The rollout of the Consumer Privacy Protection Act (CPPA) was completed by the end of September 2024 in Canada. It means that investment firms and wealth managers need to think seriously about how to best meet its requirements.
The Act centres on the need to carefully manage data management to protect individuals’ data. Wealth managers will avoid excessive data collection, instead focusing on collecting only the data they need.
That means introducing structure to data collection and storage.
Outdated manual or paper-based form filling will need to go once and for all. Data will need to be collected once only and then reused internally using a single golden copy, not jotted down in several places and held in silos.
By aligning more closely with global privacy standards, such as the General Data Protection Regulation (GDPR) in the European Union, the CPPA helps Canadian businesses operate internationally by ensuring that they meet the privacy requirements of other jurisdictions.
How will the Act affect wealth managers?
In a nutshell, all wealth managers and their service providers that use and store personal data will have to adopt protocols and tools to properly manage the lifecycle of all personal data – from consent in gathering it, the way they use it throughout its time with them, and then its deletion.
| Wealth managers will need to | Example | How can we help? |
|---|---|---|
| Avoid collecting information multiple times and move to a ‘capture once reuse many times’ model of data capture and storage. | Wealth managers will need to get rid of multiple forms that ask for the same piece of information i.e. name, and address. Instead, they will need to collect that information once and then share and reuse it wherever it is required i.e. suitability, KYC, risk etc. | Our solution gives you a single source of truth for your client data. It gathers data from the first interaction with your clients, enters it once and reuses throughout the client lifecycle. This means you get rid of data being duplicated or holding several versions of the same date point – some of which might be outdated or inaccurate. |
| Introduce and communicate to clients stronger rights over accessing and correcting data, plus their right to withdraw consent for data use. | Wealth managers will need to have an upfront discussion with their clients about data use and get their consent before they start collecting any personal data. They will also need to make sure clients understand how they can access their own data or request it be deleted. | By introducing a checklist into prospecting, onboarding, and other areas that need data collection, wealth managers are prompted to confirm they have sought consent and explained to clients how data is used. |
| Put into place a framework with robust processes and protocols that are transparent and secure. This includes reporting any data breaches to individuals and the authorities if needed. | Wealth managers need to instil a process to facilitate and evidence consent in data collection throughout the client lifecycle. They should also provide internal guidelines and ongoing training so that staff know how to follow the new rules. | Our sophisticated workflow engine integrates your policies and regulations into your processes, reducing errors and manual tasks. Every interaction on every channel is tracked meaning you get a full audit trail to evidence regulatory compliance and to flag any risks that require prompt mitigation. |
| Promote firm-wide accountability through the use of enforcement mechanisms such as fines. Firms also need to consider the reputational risk of non-compliance. | Wealth managers need to support a culture where data privacy is taklen seriously. They also need to appoint a privacy committee and a privacy officer to lead on this as well as manage data privacy policies and procedures and oversee ongoing development. | Built-in checks and balances, with automated alerts and execution, support regulatory adherence and provide a full audit trail of actions and interactions no matter what channel is used. This supports a wealth manager to instil the right processes and support those leading on data privacy to check that all is well. |
| Provide a framework to anonymise any data they want to use for analytics and inform clients of their intent. (They do not need consent if the data is properly anonymised). They will need to have strong safeguards and be transparent about their data practices. | A wealth manager might want to use data from all its clients to identify trends to inform marketing or service provision. This is allowed as long as the data contains nothing that might identify an individual. | Our solution has sophisticated and transparent security options, including tokenisation and deindexing of client-identifying data. |
How else can Wealth Dynamix help?
The need to pay close attention to how data is collected, stored and used is something we have a great deal of experience in.
Since early 2012, Wealth Dynamix has been delivering solutions that provide wealth management firms with rapidly deployed solutions to regulatory challenges; solutions that truly deliver ‘compliance by design’.
Who are we?
We provide multi-award-winning, fully integrated, end-to-end digital Client Lifecycle Management (CLM) solutions that address the complex requirements of all phases of the client lifecycle (i.e., client acquisition, digital onboarding, regulatory compliance, relationship management, client engagement, and ongoing client servicing) in the wealth management industry.
Our CLMi solution is a revolutionary, SaaS-based Client Lifecycle Management (CLM) product. It leverages leading cloud technologies that are tailored specifically for any size of wealth management firm or private bank.
Our CLM Platform comes embedded with best practice workflows, data models and integrations – meaning you can rely on us to work seamlessly with existing middle and portfolio management solutions within your tech stack.
