#08 - From Challenges to Change: Dana Bota's Roadmap for Canadian Asset Finance

Before we kick off Dana, if you could give me a quick introduction to your background and experience.

Of course. Thank you, Jeff, for having me over. I’m also delighted to be part of this conversation. A little bit about me. As, you mentioned, my name is Dana Bota. I currently oversee governance and compliance with my company and I also manage operational efficiency projects in partnership with our risk management group.

What does that mean? Well, I ensure alignment with our parent company, which is Japanese. Everything in terms of governance and compliance, as well as integrating Canadian regulatory landscape in our day to day operations. And I’m in charge of driving initiatives for fraud prevention, privacy, and anti money laundering.

My career in asset lending started about 20 years ago. I have had diverse roles in the industry from operations to credit. And underwriting as well as project management and now compliance. And I’ve worked for leading yellow iron equipment manufacturer and as well as Canada’s five big banks, which of course provided me with a broad and valuable industry experience.

So I’m an avid learner. I love learning about different aspects of compliance more recently, so I love to enhance my expertise. And outside of my professional career, I am actively passionate about empowering women in the workforce, similar to what your company has been doing. You guys are a supporter of that as well.

I contribute as a member of the Canadian Finance and Leasing Association’s Empowering Women Leaders Committee where we really strive to create some meaningful change there. So on a personal level, I also dedicate some time for mentorship and advocacy for women leadership and I work closely to my former university in this regard.

Fantastic background an enormous amount of experience across the industry, which obviously is very relevant here, Dana. so let’s kick off with anti money laundering. I know Canada appears to have been slower in adopting AML legislation than other countries, and I’d really be interested to see why you think that is the case here in Canada.

We’ve had a lot of conversations in the last few months, ever since the new regulation has been announced, and I like the fact that we can set the tone this way. So, Canada is in need for a robust anti money laundering legislation because it’s stemming from the fact that we have been having a low ranking amongst some developed nations in terms of AML effectiveness.

So the Financial Action Task Force, so FATF is an international body who assesses AML frameworks. What they’ve been talking in the past few years is the fact that from a global comparison and reputation, Canada has been ranking really low on AML integration, we have been a haven for weak corporate transparency enforcement.

They’re talking about Canada being a destination for illicit financial flow. So when you compare it to countries like UK, for example, that have a robust or proactive measures then, you know, what we’re going to talk about beneficial ownership soon, but there’s definitely a comparison.

So we do have gaps in areas of the regulatory enforcement and also data sharing across different jurisdictions. And one more thing I’ll say is for those of you that don’t know from an economic and political risk perspective, there’s something called the Basel AML Index. So this is a neat tool.

It measures the risk related to money laundering and to terrorist financing. What they do is, you can check out the website, it’s pretty cool, it shows you a map of the world and it gives you a ranking and a report to pretty much give you the why. So in terms of this index, they took a sample of 152 jurisdictions and Canada scores 121.

And US is right before us. So Canada scores 428, US scores 430. So it’s not that bad, but when you look at the grand scheme of things, we are coming after countries such as Estonia, Norway, Finland, which have a much lower score. The lower the score, the better.

So, this is some of the information that’s been circulating there. So, essentially having a weak AML legislation tarnishes Canada’s reputation. You know, we have a global image it’s making it harder for Canadian businesses to join international markets because they demand a high level of compliance.

And then, you get yourself in the situation where you’re going to have a weak compliance in Canada and then in the UK, you can’t adopt the same policies, you’re going to have to create a different kind of compliance framework. Definitely harder.

Yeah, I can see that. Obviously, this goes across all businesses in Canada.

Is there anything specific that’s worthy of mention where AML in terms of the asset financing business in Canada is particularly suffering as a result of lack of legislation?

For sure, I keep comparing us to Europe because they’re much more advanced. The way things work in Canada and here we’re referring specifically to asset lending ,we have less stringent standards here. We have a more non harmonized approach. And what does that mean? In Europe, everything is more unified. They have consistency all across the members and this way, compliance is much more straightforward and they break the barriers, right?

It’s all across the board. If you’re of interest, we can take a couple of topics that relate to the asset finance industry in terms of compliance, and we can kind of do a comparison if you like. So, for example, if we talk about KYC definite key in differences. We talked about beneficial ownership.

So let’s talk about that here. So there’s no transparency right now. There is no public registry and we’re waiting for it supposedly 2025, but again, pay attention, it’s only going to be happening on a federal level. So the information is often incomplete and very hard to verify. You’re only as good as the information that the client provide.

It makes it very hard for a lender and everybody develops their own policies and procedures, right? So then it feels like you’re working in a silo, so to speak. Enhanced due diligence, for example, that’s another one where right now it is required for high risk customers and the way it works is the Canadian law relies on FINTRAC regulations, which provides the thresholds, but it doesn’t give you the details.

So in asset lending, if you’re doing a cross border transaction, for example you don’t have enough details. Same thing for politically exposed persons. So you have to look at the foreign PEPs right now, which are subject to mandatory identification, but they don’t demand you to look at the domestic politically exposed persons, which if you ask me, it definitely creates a bit of a gap in your risk management.

What else? Verification. So verification of information, that’s still part of KYC. We currently in our asset lending industry, we rely on self reported data. So that means passports, IDs, utility bills. So unless you associate yourself with a company or you have technology that can help you have more access to a specific database and have more data sets, you’re going to have a problem.

And of course, this causes a cost constraint, so not everybody can afford to get a third party provider to check their driver’s licenses, for example, depending on the size of the business, I mean. The last aspect that I want to bring up, and this is a real problem is the reporting of suspicious activity.

The framework exists right now, as we know, only for reporting entities. The asset lending industry will join in the FINTRAC guidelines, but what’s happening is that doesn’t allow those of us that are currently outside of the reporting entity group to improve our monitoring system.

For those of us in asset lending, we’re good because with the CFLA, there’s been some efforts to try to report fraud. Fraud is huge, has been increasing. Nowadays, we’re facing some serious cases that bring a lot of losses in our industry. So it’s very important for us to all be aligned and ensure monitoring.

So, when you talk about this beneficial ownership registry, could you give us a bit of an idea of what sort of information will be held in that registry?

Of course, so today depending on which province you are extracting the corporate profile from, you’re going to have a percentage of the business ownership. Some provinces will give you a percentage, others will just give you names and addresses and I think this registries most likely will mimic what’s happening in Europe. It is going to give you the percentage of ownership names, but think of it from a holistic perspective, you’re going to have this as an additional tool of KYC.

So yes, you’re going to get your corporate profile, but then you’re going to access this registry to pretty much confirm the information you’ve already found, including the information that’s presented to you. We haven’t been privy to more information as to what it’s going to contain or what it’s going to look like, but essentially the same information will be communicated, but there will be one database. And I think the US is doing that already.

Is this being done? Because you mentioned a federal level versus a state level. So is this being done at the federal level only.

Yeah, So this is going to give you an opportunity to see if your client is operating on a federal level or not that’s going to be the platform where you’ll go check. So, even though, for example, they’re looking for financing in Ontario so, to speak you’re going to be able to check to see if they have a business open in Alberta. Okay. Because that makes a lot of sense, and from a fraud perspective, it’s important for you to know and from registration of assets from that perspective, you need to know as well.

So you can perfect your security.

Perfect. And will all asset lenders have access to this? What I mean by that, banks, independents, captives.

I believe so. If you’re operating on a federal level, you will have to be part of it.

You will have access to it.

Okay very interesting, Dana.

Let’s turn to privacy. So I have a question here how do you see Canada’s approach to the privacy legislation compared with other standards that we see around the world like GDPR? And what specifically does that mean for the asset lender?

So there’s definitely differences. I’ll start talking about the GDPR. So GDPR is the gold standard for privacy laws on a global basis. They set stringent requirements for data protection. There’s explicit consent. There’s also a lot of rules about enhanced public rights and again,

penalties are very severe when it comes to GDPR enforcement. When I move over to Canada, so, right now, in Canada, we have a federal privacy framework, which is governed by PIPEDA and then I feel that we’re still playing catch up for sure with GDPR because although we’ve made some improvements, so we’re slowly evolving the privacy law in Canada, but with Law 25 in Quebec, for example, I’ve just finished implementing in my place of business here and it’s quite the exercise.

So, there’s definitely efforts, but it only applies on a provincial level. And then there’s also talks about Bill-C 27, which essentially will be like a reform of federal privacy law for the private sector. So they’re working on that. And, this is great because it will aim to align Canada more closely to the principles.

But again, I hope that I can talk a little bit about the non compliance and that would be one of the parts that I would like to strive for the asset lending industry as the privacy legislation. And the environment for this becomes more and more strange and we have to be very careful with the type of data we collect on our customers, with the type of privacy impacts

we have on our 3rd parties very, very important to put in place some retention policies. It has to be very clear where the data is stored. How is it handled? There must be a purpose. So I’m familiar with this now because I’ve dealt with the Quebec one, but it’s coming and I think it’s important for companies to prepare themselves and try to take a look and see what others are doing so they’re prepared because it’s not just a matter of enforcing policies, it’s a matter of systems and training and bringing awareness amongst employees. So, it’s quite the project. Yes, I know from my time in Europe when GDPR was introduced, I mean, it was a massive overhead for organizations to implement and establish that.

And as you kind of just alluded to, it’s something that everyone within the organization needs to be aware of. They need to understand obviously what the conditions and the constraints are. How they treat data, what they can do with that data, their role in terms of collecting and curating that data, etc.

So yeah, I mean by the sounds of it, Canada appears to have a complex network of laws governing privacy and data protection and my sense is, it kind of involves a complex statutory regulatory and common law requirements and restrictions. So I think my question, is what specific privacy considerations would you say asset lenders need to keep in mind under Canada’s evolving privacy laws?

There’s definitely the right information. This is a big one that came out of our implementation with law 25. So your customer has to know what type of data you’re collecting on them. Who has access to it? What’s the purpose of it? And how do you safeguard it? And also the right to portability. There’s different kind of rights and I think it’s going to depend.

They haven’t adopted every single one that GDPR has, but the main one so, I think like I said earlier taking a peek at law 25 is probably a best first step to dive deeper into what to expect in the next few years. Yeah, exactly. I mean, I was going to ask why should Canadian businesses take this so seriously, but it’s pretty self evident. Well, I think they’d be as far reaching as GDPR, correct me if I’m wrong. Yeah Sure. I mean, look even for those companies that want to play in different kind of markets. I think it’s very important. Like I said, the same thing applies to privacy as AML.

You’re going to have a different set of rules in Canada versus Europe, for example, if you, if you’re going to dip into that market, but you, you have to be prepared because the cost of noncompliance is definitely hefty. And kind of a general question, what could you say the majority, and again, let’s be specific to the asset lenders here, it’s a bit of an open ended question, but do you think most of them are ready for this?

Do you think they’ve got the right processes and the right systems in place?

I think it’s a good question. But again, it has its ramifications. So look, we’ve been working in silos for so many years. You know, depending on, for those of us that had reporting entities that were closer to banking, we had a different set of rules and we had a voluntary anti money laundering program, for example, in my case, but there’s definitely implications of non compliance in our industry. And I would love to focus on those if we can, rather than saying what we have today. Again, every company is different, but there’s three areas that I would like to bring up for discussion.

And the first one is as I mentioned earlier, we were talking about KYC. I think it’s very important to focus on KYC practices to prioritize your transparency and adopt this beneficial ownership knowledge. You have to know who your clients are. You have to make sure that you have this transparency because it’s going to mitigate your risks.

Having a robust AML compliance framework, so to speak, will protect your financial integrity in the Canadian market. And like I said, if you want to dip into other ones, you’ll be a credible, trusted partner on the global stage too. So that’s your KYC. The other one would be the way we should look at due diligence is probably a long term strategy.

Like, I think bidding on effective compliance means going above and beyond your basics. So like I said, monitor your due diligence take a look at your policies and procedures and if you don’t have any, maybe you should put some in place. You also have to take a look at your processes to make sure they align with what’s happening in the market.

With your economic or regulatory environment and this way, if you do this, you pretty much minimize the chances of engaging with clients that are tied to illegal activities because essentially, that’s what will build your reputation and One last aspect is something that I’ve been involved in the past few years acting in compliance and that is recognizing compliance as a strategic differentiator.

So, we all know that, we have to recognize that being compliant isn’t just about avoiding those penalties and I think it’s about reputational impact. Because If we treat compliance as a competitive advantage and you demonstrate a proactive compliance framework, I think you’re more attractive for your clients and partners. And especially in our sector where asset lending trust is foundational. So the more you show that type of commitment to integrity, I think, the more successful you’ll be. I have, an interesting example if I could share, this has been recently brought to my attention like, one of my colleagues shared this with me, and it’s an interesting topic. It’s almost a parallel between introducing the concept of compliance versus Disney World. That’s interesting, yeah it is. So this is why I am bringing this parallel. Banks are so used to, this already, but for those of us who haven’t been exposed to a full compliance spectrum in asset lending, I think it will be an interesting parallel and I’ll give you some examples.

So at Disney, when I mean control, I mean about compliance framework, so control at Disney focuses on categories, not individual, so that means that instructions apply to everyone if you’re a certain area of the park that those are the instructions. Same thing for for asset lending. So, the way it works is You need to enforce a culture of compliance, you need to have simple policies that your employees will know and understand, and they’ll know where they are, because it’s very, very important to create that, it’s going to be everybody’s responsibility. There’s not just one denominator that’s going to act as the police, so to speak. The other one was control utilizes surveillance and not in an oppressive way. So, why is it important to have a monitoring of compliance activities? Because you’re going to have smoother operations, essentially. So, you know, monitoring, like I said earlier, it will allow you to see if your policies are strong or if your employees know your policies, otherwise you’re going to have some training gaps.

So, very important to look at that from that perspective. And Talking about control as being consensual and cooperative. So, at Disney the visitors are all willingly cooperating. Right? Everybody’s there to have fun and be safe. So, that’s how I’m relating this to compliance where, you know, with employing understanding that there are rules in place.

And everybody reading them and knowing where they are, they understand that they’re part of building a company’s reputation, contributing to that. So it’s not a matter of just having, like I said earlier, one enforcer that just stays there with a stick, making sure everybody reads the policies is definitely more than that.

So encouraging a culture of compliance, I think is essential for the asset lending industry because it’s not just about checking those boxes is about, it’s everybody’s role, similar to fraud, right? Like, we’re all in this together. The more people listen and pay attention the more prepared you would be for fraud, so to speak.

Absolutely. I love that parallel with Disney. I think it’s a great one. I love that too. Yeah and you know, I think you brought out a number of really, really key things there using my terminology, organizations should be proactive, not reactive, basically and organizationally, everyone needs to be on board.

As you say, it’s got to be a cultural thing, it’s not just your responsibility type attitude, and that for me, in my experience, that’s really got to be communicated from the top down in the organization. So everyone is aware that, you know, they’re part of the process they’re responsible. You’ve got to make it easy for them to, to understand. And yeah, at the end of the day, if you don’t want to face financial penalties, reputational risk. As you quite rightly said and let’s not forget, and, I’ve seen this before, with other legislation if you get caught or you do it wrong, you’re going to be under increasing regulatory scrutiny all the time.

So be proactive make sure it’s properly communicated throughout the organization and yeah, at the end of the day, we’re all here. And as you say, it is the reputation for me, that’s probably the key thing here. It’s not, just about the potential implications of fines and those sorts of things.

I think everyone in the asset finance industry has a responsibility to, be proactive to make sure they, Enhance their reputation and they become better lenders to deal with, you know, it doesn’t matter who their borrowers are in that situation, they will become more attractive. So Dana, before we kind of close, is there anything else you want to say kind of as a bit of a wrap up maybe, the last couple of minutes, question is, I know you’ve kind of answered all of this anyway, but if you have to give a final message to the Canadian asset lenders, you know, be they banks, independents or captives, then what would your final message be to these, organizations?

Think about your reputation and your customers trust, essentially look inward, try to understand what your current practices are peak outward to ensure that you’re in line with what the legislation is bringing. I would also say that being proactive in the sense is very important. And one thing that I would say is continue to have conversations.

We’ve been very privileged with the CFLA that we have a great platform where we can exchange ideas and try to get prepared. We don’t know what’s coming, but we are there and they’re by our side. It’s very important to continue the conversation and we’re going to learn from each other for sure.

Very important to share your experience and also look at different other countries that have implemented similar legislation for in our instance, for example, when we implemented law 25, we piggybacked on the experience of our UK office and spoke to their data privacy officers, so important to get a different perspective and I think Canada overall can do that from the point where they start drafting this legislation to what happens after. So, it’s going to be quite the change, I’m sure that. You know, we’ve been quite the solid industry and I think there’s great perspectives and by following this type of legislation and enhancing our due diligence and our practices, we’re definitely winning not only in Canada, but on a global spectrum as well. Absolutely. I like that point about best practice, learn from others Look at it internationally, as you’ve just said.

And also, Dana, thanks very much for mentioning the CLFA. I know both our organizations are members and as you say, it’s a marvelous platform body, to freely and openly exchange ideas. And let’s not underestimate, potentially the CLFA’s ability to be able to, be a voice, if you like, for the asset lenders in Canada.

So, yep, fantastic. So, look, Dana, thank you so much for your insights into what is obviously a very highly topical subject and your thoughts and implications here, you know, on the industry in Canada. I look forward to continuing our discussions. You and I, I’m sure, will be meeting on a regular basis at various CLFA events.

As this kind of regulatory framework evolves and I just like to say for those who are watching this podcast, do feel free to reach out to Dana or me on LinkedIn, or if you have any questions or just like to talk generally about your business as we move into the era evolving challenges and opportunities for asset financing industry here in Canada, feel free to reach out to us.

Thank you so much, Dana. Thank you so much, Jeff. You as well. Take care.