Data security questions Canadian banks should ask their compliance vendors

Data sits at the heart of a firm’s operations, making data governance the system that keeps it running. A strong data governance framework drives decision-making, supports compliance, enables firms to integrate new technologies, and, perhaps most importantly, reinforces risk management.

Data security goes hand in hand with data governance. With many firms relying on external providers to support critical operations, maintaining oversight of third parties within your data ecosystem is critical to business resilience. 

In Canada, financial regulators have also underscored the role of data sovereignty in supporting operational resilience. What should Canadian firms be asking their compliance vendors to maintain control of their data infrastructure?

Why does this matter for Canadian banks?

As the industry evolves, it’s more important than ever that firms reassess their data environment to maintain security, control, and resilience. This is particularly pertinent for Canadian firms for a few reasons:

1) Maintaining control when “hyperscalers” go down

Recent operational incidents have highlighted how many large-scale disruptions involve third-party providers that rely on public clouds, such as the Amazon Web Services (AWS) outage, which affected more than 2,000 companies worldwide.

Firms also need to consider fourth-party risk and whether there are any invisible vendors in their supply chain. For example, many businesses affected by the AWS outage didn’t work with the public cloud provider but were affected because their third-party provider used AWS’s cloud. 

Questions to ask your compliance vendor:

• Do you depend on any public third-party cloud providers?
• What processes do you have in place to identify, detect, and respond to cyber incidents and risks?

2) Data sovereignty as a priority in Canada

Data sovereignty has become a focus in Canada, especially to reinforce privacy standards. The Government of Canada released a white paper highlighting the risks public cloud environments and “hyperscalers” pose to data sovereignty, including impacts on security posture and the protection of sensitive data.

A report from the Canadian Anti-Monopoly Project found that 85% of Canada’s public cloud market is controlled by Amazon, Google, and Microsoft. This reliance on foreign providers could subject Canadian firms to laws within international jurisdictions, such as the U.S. Cloud Act. Under this Act, U.S. authorities can compel Canadian firms to share sensitive data if they work with a U.S.-based provider, even if it’s stored in another country.

Questions to ask your compliance vendor:

• Do you have full control of your data stack?

3) Regulatory expectations around operational risk and vendor due diligence

Financial regulators like the Office of the Superintendent of Financial Institutions (OSFI) and the Canadian Investment Regulatory Organization (CIRO) have set expectations for managing operational risk as cyberthreats and disruptions evolve.

OSFI’s E-21 framework sets out guidelines for firms to prepare for and defend against severe operational disruptions by maintaining governance, mapping dependencies, and managing data risks. OSFI’s B-10 framework sets out risk management expectations related to third parties and their criticality to a firm’s operations. 

Similarly, CIRO establishes pillars to support operational resilience in its Technology Risk Management Guidelines, such as confidentiality, integrity, and sustainability. It also states that vendor due diligence is crucial to ensure vendors can deliver critical services and meet firms’ performance standards.

Questions to ask your compliance vendor:

• Do you have an incident response plan and a process for monitoring outages?
• What are your backup or redundancy plans?

4) Evolving technologies accelerate the need for secure data infrastructure

Technologies like artificial intelligence (AI) take data governance to a whole new level. As firms increasingly adopt AI into business operations, they must consider their data foundations. Without a strong data foundation, AI can’t process information and scale operations successfully – a point the Canadian Government has made in its national AI sovereignty strategy.

Questions to ask your compliance vendor:

• How do you structure and normalize data for AI enrichment?
• What measures do you have in place to support explainability and model governance?

5) Sustainability depends on responsible data centers

Data centers are incredibly energy-intensive and are already having major environmental impacts by consuming electricity, using substantial amounts of freshwater, and increasing carbon emissions. Gartner found that data center energy consumption is projected to grow 26% in 2026. 

The Canadian Government released principles for responsible data center development, which outline considerations around environmental impacts, electricity costs, and local impacts. Responsible, or “green,” data centers provide greater efficiency, cost savings, and sustainable technology infrastructure.

Questions to ask your compliance vendor:

• What energy-saving features have you implemented for your data center?
• How does your data center minimize its carbon footprint?

How Global Relay can support

With these points in mind, it’s important that Canadian firms work with compliance providers that have full control of data stacks, maintain security standards, and offer sustainable infrastructure. Global Relay’s compliance technology can meet these needs:

Technology built from scratch

We built our technology from the ground up, meaning that all our products have been carefully designed and structured in-house. While other vendors may rely on acquired solutions or external providers, we are a single-vendor, end-to-end solution that operates independently.

We have complete control over our products and infrastructure, from communications capture to data archiving to compliance monitoring. This mitigates breaches or outages that could occur if data were being passed between systems. In the unlikely event of an outage, we could promptly identify and address it, which greatly reduces interruptions. 

Robust security standards

We have a layered approach to our security to ensure that records are secure, accessible, and tamperproof. As part of this approach, we apply strict access controls so that only designated individuals within your firm can retrieve data.

We encrypt data with cryptographic and authentication protections, perform constant integrity checks to preserve its integrity, and adhere to global security standards such as ISO 27001 and SOC 2. Additionally, we have continuous threat monitoring and incident response teams.

Green and sustainable data center

Our green data center uses eco-friendly data storage and management to reduce its carbon footprint. It does this by using alternative technologies like free air cooling, evaporative cooling, and clean hydroelectric energy. Alongside this, our data center doesn’t use a coal-powered air conditioning to operate, which minimizes carbon emissions.

Together, these features better position Global Relay to help firms manage evolving industry risks, retain full visibility of their data, and scale their business operations securely.

Data security is essential to protect sensitive information against evolving risks, and at Global Relay, protecting your data is our top priority. Learn more about our security-first approach here.