published last week, puts an unprecedented focus on economic security – highlighting eight areas, including payments, where Canada wants to increase its “strategic autonomy.” The federal government also unveiled plans on Friday to work toward connecting Canada and the EU’s instant payment systems to allow Canadians to send money to people and businesses in the region with greater speed and at lower cost.

Ottawa vows to prepare for all contingencies, ‘including war,’ in national-security plan

In a speech to the European Parliament in September, Mr. Carney highlighted the importance of sovereignty in payments, ranking it alongside AI, semiconductors, critical minerals, defence and other critical capabilities.

“We all have important gaps in these strategic capabilities, and we each must rely on individual nations or companies to fill them,” Mr. Carney said. “This creates vulnerabilities, particularly when supposedly ‘global’ companies prove national in the breach.”

Ottawa is recognizing that to bolster trade and grow the economy, Canada will need to improve its payments infrastructure’s connections with global markets, KPMG Canada executive director and Canadian payments lead Edwin Isted said in an interview.

“When you reduce the friction in your movement of value, you have a commensurate uptick in economic value being delivered into your industry,” Mr. Isted said. “When money moves slowly, that has a negative impact on trade.”

The Prime Minister’s speech in September followed news in August that Royal Bank of Canada and Bank of Montreal had sold Canadian payment processor Moneris Solutions Corp. to a U.S. private equity firm for $2-billion, which critics complained compromises part of Canada’s infrastructure used to move money.

Thousands of businesses in Canada use Moneris’s point-of-sale machines and other services that allow businesses to accept and manage payments.

Moneris sale to U.S. owner adds risk to Canada’s data sovereignty, payments industry leaders warn

Payments leaders questioned whether Canadian businesses’ data and financial security could be at greater risk given the increasingly volatile relationship with Washington.

Independent payment strategy adviser Doug Macdonald said the Moneris sale needs to be examined to ensure Canada retains control over key networks.

Moneris is “one of the choke points in the payments system, where a significant amount of retail payments volume goes through one vendor, and any disruption to that would be catastrophic to small businesses and enterprises across the country,” he said.

Canada relies on several foreign-owned payment systems, including Visa, Mastercard and the U.S.-based CLS Bank, for clearing foreign exchange transactions, and the Britain-based SwapClear for settling interest rate swap transactions.

Filipe Dinis, a former chief operating officer at the Bank of Canada, said it is unlikely Canada would try to replace these systems outright.

“My view is that having fully redundant systems is quite expensive,” he said in an e-mail, although he added that having some critical functions assumed by Canadian operators could help mitigate risk.

Opinion: Moneris, a big payments processor, is being sold to U.S. private equity. This should worry us

Europe has already been grappling with the task of securing its payments and financial data sovereignty. Europe relies heavily on U.S. companies to power its payments infrastructure, and the EU and individual countries have been rushing to rebuild and reinforce their own payments system.

In 2024, the European Payments Initiative – which is backed by 18 regional banks and financial services companies – launched its own digital wallet to facilitate peer-to-peer transactions. The initiative removes the need for international payments networks and offers an alternative to foreign payments providers, such as PayPal Holdings Inc.

To hedge against a cyberattack or other emergency that could take down payments systems, Sweden’s central bank, Riksbank, has enabled consumers to purchase essential goods with their Visa and Mastercard cards without needing a network connection. It also wants to enable offline purchases through a local payments network that does not rely on the Visa and Mastercard systems.

In Britain, about 95 per cent of card transactions are processed by Visa and Mastercard, and the country’s banks and policy-makers are assessing how to rebuild domestic capabilities, according to a report by Interac.

In the early 2000s, Britain permitted its own domestic debit scheme, Switch, to be merged into Mastercard. In 2016, 18 British lenders sold Vocalink, which oversees the systems that run key parts of Britain’s financial infrastructure, to Mastercard.

Koho Financial granted access to Interac payment system as it expands services to compete with banks

While Canada and the EU share similar concerns, they face different challenges. In Europe, 13 countries rely entirely on international networks to process card transactions, according to a 2025 report by the European Central Bank.

Canada’s primary retail payments and debit network operator, Interac, has remained domestically owned by a group of banks, credit unions, caisses populaires and payment acquirers.

In August, Interac issued a report calling on the federal government to develop a national payments strategy that prioritizes the sovereignty of critical infrastructure.

Mr. Macdonald said Canada’s resilience will not come from reducing its payments options, such as by removing access to Visa and Mastercard. Instead, the country should be expanding its systems, companies and methods for moving funds in order to protect from foreign actors, cyberattacks and other threats.

“There’s any number of things that can bring a payments network down, and we don’t want to get stuck with only having one option,” Mr. Macdonald said.

Canada got a lesson about the risk of relying too much on one company to underpin critical payments infrastructure in July 2022, when Rogers Communications Inc. experienced a nationwide service outage that lasted for 26 hours. This knocked out the Interac debit system and e-transfer system, freezing payments across much of the country.

In the aftermath of the outage, Interac added a second network provider and a “third link” that could reroute user traffic in the event the other systems failed.

Opinion: Why Canada needs a digital dollar

Canada is also preparing to launch real-time rail, a new system that would allow payments to be sent and received instantly, and the network that Ottawa hopes to connect to Europe’s instant payments system.

But Canada’s system is still reliant on credit card networks. Visa and Mastercard make up approximately 96 per cent of Canadian credit card volume, and about 90 per cent of Canadian mobile payments move through wallets operated by three U.S. platforms, according to Interac.

U.S. tech giants are not the only concern. With much of global trade being done in U.S. dollars, many of Canada’s cross-border transactions are routed through correspondent banks and entities in the U.S., which can be a cumbersome, costly process.

“Global trade inflows and outflows from Canada, have crossed through New York City, through a handful of correspondent banks through the SWIFT network,” Mr. Roberts, the Deloitte payments head, said. “A complement rather than an alternative to that is directly connecting Canadian national infrastructure with the national infrastructure of other jurisdictions.”

Mr. Dinis, the former Bank of Canada official, said there are two types of payments risk that need to be managed: interconnectivity risk and concentration risk. The first refers to the fact that a shock or an outage in one part of the payments system – either domestic or international – could ripple to other parts of the financial system. The second refers to the fact that certain key capabilities are reliant on a single operator.

“The current geopolitical risks have only increased the focus on the need to have sovereign and operational resilient critical systems like our payments and settlement systems,” Mr. Dinis.