Proclamation
4notify Canada · Canada Gazette
PROCLAIMED · OSFI · Interac
Proclamation No.
PRO-CA-001
Date
2026-05-27
Status
In force
Category
Banking & Payments

Interac e-Transfer authentication: one-time passcode delivery to Canadian bank customers across Rogers, Bell and Telus

The Office of the Superintendent of Financial Institutions (OSFI) sets the operational-resilience and authentication expectations Canada's federally regulated banks must meet, and Interac operates the e-Transfer rails that move money between them. Every high-value transfer and login carries a second factor. 4notify delivers one-time passcodes at P50 under four seconds across the Rogers, Bell and Telus networks through tier-1 direct connections.

SMSPushEmail
Preamble

Section 1 — Pursuant to the Bank Act and OSFI Guideline B-13 (Technology and Cyber Risk Management), and in support of the Interac e-Transfer authentication framework, this Proclamation governs the delivery of strong-authentication one-time passcodes to customers of Canadian financial institutions over the national mobile networks.

Statutory Basis
Bank Act (S.C. 1991, c. 46)

Federal charter and supervisory framework for Canada's Schedule I and II banks; OSFI mandate.

OSFI Guideline B-13

Technology and cyber-risk management expectations, including authentication and secure delivery of credentials.

Retail Payment Activities Act

Bank of Canada oversight of payment service providers and operational-risk safeguards for retail rails such as Interac.

Implementation
01

OSFI alignment + tier-1 carriers

4notify holds tier-1 direct connections with Rogers, Bell and Telus and aligns delivery controls to OSFI B-13 expectations for authentication channels.

02

OTP minted in the bank HSM

The one-time passcode is generated inside the bank's hardware security module; 4notify receives only the hash and the destination number.

03

60-second window + fallback chain

SMS is delivered within 60 seconds; on a DLR failure the message falls back to push, then email. Grey-route latency is avoided.

04

Seven-year audit retention

Every delivery is signed and retained for seven years — aligned with FINTRAC record-keeping and OSFI examination requirements.

Delivery Envelope
json
{
  "event": "bank.interac.etransfer_otp",
  "bank_id": "CA-XXXX",
  "transaction_id": "TX-2026-05-27-948210",
  "amount": 240.00,
  "currency": "CAD",
  "delivery": {
    "channel": "sms",
    "fallback": ["push", "email"],
    "window_seconds": 60,
    "template": "interac_etransfer_otp_ca_v3"
  },
  "audit_signature": "https://4notify.net/sig/bank/948210"
}
Sample Message
SMS

RBC: Your verification code to send $240.00 to M. Tremblay is 482193. Valid for 5 min. Never share this code with anyone.

Compliance Checklist
  • OSFI B-13 authentication-channel alignment documented
  • Tier-1 direct connections active with Rogers, Bell and Telus
  • OTP P50 ≤ 4 seconds measured quarter over quarter
  • Seven-year FINTRAC-aligned audit retention attested
The 4notify difference

4notify is the only A2P provider with simultaneous tier-1 direct connections across Rogers, Bell and Telus and an OSFI-aligned, seven-year signed audit envelope for Interac e-Transfer authentication delivery.

Frequently Asked Questions
Does 4notify deliver to Canadian banks directly or via an aggregator?

Tier-1 direct connections with Rogers, Bell and Telus. There is no grey-route aggregation on authentication traffic.

Are push notifications accepted as a second factor?

Yes — an app-bound push notification is a recognised possession factor. We always pair push with SMS or email so a single channel failure never blocks a customer from completing a transfer.

Proclaimed by
4notify Operations Office
2026-05-27 · PRO-CA-001

Start for free

14 days, no card required. Weekday support in English.

Other Proclamations in this Edition