CASL compliance for mortgage brokers

What CASL actually covers

Canada's Anti-Spam Legislation — formally S.C. 2010, c. 23 — prohibits sending a commercial electronic message to an electronic address unless the recipient has consented and the message meets the content requirements (section 6(1)). “Electronic address” is defined in section 1 to include email, instant messaging and telephone accounts, so a text message to a borrower's mobile is in scope in exactly the same way as an email.

A message is commercial if one of its purposes is to encourage participation in a commercial activity. For a mortgage brokerage that is almost everything outbound that is not about a file already in progress: rate updates, renewal outreach, newsletters, 'thinking of refinancing?' campaigns, referral asks, and the monthly market commentary an agent sends to their whole database.

Phone calls are not CASL. Voice calls are governed by the CRTC's telemarketing and National Do Not Call List rules, which are a separate regime with their own calling hours and registration obligations. This guide is about email and text.

Express consent versus implied consent

Express consent is a positive opt-in: the person ticked an unticked box, typed their email into a form that said what they would receive, or told you on a recorded call that they want your updates. Once you have it, it does not expire. It lasts until the person withdraws it.

The CRTC's regulations (section 4) set what a request for express consent has to include: who is asking, on whose behalf, contact information, and a statement that consent can be withdrawn. Consent to marketing also has to be sought separately — a pre-checked box, or consent folded into your terms of engagement, is not the opt-in the CRTC expects.

Implied consent is consent the Act infers from the relationship, and it is where brokerages get into trouble, because it has an expiry date that nobody writes down. Section 10(9) lists the situations; the ones that matter for mortgage marketing are an existing business relationship and, for business contacts only, a published or disclosed address.

The two clocks, applied to a mortgage book

Walk the life of an ordinary lead and you can see where consent quietly lapses.

A prospect fills in a pre-approval form in March and never proceeds. You have implied consent from the inquiry for six months. In October, if you have not obtained express consent, their address is still in your CRM, still on your newsletter list, and no longer yours to email for marketing.

A client funds with you. The mortgage relationship gives you a business-relationship basis, but the funded file is also the moment of highest goodwill you will ever have with that person. It is the cheapest point to ask for express consent, and the brokerages with clean lists ask then as a matter of routine.

Your database is probably full of the third category: contacts imported from an old system, a former brokerage, a spreadsheet, a trade show, with no record of how they got there. Section 13 of the Act puts the onus of proving consent on the person who claims it. An address with no source and no date is, in practice, an address you cannot defend.

• Record the basis (express, implied-inquiry, implied-client, published) and the date it arose on every contact.
• Record where it came from: the form, the call, the funded deal, the directory.
• Suppress marketing automatically when an implied basis passes its window, rather than relying on someone to run a report.
• Treat an unknown basis as 'ask first', not as 'probably fine'.
• Run a re-permission campaign to lapsing implied contacts before the clock runs out, not after.

What every commercial message must contain

Consent is half the obligation. Section 6(2) requires every commercial electronic message — including one sent on a perfectly valid basis — to identify the sender and anyone it is sent on behalf of, give information to contact them, and include an unsubscribe mechanism. The CRTC regulations (section 2) specify the identification: the business name, a mailing address, and a phone number, email address or web address.

For a brokerage, 'on whose behalf' is the detail that catches people. An agent emailing their own database under the brokerage's licence is usually sending on the brokerage's behalf as well as their own, and the message should say so. A campaign sent from a head-office platform with each agent's name on it needs both.

The unsubscribe rules are in section 11. The mechanism has to be free, use the same electronic means where practicable, and point to an address or web page that stays valid for at least 60 days after the message is sent. The request must be given effect “without delay, and in any event no later than 10 business days.” The CRTC regulations add that it must be “readily performed” — a login wall or a five-screen preference centre fails that test.

• Business name, and the agent's name where the agent is the sender.
• A real mailing address — the brokerage office, not a P.O. box nobody checks.
• A phone number, email address or website that reaches a person or voicemail.
• A one-click or reply-to unsubscribe that works without logging in.
• Unsubscribes applied across every agent's list, not only the list the message came from.

Exemptions brokers actually use

Section 6(6) of the Act removes the consent requirement — but not the identification and unsubscribe requirements — for messages that solely do certain things. The two that cover most day-to-day broker email are a message that provides a quote or estimate the person requested (6(6)(a)), and one that “facilitates, completes or confirms a commercial transaction” the person previously agreed to (6(6)(b)). Document requests, condition updates and closing logistics on a live file sit here.

Section 6(5)(a) excludes messages to people with whom the sender has a family or personal relationship, as those terms are defined in the Electronic Commerce Protection Regulations (section 2). The definitions require real two-way communication; a contact you met once at an open house is not a personal relationship.

The referral exemption is in section 4(1) of those same regulations, not in the Act. It lets you send the first commercial message to someone you were referred to, provided the referrer has a relationship with both you and the person, and the message discloses the referrer's full name and states that it is sent as a result of the referral. It covers one message. If they do not reply with consent, the exemption is spent.

1. 1

   A realtor sends you a buyer

   Your first email can rely on the referral exemption if it names the realtor in full and says the buyer was referred. Ask for consent in that email.

2. 2

   The buyer replies with questions

   They have now made an inquiry. You have six months of implied consent from that date, and every reply about their file is transactional anyway.

3. 3

   The file funds

   Ask for express consent to ongoing updates — rate alerts, renewal check-ins — as part of the closing sequence, and record the answer either way.

Penalties and who enforces them

The CRTC enforces the anti-spam provisions. Section 20(4) of the Act sets the maximum administrative monetary penalty at $1,000,000 per violation for an individual and $10,000,000 for any other person — which includes a brokerage corporation. Officers and directors are liable for a corporation's violation if they “directed, authorized, assented to, acquiesced in or participated in” it (section 31). Section 32 is the one a brokerage with agents should read: a person is liable for a violation committed by an employee acting within the scope of their employment, or by an agent acting within the scope of their authority, whether or not that individual is identified.

The private right of action that would have let recipients sue directly was never brought into force. The government suspended it in 2017, and sections 47 to 51 now appear in the consolidated Act as repealed before coming into force. That removes the class-action risk, not the regulatory one.

Because section 13 puts the onus on the sender, the practical defence is the same at any size: a record, per contact, of the basis, the date and the source. The CRTC publishes its enforcement actions, and reading a few is the quickest way to see what an investigation actually asks for.

Making it hold across a brokerage

CASL compliance fails in brokerages for the same reason FINTRAC compliance does: it depends on each agent getting it right on their own list, on their busiest week. The fix is to move the rules out of people's heads and into the system that sends the message.

In Mortgage360, each CRM contact carries a consent basis and a consent date. When an agent sends from the mortgage CRM, the send checks the basis: implied consent past its six-month or two-year window is refused with a reason, and a contact recorded as a deal participant with no consent — a co-signer or guarantor — is blocked from marketing. Outbound email gets the sender identification, mailing address and a signed unsubscribe link added if the template does not carry one, plus a one-click unsubscribe header mail providers recognise. The compliance screen shows the do-not-call list and opt-out rates, and automations send through the same checks, so a drip cannot bypass them.

None of that decides your consent basis for you. A contact imported with the wrong basis will be treated as whatever you told the system. The work is in recording the basis honestly at the point the contact arrives.

• Decide the consent wording once, at brokerage level, and use it on every form and every agent's site.
• Capture the basis and date on import; refuse imports that have neither.
• Ask for express consent at funding as a standard closing step.
• Suppress on lapse automatically, and send re-permission requests before the window closes.
• Honour unsubscribes firm-wide, within the ten business days — ideally within the minute.

Sources

1. Canada's Anti-Spam Legislation, S.C. 2010, c. 23 (full text) — Justice Laws Website
2. Electronic Commerce Protection Regulations, SOR/2013-221 (referral exemption, s.4) — Justice Laws Website
3. Electronic Commerce Protection Regulations (CRTC), SOR/2012-36 — Justice Laws Website
4. Compliance and Enforcement Information Bulletin CRTC 2012-548 — CRTC
5. Compliance and Enforcement Information Bulletin CRTC 2012-549 — CRTC
6. Frequently asked questions about Canada's anti-spam legislation — CRTC
7. Guidance on implied consent — CRTC
8. SI/2017-31: private right of action provisions not brought into force — Canada Gazette
9. Canada's anti-spam legislation — Innovation, Science and Economic Development Canada