Moneris Sale to US Firm Raises Privacy Concerns

The Deal Terms

RBC expects a $475 million after tax gain from the sale. BMO anticipates a $600 million gain. The transaction, announced earlier this week, shifts ownership of a major Canadian commerce solutions provider into American hands.

Why This Payment Processor Matters

Moneris isn’t a minor player. It processes roughly one in three payment transactions across Canada, according to a company press release.

• Services over 325,000 points of commerce nationwide
• Handles more than $5 billion in transactions every year
• Processes approximately one third of all Canadian payment transactions

That scale is exactly why the sale is drawing scrutiny from privacy advocates and lawmakers alike.

The Digital Sovereignty Problem

Digital sovereignty refers to a country’s control over its own digital assets, and Canadian officials have been vocal about protecting it. AI Minister Evan Solomon has previously stated Canada needs a sovereign digital economy free from coercion.

Dozens of experts penned an open letter urging Prime Minister Mark Carney to protect Canada’s digital sovereignty following the announcement. Sharon Polsky, president of the Privacy and Access Council of Canada, shares that concern directly.

What Happens to Canadians’ Data

Polsky warns that Moneris’s access to Canadians’ purchasing habits could expose that data to foreign law enforcement once ownership shifts. She specifically cited the possibility of US border agents checking transaction histories for cannabis purchases, since cannabis remains federally illegal in the United States despite being legal in Canada.

Senator Colin Deacon raised similar concerns on CBC’s Power and Politics, worrying that the US government could compel data sharing on an individual basis. The timing makes this more concerning rather than less. The deal is unfolding amid an active trade war between the two countries, and Polsky suggests rich transaction data could end up informing trade negotiations in ways Canadians never anticipated.

Canada’s Privacy Laws Are Falling Behind

Polsky argues that Canada’s current digital privacy legislation simply isn’t adequate for this moment. Canadian law is less stringent than American requirements, which creates an uncomfortable asymmetry. A Canadian company caught between the two legal systems might end up complying with US law over Canadian legislation when the two conflict.

The government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, in June to update the country’s privacy framework. The bill requires privacy impact assessments for data transfers outside Canada, but Polsky isn’t convinced it goes far enough.

She believes Bill C-36 and other legislative attempts dance around the issues without addressing data retention in Canada as a matter of national security or digital sovereignty. This marks the third attempt to update Canada’s privacy regulations, which itself says something about how difficult this problem has been to solve.

What Happens Next

The Moneris sale still needs regulatory approval, including Competition Act clearance, before it can close. The deal is expected to finalize by the end of the banks’ fiscal first quarter in 2027, giving regulators and lawmakers a narrow window to address these concerns before ownership officially changes hands.

Polsky put it bluntly: Canada is behind the eight ball on digital sovereignty, and this sale is likely to become a test case for whether that gap gets addressed or simply gets wider.

Hashlytics Take

This deal is a preview of a pattern that’s going to repeat across Canadian tech and financial infrastructure. Canada keeps building critical digital assets, then selling them to US buyers the moment a premium valuation shows up, and each time the sovereignty conversation gets treated as an afterthought instead of a dealbreaker. The real story here isn’t Moneris specifically. It’s that Canada has no consistent framework for deciding which infrastructure is too sensitive to sell, and until that changes, this exact headline will keep happening with a different company name attached.