Undertaking for the sharing of information with insurers

Introduction:

This advisory clarifies the form and the filing of the undertaking that a federally regulated deposit-taking institution (i.e., a bank, an authorized foreign bank, an entity to which the Trust and Loan Companies Act applies, an association to which the Cooperative Credit Associations Act applies) as well as provincially incorporated trust or loan companies controlled by a federally regulated deposit-taking institution or a bank holding company (collectively referred to as “DTI”) shall obtain from an insurance company, agent or broker (collectively referred to as “insurer”) to whom it wishes to provide information respecting the DTI’s customers.

Legislative References

Section 6 of the Insurance Business (Authorized Foreign Banks) Regulations

Sections 8 and 8.1 of the Insurance Business (Banks and Bank Holding Companies) Regulations

Section 7 of the Insurance Business (Cooperative Credit Associations) Regulations

Section 8 of the Insurance Business (Trust and Loan Companies) Regulations

Interpretation:

These Regulations limit the flow of information from a DTI to insurers. In particular, a DTI cannot provide information respecting its customers unless:

1. the DTI has established procedures to ensure that the information will not be used by an insurer to promote in Canada the insurer, an insurance policy, or a service in respect of an insurance policy; and

2. the insurer has given an undertaking to the DTI, in a form acceptable to the Superintendent of Financial Institutions (the “Superintendent”), that it will similarly limit its use of that information.

While the Regulations provide that the undertaking must be given to the DTI, the historical practice has been for the insurer to provide the undertaking to both the DTI and the Superintendent. There was a further requirement in the undertaking for the insurer to provide an annual compliance certificate to both the DTI and the Office of the Superintendent of Financial Institutions (OSFI).

OSFI has reconsidered this practice and determined that the undertaking and the compliance certificate shall only be provided to the DTI. In this context, the attached “form” of undertaking, or an information sharing agreement that would include the undertakings set out in paragraph (a) to (e), or as read by screen readers, paragraphs 1 to 5, of the attached “form”, is considered acceptable to the Superintendent. Furthermore, insurers that have provided undertakings under the previous form are no longer required to file an annual compliance certificate with OSFI.

Undertaking

• Insurance Business (Authorized Foreign Banks) Regulations,
• Insurance Business (Banks and Bank Holding Companies) Regulations or
• Insurance Business (Cooperative Credit Associations) Regulations
• Insurance Business (Trust and Loan Companies) Regulations

From: (insert name of insurance company, agent or broker)

To: (insert name of bank, federally incorporated trust or loan company, cooperative credit association, provincially incorporated trust or loan subsidiary or authorized foreign bank that will provide the information (the DTI))

As required by paragraph 8(2)(b) [or 8.1(2)(b)] of the Insurance Business (Banks and Bank Holding Companies) Regulations, [or 8(2)(b) of the Insurance Business (Trust and Loan Companies) Regulations, or 7(2)(b) of the Insurance Business (Cooperative Credit associations) Regulations, or 6(2)(b) of the Insurance Business (Authorized Foreign Banks) Regulations], and in consideration of (insert name of the DTI) providing information respecting its customers to (insert name of insurance company, agent or broker), the latter undertakes that:

1. the information will not be used to promote in Canada itself, or to promote in Canada an insurance policy or a service in respect thereof;

2. it will take all reasonable steps to ensure that the information is not used by any other person to promote in Canada (insert name of insurance company, agent or broker), or to promote in Canada an insurance policy or a service in respect thereof;

3. it will take all reasonable steps necessary to ensure that this Undertaking is known to, and adhered to by, its employees;

4. it will, if requested by (insert name of the DTI), make no further use of the information respecting customers of (insert name of the DTI); and

5. it will, on or before January 31 of each year, provide (insert name of the DTI) an affidavit [compliance certificate] indicating that it is in compliance and has been in compliance with the terms and conditions of this Undertaking during the previous year ended December 31.

Dated at (insert name of place and province) this (insert date).