Canada Already Lost Its Digital Sovereignty, The Moneris Sale Just Made It Obvious
In 2021, when the Liberal government blocked the sale of Neo Lithium to a Chinese buyer on national security grounds, Industry Minister François Champagne called critical minerals "the new oil." Five years later, the same government is watching RBC and BMO sell Moneris, a processor handling 40% of every credit and debit card transaction in Canada, to a San Francisco private equity firm, and the room is silent.
The justification for the lithium block was straightforward. China could weaponize supply chains in a trade war. The metal had strategic value. Now imagine the same logic applied to a company that sees every latte purchase in Lethbridge, every grocery run in Saint John, every gas fill-up from Vancouver to St. John's, and tells you whether Canadians are spending or saving in real time. That's Moneris. Over 325,000 merchant locations. Three billion transactions a year. And the government is treating the sale like a real estate deal.
The Data Isn't Staying in Toronto Just Because the Servers Are
Moneris stores most of its data on Canadian servers, which sounds reassuring until you understand how the U.S. Cloud Act works. Passed in 2018, the Cloud Act allows U.S. law enforcement to subpoena data held by American companies regardless of where the physical servers sit. Francisco Partners is a U.S. entity. Once the deal closes, Moneris becomes subject to U.S. legal jurisdiction even if every byte stays in a Toronto data centre. A Canadian warrant isn't required. A U.S. subpoena is enough.
This isn't hypothetical. In 2020, the U.S. Department of Justice used the Cloud Act to access data stored by Microsoft in Ireland. The company was American. The servers were European. The data moved anyway. Moneris is now walking into the same structure, and the assurance that "privacy laws still apply" ignores the fact that jurisdiction conflicts aren't resolved by privacy commissioners, they're resolved by whoever has enforcement power.
The counterargument you'll hear is that Canada does this too, that our banks share data across borders all the time, that Moneris will still be bound by PIPEDA. True, mostly. But there's a difference between a Canadian bank with U.S. operations sharing data under bilateral agreements and a U.S. private equity firm owning the rails that every other Canadian bank runs on. One is a commercial relationship. The other is infrastructure.
The Precedent Is Worse Than the Transaction
What Francisco Partners is buying isn't the thrill of processing Interac transactions. It's a rent-extraction machine with 40% market share in a country where payments are moving to digital whether consumers like it or not. Private equity doesn't buy assets like this to run them better. It buys them because payment processors are the definition of sticky revenue: low churn, predictable fees, almost no elasticity. You can raise prices half a percent and merchants will grumble but pay because switching costs are brutal.
That model works fine when the owner is two Canadian banks with regulatory obligations and reputational risk in the domestic market. It works differently when the owner is a fund in San Francisco with a seven-year horizon and LPs in London and Singapore. The optimization changes. So does the willingness to push back when a U.S. trade negotiator floats the idea of data-sharing requirements as part of a revised USMCA.
The Investment Canada Act gives the federal government power to block deals that don't provide "net benefit" or that threaten national security. The threshold for invoking it is deliberately vague, which in practice means it almost never gets used unless the acquisition involves a state-owned Chinese firm or actual weapons. Payments infrastructure gets categorized as commercial, not strategic. The Neo Lithium logic doesn't apply, apparently, when the buyer is American and the asset processes your spending habits instead of powering your battery.
Canada didn't lose digital sovereignty with this sale. It lost it years ago, one transaction at a time, under the assumption that commerce and infrastructure are separate categories. Moneris is just the part where we can't pretend anymore.
In 2021, when the Liberal government blocked the sale of Neo Lithium to a Chinese buyer on national security grounds, Industry Minister François Champagne called critical minerals "the new oil." Five years later, the same government is watching RBC and BMO sell Moneris, a processor handling 40% of every credit and debit card transaction in Canada, to a San Francisco private equity firm, and the room is silent.
The justification for the lithium block was straightforward. China could weaponize supply chains in a trade war. The metal had strategic value. Now imagine the same logic applied to a company that sees every latte purchase in Lethbridge, every grocery run in Saint John, every gas fill-up from Vancouver to St. John's, and tells you whether Canadians are spending or saving in real time. That's Moneris. Over 325,000 merchant locations. Three billion transactions a year. And the government is treating the sale like a real estate deal.
The Data Isn't Staying in Toronto Just Because the Servers Are
Moneris stores most of its data on Canadian servers, which sounds reassuring until you understand how the U.S. Cloud Act works. Passed in 2018, the Cloud Act allows U.S. law enforcement to subpoena data held by American companies regardless of where the physical servers sit. Francisco Partners is a U.S. entity. Once the deal closes, Moneris becomes subject to U.S. legal jurisdiction even if every byte stays in a Toronto data centre. A Canadian warrant isn't required. A U.S. subpoena is enough.
This isn't hypothetical. In 2020, the U.S. Department of Justice used the Cloud Act to access data stored by Microsoft in Ireland. The company was American. The servers were European. The data moved anyway. Moneris is now walking into the same structure, and the assurance that "privacy laws still apply" ignores the fact that jurisdiction conflicts aren't resolved by privacy commissioners, they're resolved by whoever has enforcement power.
The counterargument you'll hear is that Canada does this too, that our banks share data across borders all the time, that Moneris will still be bound by PIPEDA. True, mostly. But there's a difference between a Canadian bank with U.S. operations sharing data under bilateral agreements and a U.S. private equity firm owning the rails that every other Canadian bank runs on. One is a commercial relationship. The other is infrastructure.
The Precedent Is Worse Than the Transaction
What Francisco Partners is buying isn't the thrill of processing Interac transactions. It's a rent-extraction machine with 40% market share in a country where payments are moving to digital whether consumers like it or not. Private equity doesn't buy assets like this to run them better. It buys them because payment processors are the definition of sticky revenue: low churn, predictable fees, almost no elasticity. You can raise prices half a percent and merchants will grumble but pay because switching costs are brutal.
That model works fine when the owner is two Canadian banks with regulatory obligations and reputational risk in the domestic market. It works differently when the owner is a fund in San Francisco with a seven-year horizon and LPs in London and Singapore. The optimization changes. So does the willingness to push back when a U.S. trade negotiator floats the idea of data-sharing requirements as part of a revised USMCA.
The Investment Canada Act gives the federal government power to block deals that don't provide "net benefit" or that threaten national security. The threshold for invoking it is deliberately vague, which in practice means it almost never gets used unless the acquisition involves a state-owned Chinese firm or actual weapons. Payments infrastructure gets categorized as commercial, not strategic. The Neo Lithium logic doesn't apply, apparently, when the buyer is American and the asset processes your spending habits instead of powering your battery.
Canada didn't lose digital sovereignty with this sale. It lost it years ago, one transaction at a time, under the assumption that commerce and infrastructure are separate categories. Moneris is just the part where we can't pretend anymore.
Read Next
How Dual Citizens Can Claim RESP Tax Benefits Without Form 3520 Reporting
Bond Markets Are Pricing In Recovery, Not the 1970s Replay Already Underway
Why Fortress Tells Private Credit Lenders to Stop Chasing AI Data Centre Deals
Canada's Tax Code Punishes Work and Rewards Wealth Hoarding: Four Reforms That Would Actually Fix It