Selling Moneris to U.S. Private Equity Isn't a Privacy Risk, It's a Sovereignty Failure Canada Chose

BMO and RBC created Moneris in 2000 to consolidate their merchant processing operations. For 25 years, it functioned like infrastructure owned by the country's banking system. Now it's being sold to Francisco Partners, a San Francisco private equity firm that specializes in buying tech assets, optimizing them for profit, and flipping them. The transaction will move ownership of approximately 3 billion Canadian payment transactions a year, one in three purchases made in this country, out of the domestic banking system and into a U.S. financial structure governed by U.S. law.

The immediate reaction has focused on privacy. Will Canadian spending data be subject to the Patriot Act? Can U.S. authorities compel disclosure of transaction records? These are reasonable questions, but they frame the problem too narrowly. Privacy law applies to data handling. Sovereignty applies to who controls the pipes.

The infrastructure nobody sees

Moneris isn't a consumer brand. Most Canadians couldn't name their payment processor if asked. But it sits between every debit card tap and every business bank account in 325,000 merchant locations. It knows what Canadians bought, where, when, and for how much. That data doesn't just power fraud detection. It feeds credit scoring, insurance underwriting, retail inventory models, and increasingly, AI training sets that shape lending and consumption patterns.

Under bank ownership, Moneris operated with the structural incentives of a utility. Margins were thin. The goal was reliability and integration with the broader Canadian financial system. Under private equity, the incentive structure flips. Francisco Partners didn't buy Moneris to keep margins thin. The playbook is: cut costs, raise fees, extract value, and exit within five to seven years. For merchants, that likely means higher transaction fees. For Canada, it means the data architecture of the retail economy is now a line item on a PE fund's internal rate of return model.

What sovereignty actually means

Sovereignty isn't about keeping foreign companies out. It's about maintaining decision-making authority over critical systems when things go wrong. If a trade dispute escalates and the U.S. government decides to apply pressure, does Canada control the payment rails, or does a firm in San Francisco?

The Investment Canada Act allows Ottawa to block deals that threaten national security, and this one is under review. But the threshold has historically been narrow: direct threats to defense or critical physical infrastructure. Payment data has been treated as a commercial asset, not a national one. The sale of Moneris suggests that framing is still operative in 2026, even as every other G7 country has spent the last five years expanding the definition of critical infrastructure to include digital systems.

The pattern, not the transaction

This isn't an isolated deal. It's the latest in a multi-decade pattern of Canadian-built financial infrastructure being sold when it becomes inconvenient or capital-intensive to maintain. Moneris required investment to keep up with real-time payment systems and fraud detection. RBC and BMO chose to liquidate rather than build. That's a business decision. It's also a policy failure.

Other countries have made different choices. The EU requires payment processors serving European customers to store data on European servers, regardless of parent company location. Australia blocked the sale of its national stock exchange operator to a foreign bidder in 2021, citing sovereignty concerns over financial market infrastructure. Canada, by contrast, has treated its payment systems as assets to be bought and sold under the same rules that govern a shoe factory.

The privacy risk is real but manageable. PIPEDA still applies to data collected in Canada, and the incoming Consumer Privacy Protection Act will tighten enforcement. The sovereignty risk is structural. Canada no longer owns the platform that processes a third of its transactions. That wasn't a failure of privacy law. That was a decision, made incrementally over decades, that financial infrastructure is just another business.