Canadian banks' retail compliance teams can use AI agents to test whether products sold were appropriate for the customer, check complaint handling against consumer protection rules, review fee and rate disclosures, and keep model inventories current under OSFI Guideline E-23. FCAC and OSFI hold the bank accountable, so findings on sales conduct, complaint outcomes and model approval stay with people.
What do retail banking compliance teams in Canada spend their time on?
Canadian banks are federally regulated. OSFI supervises their safety and soundness, including model and technology risk, and FCAC supervises their consumer protection obligations. Retail compliance spends much of its effort on how customers are sold to and treated.
Sales appropriateness. Banks must take into account a customer's circumstances and needs before offering or selling products and services, and must not use pressure tactics. Following past concerns about aggressive sales in Canadian retail banking, this area gets close supervisory attention.
Complaints. Banks must handle complaints through a defined internal process, refer unresolved complaints to an external complaints body, and record and report complaint information.
Disclosure. Fees, interest rates and key terms must be disclosed clearly and in a timely way, in English and French.
Model risk. Credit adjudication, pricing, fraud detection and collections rely on models, including machine learning. OSFI Guideline E-23 sets expectations for managing model risk across the lifecycle, and agents that inform decisions fall within it.
Privacy. Customer data is personal information under PIPEDA.
Where can agents help?
Depth caps how far an agent may act: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.
| Use | What the agent does | Depth |
|---|---|---|
| Sales appropriateness testing | Compares products sold with the customer's recorded needs and circumstances, and flags sales such as multiple credit products opened in one visit or products inconsistent with stated needs | 1 |
| Complaint process testing | Checks complaints against the process steps, timelines and referral requirements, and lists breaches | 1 |
| Disclosure review | Reads fee schedules, account agreements and marketing in English and French, and flags missing or inconsistent disclosures | 1 |
| Model inventory upkeep | Identifies new or changed models and agents from project and change records, and drafts inventory entries with owner, use and risk tier | 2 |
| Complaint reporting | Drafts the periodic complaint report from the complaint register | 2 |
Sales appropriateness testing is the most Canada-specific use: the obligation is explicit, it is a supervisory focus, and branch and digital sales generate volumes no team can review in full.
What stays with people?
The broader question of which compliance decisions can never be delegated is covered in which compliance decisions must stay with a person. In Canadian retail banking, five stand out.
Concluding that a sale was inappropriate. A flagged sale may have a sound explanation in the customer's circumstances. Deciding otherwise, and remediating, is for compliance with the business.
Complaint outcomes. Whether a complaint is upheld, and what the customer receives, stays with complaint handlers.
Model approval. Whether a model or agent is fit for use is a decision for model owners and independent validation under E-23.
Staff consequences. Where testing points to an individual's sales practices, any action is for management and human resources.
Reporting to FCAC and OSFI. Breach reports and responses to supervisors are made by responsible officers.
Which Canadian rules apply?
Canada has no federal AI act in force. Banks' agents are governed by federal financial regulation and privacy law. The broader view is in how AI agents are regulated in Canada.
FCAC supervises federally regulated financial institutions' compliance with consumer protection obligations, including appropriateness of products and services, prohibition of pressure selling, disclosure, and complaint handling and reporting. Communications and tests an agent produces are part of how the bank meets these.
OSFI and Guideline E-23. OSFI supervises federally regulated financial institutions. E-23 sets expectations for model risk management across the lifecycle, including inventory, risk rating, validation, monitoring and governance, with scope covering AI and machine learning. OSFI also expects banks to manage third-party and technology risk, which covers an agent's provider.
PIPEDA. Governs personal information in commercial activity: consent, identified purposes, limiting use, safeguards and individual access.
Provincial securities regulators supervise investment dealing, relevant where retail branches sell investment products.
AML law, consistent with FATF standards, applies to due diligence, monitoring and reporting.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How to start in the first 90 days
Days 1 to 30. Enter the compliance agent in the model inventory and agree its risk tier with model risk. Start with complaint process testing, which has clear rules and existing quality assurance results to compare against.
Days 31 to 60. Replay the agent against a quarter of complaints already reviewed by quality assurance. Resolve every disagreement, then begin sales appropriateness testing on one product family.
Days 61 to 90. Run both uses monthly, with compliance reviewing every flag. Indian banks face a different regulator and a different conduct focus; see compliance agents in Indian retail banking.
Where Pryme fits
In Pryme, the sales appropriateness tester runs at depth 1 and reads customer needs and product records stamped with their provenance, so a declared need is weighed differently from verified data. Attest replays it against your own past sales and complaint files, and the certificate lapses after 90 days unless renewed. Every verdict is filed, which supports both E-23 documentation and FCAC reviews. The guide to AI compliance agents explains the principle.
Questions people ask
Does OSFI Guideline E-23 apply to a compliance agent?
E-23 covers models whose outputs inform decisions, including AI. A compliance agent that flags sales for review informs decisions, so treat it as in scope and rate its risk accordingly.
Can an agent identify pressure selling?
It can flag patterns that suggest it, such as several products sold together or sales inconsistent with stated needs. Establishing pressure selling requires a person to review the interaction and context.
Should the agent review French disclosures separately?
Yes. Review each language against the same standard and compare them, because the bank must disclose clearly in both.