Canadian arm of China’s largest bank had plans to set up payments processor to collect spending data

Open this photo in gallery:

The Canadian subsidiary of China’s largest bank spearheaded a project to establish a new payments processor that would collect financial information about Canadians of Chinese descent, as well as Chinese nationals and other consumers, according to a person familiar with the matter.

Industrial and Commercial Bank of China (Canada), which is known internally as ICBK, led a group of companies that put together a proposal around 2019 and 2020 to set up a new payment processing system for debit cards and credit cards that would be used by retailers, the source said. (The Globe and Mail is not identifying the individual, who was not authorized to speak publicly about the matter.)

The consortium wanted to create a new payments processor that would directly compete with Moneris, which is a major player in Canada, the source said. The project’s broader ambition, however, was to gather retail spending data from Canadians of Chinese ancestry and Chinese nationals, including foreign students, the individual said.

Since major Canadian banks are the biggest issuers of debit and credit cards in the country, the project hinged on processing retail payment transactions for customers of domestic financial institutions, the source added. Prolonged economic shutdowns stemming from the COVID-19 pandemic, however, caused the project to lose momentum and it was eventually scrapped.

Still, the ICBK-led group’s goal of harvesting financial data from consumers throws into stark relief concerns about Chinese state surveillance of diaspora community members in Canada. Although that was a recurrent theme of the recent Hogue Commission on foreign interference in Canadian elections and democratic institutions, the public inquiry failed to probe foreign meddling through the banking and payments systems.

Canadian arm of China’s largest bank repeatedly broke money-laundering rules despite multiple warnings from regulators

ICBK did not confirm it had ambitions to set up a payments processor or answer specific questions about the proposal, but provided a statement to The Globe saying its focus remains on “serving customers and Canada with integrity while maintaining a strong compliance framework.”

Moneris, meanwhile, “is not aware of any discussion regarding ICBK’s interest in entering the Canadian payments market,” the processor’s spokesman, Darren Leroux, wrote in an e-mailed statement.

Of chief interest to the ICBK-led group was accessing debit- and credit-card payment information for 11/11, which is the world’s largest shopping festival, the source said. Also known as “Singles Day” or “Double 11,” the retail holiday, which originated in China but is also celebrated in other countries, culminates on Nov. 11 each year.

Marketed as a foil to Valentine’s Day, Double 11 is a cultural celebration of unwed individuals. In the weeks leading up to Nov. 11, single people buy themselves gifts and attend various social events.

In 2024, total retail spending for Double 11 increased by 26.6 per cent year over year to 1.44-trillion renminbi (the equivalent of $285-billion) in China alone, according to an estimate from retail data service provider Syntun Ltd.

Prior to the pandemic, the ICBK-led group briefed officials at major Canadian banks to solicit their support for the proposed payment processor, the source said. The proposal instead elicited some concern about the security of customer payment data, the person added.

FinTRAC report shows examples of suspicious ICBK account activity

The Bank of Canada is responsible for supervising payment service providers to ensure they manage operational risks and safeguard customers’ funds. Spokesman Paul Badertscher said the central bank is not aware of the ICBK-led proposal and cannot comment on any specific company.

The Minister of Finance also has “a mandate and powers to address national security risks” posed by foreign and domestic payment service providers, said Marie-France Faucher, an official with the Department of Finance.

Industrial and Commercial Bank of China Ltd., ICBK’s parent company, facilitates banking via WeChat, a Chinese messaging and mobile payments app, according to its website.

ICBK declined to say if its Canadian customers are also transacting via WeChat or other Chinese apps. Nor did it specify how the bank protects Canadian customer data. Similarly, it did not directly answer a query about whether its administrative record-keeping systems and Canadian customer data, including debit- and credit-card payment information, are stored in Beijing.

The Office of the Privacy Commission of Canada said companies subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) are not prohibited from processing or storing personal information in another jurisdiction. However, PIPEDA does have rules that govern how companies transfer personal information to a third party for processing, said spokesman Vito Pilieci.

At least three pieces of legislation – China’s National Security Law (2015), China’s National Intelligence Law (2017) and China’s Cyber Security Law (2017) – compel People’s Republic of China commercial entities and individuals to assist the government and intelligence services with security issues when required.

“It may force locally employed PRC personnel of Canadian companies to assist in PRC intelligence operations,” states a 2022 brief by the Canadian Security and Intelligence Service, referencing China’s National Intelligence Law. The document, which was partly redacted, was declassified and released at the Hogue Commission last September.

Neither ICBC, which operates its own militia in China, nor ICBK provided comment in response to a query about whether the Canadian lender provides any assistance to the Chinese government for intelligence and security purposes.

A 2023 report by the Department of Finance also warned that foreign bank subsidiaries in Canada often have clients, including Canadian citizens and foreign nationals, who are politically-exposed people or have connections to high-risk jurisdictions.

The Financial Transactions and Reports Analysis Centre of Canada, meanwhile, requires banks to conduct PEP screening. The regulator also provides guidance on how businesses should report suspicions of money laundering and terrorist financing.

“In late 2023, the director and CEO of FinTRAC announced that some businesses were not where they should be from a compliance perspective and that the centre was ramping up significantly its enforcement action to protect Canadians and Canada’s financial system,” spokeswoman Mélanie Goulette Nadon said in an e-mailed statement.

The Financial Action Task Force (FATF), an intergovernmental body that sets standards to combat financial crime, concluded in 2016 that Canada may be particularly vulnerable to the laundering of the proceeds of Chinese corruption.

Canada is preparing for another review by the FATF this year. China, however, isn’t on either the FATF’s “black list” or “grey list” of high-risk countries with weak financial-crime controls.