Effective April 23, 2025, Financial Institutions will be required to have an information security incident management policy and be prepared to report any security incident to the Autorité des marchés financiers (the AMF) within 24 hours.

Published in the Gazette officielle du Québec on October 23, 2024, the Regulation respecting the management and reporting of information security incidents by certain financial institutions and by credit assessment agents (the Regulation) establishes new requirements aimed at enhancing the management and reporting of information security incidents to the AMF.

The Regulations define an "information security incident" as an attack on the availability, integrity or confidentiality of information systems or the information they contain¹.

In contrast to the Act respecting the protection of personal information in the private sector and the Personal Information Protection and Electronic Documents Act, the Regulation’s scope extends beyond incidents involving only personal information, covering breaches that may impact the physical integrity of computer systems as well.

Targeted entities

The Regulations, which will come into force on April 23, 2025² , will apply to insurers, mutual companies, federations, credit unions not members of a federation, deposit institutions, trust companies and credit assessment agents (the Financial Institutions)³.

Information security incident management policy

By April 23, 2025, Financial Institutions must adopt a comprehensive information security incident management policy (the Policy) that includes specific procedures for detecting, assessing and responding to incidents. The Policy must also extend to third parties entrusted with information management and processing activities and incorporate clear reporting protocols for Financial Institution management and relevant stakeholders, including consumers, subcontractors and regulatory bodies such as the AMF and any other competent authorities⁴.

Reporting obligations

The Regulation places substantial reporting responsibility on Financial Institutions, adding to existing requirements. In particular, it mandates reporting of any information security incidents “with potentially  adverse impacts”. However, the Regulation does not define this term, leaving broad room for interpretation in assessing the new reporting obligations imposed on Financial Institutions.

Reporting to the AMF

Upon the Regulation’s entry into force, Financial Institutions will be required to report all information security incidents to the AMF within 24 hours. Following this initial report, regular updates must be submitted according to a predetermined schedule, including assessment notices, until a notice is sent to the AMF indicating that the incident is under control and that operations have returned to normal.

This obligation aligns closely with the reporting requirements set by the Office of the Superintendent of Financial Institutions (OSFI), which mandates a similar 24-hour reporting period for federally regulated financial institutions (FRFIs) under its Technology and Cyber Security Incidents Reporting advisory.

Incident report to AMF

Within 30 days after notifying the AMF that an incident is under control, the Financial Institution must submit a detailed security incident report. This report must include specific information such as the source and type of incident, an assessment of potential recurrence, and the measures implemented to reduce the risk of similar future incidents⁵.

Additional obligations

• Each Financial Institution must assign, in writing, an information security incident manager, responsible for overseeing incident management and ensuring compliance with reporting procedures⁶.
• The Regulation mandates that Financial Institutions maintain a current, secured and confidential register of all information security incidents for a minimum of five years from the report date⁷.
• Financial Institutions are also required to coordinate incident reporting with other relevant authorities, including OSFI and local police forces. This obligation also extends to any party contractually bound to compensate for damages resulting from the incident⁸. In such cases, the AMF clarifies that this could include an insurer covering cyber risks⁹.
• If a confidentiality incident is notified to the Commission d'accès à l'information (CAI), it must also be notified to the AMF. However, reporting to the AMF does not automatically trigger a report to the CAI, as an information security incident may involve data beyond personal information. Nonetheless, if the incident involves personal information and poses a serious risk of harm as defined in section 3.5 of the Act respecting the protection of personal information in the private sector, or a real risk of serious harm to an individual under section 10.1(1) of the Personal Information Protection and Electronic Documents Act (PIPEDA), the Financial Institution may need to fulfill obligations under these laws.

Sanctions

Penalties will be applied for failing to report an incident within 24 hours or for not designing a responsible person in writing. These include fines of CA$250 for individuals and CA$1,000 for Financial Institutions.

Non-compliance with other provisions, such as the absence of an incident register or a management policy, may incur higher penalties - CA$500 for individuals and CA$2,500 for Financial Institutions. Financial Institutions will receive a notice of non-compliance before any sanctions are imposed.

Conclusion

The new Regulations, effective April 23, 2025, introduces stricter requirements for Financial Institutions in managing and reporting information security incidents. To ensure full compliance with confidentiality and security incident management obligations, it is essential for Financial Institutions to adopt and update internal policies and procedures that meet both new and existing standards.

If you have questions regarding your obligations under the Regulation or need assistance in implementing compliant policies and procedures according to Québec regulations, please contact the authors, Nathalie Durocher and Charles Giroux.

This bulletin is for informational purposes only, does not constitute a legal opinion and should not be relied upon as such.

[1] Art. 2.

[2] Art. 14.

[3] Art. 1.

[4] Art. 3.

[5] Art. 9.

[6] Art. 4.

[7] Art. 11.

[8] Art 5 al.2.

[9] Notice of consultation (December 7, 2023): Regulation respecting the management and reporting of information security incidents by certain financial institutions and credit reporting agents. [Online] Accessed October 29, 2024.