• Home
  • Selling Moneris to U.S. Private Equity Won't Hurt Privacy. It Will Erase the Option to Regulate It.
Selling Moneris to U.S. Private Equity Won't Hurt Privacy. It Will Erase the Option to Regulate It.
By Erin Fraser profile image Erin Fraser
3 min read

Selling Moneris to U.S. Private Equity Won't Hurt Privacy. It Will Erase the Option to Regulate It.

RBC and BMO are offloading Moneris Solutions Corp., the processor that handles roughly one in three card transactions in Canada, to Francisco Partners, a San Francisco private equity firm. The deal will almost certainly clear Investment Canada Act review because the Canadian government has no framework that treats payment infrastructure as anything other than a business asset. That's the actual problem.

The privacy objection being raised in Ottawa right now is backwards. Critics worry that U.S. ownership means Canadian consumer spending data falls under the Patriot Act, which technically it might, though Moneris will still have to comply with PIPEDA for Canadian operations. Fine. But even if Francisco Partners were a model corporate citizen with ironclad data governance, the structural issue remains: once you sell the rails, you lose the ability to write new rules for them.

Why the banks are selling now

RBC and BMO founded Moneris in 2000 as a joint venture. For two decades, it functioned as a quasi-utility, deeply integrated with Canada's two largest banks, servicing over 325,000 merchant locations. The business model was stable. The margins were thin but predictable. What changed is that payment processing stopped being a stable hardware business and became a software race against Stripe, Square, and every other fintech competitor that can spin up a merchant onboarding flow in three clicks.

The banks looked at the capital requirements to modernize Moneris and decided they'd rather own the consumer relationship than the pipes. That's a rational business decision. It's also a retreat from the technical plumbing of Canadian commerce, and it means the people who control that plumbing now answer to Francisco Partners' LP returns, not to Ottawa.

The jurisdictional gap nobody's addressing

Here's what matters more than the Patriot Act angle: Canada is in the middle of updating its privacy framework through the Digital Charter Implementation Act (C-27), which includes new rules on data portability and de-identification. If Moneris were still owned by RBC and BMO, Ottawa could lean on those institutions when writing regulations that affect payment data. Canadian banks operate under significant regulatory oversight. They respond to the Office of the Superintendent of Financial Institutions. They get calls from the Bank of Canada. They show up when summoned.

Francisco Partners does not. A U.S. private equity firm with a Canadian subsidiary has to follow Canadian law, but it does not have to cooperate with Canadian regulators who want to pilot new frameworks before they become law. It does not participate in the informal coordination that happens when Ottawa is designing policy and needs the major players in a sector to stress-test it. That channel just closed.

What gets harder after the sale

Payment data is the highest-resolution map of consumer behavior in the economy. Moneris processes over 3 billion transactions annually. That dataset shows where Canadians spend, when they spend, what they cut when money gets tight, and which sectors are seeing stress before it shows up in official statistics. Policymakers used to be able to assume that dataset was managed by entities whose executives would take a call from the finance ministry. That assumption is now wrong.

If Canada wanted to implement real-time fraud monitoring requirements, or mandate transaction-level transparency for certain merchant categories, or build interoperability rules that let consumers port payment data to new platforms, the government would now be negotiating with a private equity firm whose only obligation is shareholder return. Francisco Partners will comply with the law. It will not help design it.

The privacy risk isn't that your Visa transaction gets subpoenaed by the FBI. The risk is that Canada no longer has a domestic owner of payment infrastructure it can regulate proactively. The door didn't close. The option to build the door just got sold to someone who doesn't live here.