On May 11, 2023, the Fighting Against Forced Labour and Child Labour in Supply Chains Act, S.C. 2023, c. 9 (the “Act”) was passed. The purpose of this Act is to implement Canada’s international commitment to contribute to the fight against forced labour and child labour, and to require certain entities to report on the measures they have taken to reduce the use of forced labour and child labour. The Act came into force on January 1, 2024, and reporting entities and federal institutions were required to submit their first report under the Act by May 31, 2024. In addition, Public Safety Canada (the “Government”) released the Guidance for reporting entities.  Scope of the Act The Act applies to government institutions and to any corporation, partnership, trust or other unincorporated organization that (i) is listed on a stock exchange in Canada or (ii) has a place of business in Canada, does business in Canada or has assets in Canada and that, based on its consolidated financial statements, meets at least two of the following conditions for at least one of its two most recent financial years: (a) it has at least $20 million in assets (b) it has generated at least $40 million in revenue (c) it employs an average of at least 250 employees (collectively, the “entities”) Or (iii) is prescribed by regulations. The obligation to report applies to any entity (a) producing, selling or distributing goods in Canada or elsewhere; (b) importing into Canada goods produced outside Canada; or (c) controlling an entity engaged in any of these activities. Entities are considered to be operating in Canada if they produce, sell or distribute goods in Canada. They may also be considered to be operating in Canada if they have employees, if they make deliveries, purchases or payments in Canada, or if they have bank accounts in Canada. It is important to note that doing business in Canada does not require having a place of business in Canada. Forced Labour vs. Child Labour For the purposes of this Act, child labour is defined as labour provided by minors that (i) is provided or offered to be provided in Canada under circumstances that are contrary to the laws applicable in Canada; (ii) is provided or offered to be provided under circumstances that are physically, socially or morally dangerous to them; (iii) interferes with their schooling; or (iv) constitutes the worst forms of child labour, as defined in article 3 of the Worst Forms of Child Labour Convention.1 Forced labour is labour provided by a person (i) in circumstances in which it would be reasonable to believe that their safety or that of a person known to them would be threatened if they failed to provide such labour; or (ii) in circumstances which constitute forced or compulsory labour, as defined in article 2 of the Forced Labour Convention.2 Entities With Reporting Obligations Any entity required to report annually to the Government under the Act must include in its report the steps taken during its previous financial year to prevent and reduce the risk of forced labour and child labour. In order to comply with the obligations imposed by the Act, the entity must also include in its report information on its structure, its activities relating to the production, sale, distribution or importation of goods, as well as the type of goods and place of operation, and the countries or regions involved in its supply chains. Lastly, the report must include a brief explanation of the entity’s due diligence policies and processes regarding forced labour and child labour, information on the training provided to employees, and the parts of its business that carry a risk of forced labour or child labour. Given that the steps taken to prevent and reduce forced labour and child labour can result in a loss of income for vulnerable families, the Act requires entities to identify the measures taken to mitigate such impact on these families. Publication of Reports Entities must not only comply with the format, approval and attestation requirements for their report before submitting it to the Government but also make it available to the public by publishing it on a prominent place on their website. They can submit their report in one of the two official languages, although the Government recommends that reports be published in both English and French. In addition, the Act requires entities incorporated under the Canada Business Corporations Act or any other federal law to provide a copy of the report to each shareholder at the same time as their annual financial statements. Offences and Fines Reporting entities that fail to submit their report or make it available to the public are liable to a fine of not more than $250,000 per offence.3 The senior executives, directors and employees of an entity are also liable to fines and criminal prosecution should the entity contravene the Act.4 Any offence committed by an entity may also entail reputational risk. Our Advice Introducing policies, procedures, audit tools and other rules—or improving existing ones—to prevent and reduce modern slavery is essential. Such policies and rules may include procedures for reporting and an investigation process to address concerns, as well as a whistleblower protection system (whistleblower policy or similar measures). Businesses should think about how they select suppliers and whether they should adopt rules for monitoring the activities of their suppliers and partners. They should also consider updating their agreements with existing suppliers or partners to ensure compliance with the requirements of the Act, in particular by including provisions prohibiting the use of forced labour or child labour in suppliers’ business activities. Other measures may include raising awareness and training staff, directors and officers on how to implement company policies and procedures aimed at identifying and preventing forced labour and child labour. Our team has developed tools to help reporting entities identify the parts of their business that carry a risk of forced labour or child labour. We will be monitoring upcoming government publications in response to the first reports that reporting entities submit and, if need be, we will release another article to clarify reporting obligations. For any questions or advice relating to your obligations under the Act, do not hesitate to contact our team. Section 1 of the Act; see also the Worst Forms of Child Labour Convention, adopted in Geneva on June 17, 1999, article 3: Link Section 1 of the Act; see also the Forced Labour Convention, adopted in Geneva on June 28, 1930, article 2: Link Section 19 of the Act. Section 20 of the Act.

Over the last several years, member countries of the OECD, including Canada and the U.S., have committed to various international undertakings dealing with corporate governance. In keeping with these commitments, since 2019, the Canada Business Corporations Act (CBCA) has required business corporations incorporated under the CBCA to prepare and maintain a register of individuals with significant control over the corporation. Nearly all Canadian provinces, including Québec, have also amended their legislation to make control of companies incorporated in their jurisdiction more transparent. For instance, since March 31, 2023, companies registered with the Québec Enterprise Register (REQ) must report their ultimate beneficiaries to the REQ. Providing greater transparency in the control of Canadian businesses is a continuing process, and additional provisions that apply to federal business corporations came into force on January 22, 2024, and others, applicable to businesses registered with the REQ, will come into force on July 31, 2024. The provisions of the Corporate Transparency Act of the United States requiring companies to report beneficial ownership information came into force on January 1, 2024; some of these provisions are of interest for Canadian companies. Canada – Public register of individuals with significant control Since June 2019, business corporations incorporated under the Canada Business Corporations Act have been required to maintain a register of “individuals with significant control” (ISCs) containing the following information: the name, date of birth and last known personal address of each ISC the citizenship, country or countries where the ISCs are residents for tax purposes the date on which each of these individuals became an ISC the manner in which the individual is an ISC and any other information required by the regulation.1 Although federal corporations must make this register accessible to the Director tasked with administering the Canada Business Corporations Act, to shareholders and creditors of the corporation and to investigative bodies, the register was not accessible to the public until recently. On November 2, 2023, the federal legislator amended the provisions of the Canada Business Corporations Act to, among others: allow ISCs to provide an address for service in addition to their personal address provide that a portion of the ISC information compiled by federally incorporated businesses must be sent to the Director tasked with administering the CBCA provide that the Director must make the following information on ISCs accessible to the public: their name their address for reporting purposes if such an address is provided or, failing which, their personal address the date on which they became an individual with significant control and a description of the manner in which each one is an individual with significant control Note that even if the date of birth, citizenship, country or countries where the ISC is a resident for tax purposes and their personal address (if they provided an address for reporting purposes) must be provided to the Director overseeing the Canada Business Corporations Act, this information will not be made public. The Director may, however, in turn provide to any police force, the Canada Revenue Agency and any provincial body that has responsibilities similar to those of the Canada Revenue Agency, bodies that have investigative powers in relation to certain offences, a provincial enterprise register or provincial agency enforcing corporate law in that province all or part of a corporation’s ISC information, which goes beyond the information it makes available to the public. A corporation must send its ISC information electronically through the Corporations Canada website, at incorporation (if incorporated after January 22, 2024), annually and concurrently with the filing of its annual declaration, within 30 days following its merger with another CBCA corporation, within 30 days of the date on which it becomes subject to the CBCA after incorporating under the laws of another jurisdiction, and within 15 days following any changes made to its register of ISCs. These amendments came into force on January 22, 2024. To assist federal corporations in drawing up a list of their ISCs, the Director tasked with administering the Canada Business Corporations Act posted a letter template on its website that federal corporations may send to their shareholders, their ISCs and to anyone who could reasonably be expected to have the relevant knowledge to identify their ISCs.2 The purpose of that letter is to help the corporation in identifying its ISCs. It is mandatory for shareholders to respond to the corporation’s request and failure to respond may result in significant fines and even imprisonment. Québec – Search a natural person by last name and first name Since April 1, 2023, most private businesses that required to register in Québec must report to the Registre des entreprises du Québec the names, residential address and date of birth of each of their ultimate beneficiaries, and the type of control exercised by them or the percentage of shares or units of the corporation owned by these ultimate beneficiaries or of which they are the beneficiaries. In general, an ultimate beneficiary of a business is a natural person who owns or is the beneficiary of 25% or more of the voting rights for that business, who owns or is the beneficiary of 25% or more of its fair market value or who has an influence that could result in de facto control over the business. The information reported on ultimate beneficiaries is accessible to the public and free for anyone consulting the REQ. The requirement to report ultimate beneficiaries applies to almost all businesses registered in Québec and is not limited to businesses incorporated under Québec law nor to business corporations. Therefore, any foreign legal person that is required to register in Québec must report its ultimate beneficiaries. The same applies to partnerships, such as general partnerships and limited partnerships, and some trusts. As of July 31, 2024, it will be possible to search the REQ using the last name and first name of a natural person. Accordingly, from that date, it will be possible to obtain the list of all businesses registered in the REQ of which a person is a director, officer, one of the three shareholders controlling the greatest number of votes and an ultimate beneficiary by searching by his or her last name and first name. The last and first name of the natural person and his or her residential address will appear in the search results. However, if a work address was reported to the register for that person, only the work address will appear. Federally incorporated businesses registered with the REQ A federally incorporated business that does business in Québec must maintain a register of its ISCs under the Canada Business Corporations Act and report information on its ultimate beneficiaries to the REQ. Although most ISCs of a federally incorporated business will also be the ultimate beneficiaries under the Act respecting the legal publicity of enterprises and vice versa, the two acts do not define an ISC and ultimate beneficiary in exactly the same way. A person may be an ultimate beneficiary under the Act respecting the legal publicity of enterprises without necessarily being an ISC under the Canada Business Corporations Act (and vice versa). Consequently, the content of the register of ISCs for a federally incorporated business — and thus information it will have reported to the Director in charge of the Canada Business Corporations Act — may not be identical to the ultimate beneficiary information it will have reported to the REQ. However, federally incorporated businesses that do not do business in Québec are not required to register under the Act respecting the legal publicity of enterprises. All other provinces, except for Alberta,3 have now incorporated provisions into their business corporations legislation requiring corporations registered under the laws of that province to maintain a register of individuals with significant control. As a result, these provisions only apply to business corporations incorporated under the law of the province and, therefore, do not apply to business corporations incorporated under the Canada Business Corporations Act or under the business corporation act of another province. Corporate Transparency Act in the United States coming into force – Impact on Canadian businesses On January 1, 2021, the Corporate Transparency Act, part of the U.S. Anti-Money Laundering Act of 2020, came into force. Just like the amendments made to the Canada Business Corporations Act and to the Act respecting the legal publicity of enterprises (Québec), the aim of the Corporate Transparency Act is to prevent and fight against money laundering, terrorism financing, corruption, tax fraud and other illicit activities, among others, by increasing the transparency of private companies incorporated in or registered in the United States. On January 1, 2024, the reporting requirements in the Corporate Transparency Act to identify “beneficial owners,” which are basically equivalent to ISCs under the Canada Business Corporations Act and “ultimate beneficiaries” under the Act respecting the legal publicity of enterprises (Québec), came into force. Businesses covered by the act and incorporated before January 1, 2024, have until January 1, 2025, to file their first Beneficial Ownership Information Report. Businesses incorporated after that date must file their first report no later than 30 days after the date they first register with a U.S. government authority. Reports on beneficial ownership of businesses are filed with the Financial Crimes Enforcement Network, an agency of the U.S. Department of the Treasury, better known by its acronym FinCEN. Reporting businesses must submit an updated report within 30 days of any change in information previously reported to FinCEN. Reports on beneficial ownership are not accessible to the public and are not subject to the U.S. Freedom of Information Act. The information contained in these reports will be, however, generally accessible to United States law enforcement agencies and United States federal tax authorities. Foreign law enforcement authorities may also be granted access in certain circumstances through United States federal intermediary agencies. Provided they have received the consent of their clients, financial institutions will also have access to the information to facilitate compliance with customer due diligence requirements under applicable law. All corporations incorporated in the U.S. must file beneficial ownership information reports unless they are legally exempt. Exempt businesses include: most businesses whose securities are registered under the Securities Act of 1934 large businesses, i.e., businesses with more than 20 full-time employees in the U.S., having a facility in the U.S., and having reported over U.S.$5 million in gross revenues or sales in the previous reporting period. It follows that in most cases, unless it is exempted, usually because it will qualify as a “large business” due to the number of its employees and its revenues, a  U.S. subsidiary of a Canadian corporation will have to comply with the act and report the identity of its Canadian beneficial owners. A reporting business must, among other things, report the full name, the date of birth and the address of all its beneficial owners. The U.S. subsidiary of a Canadian corporation must also submit a copy of the Canadian passport (or from the country of citizenship of the person in question) for each of its beneficial owners. A person is deemed a beneficial owner of a corporation if he or she is a natural person who, directly or indirectly, exercises substantial control over the reporting corporation, or owns or controls at least 25% of the corporation’s ownership interests (shares, units or others), in voting rights or in value. The definition of “substantial control” for the purposes of the Corporate Transparency Act is much broader and more specific than what is found in equivalent Canadian legislation. An individual has “substantial control” over a reporting corporation under the Corporate Transparency Act if such individual (i) is a senior officer in the corporation, (ii) has authority to appoint or remove certain officers or a majority of the directors (or similar body) of the reporting corporation, (iii) is an important decision maker of the reporting corporation or (iv) has any other form of substantial control over the reporting corporation. The Corporate Transparency Act imposes serious penalties on individuals who willfully fail to file or update beneficial ownership information or who willfully file false information. These penalties include civil penalties of up to U.S.$500 per day of violation, fines of up to U.S.$10,000, as well as potential; imprisonment for a period up to two years. Note that the act contains a presumption against senior officers in respect to reported information that is false, incomplete or not up to date. These officers could therefore be held personally held liable for civil penalties and fines and could be subject to imprisonment if the reported information proves to be false or incomplete or not up to date. Senior officers must therefore be especially vigilant and ensure that the reporting requirements under the Corporate Transparency Act are met. The Director tasked with administering the Canada Business Corporations Act has posted a template for the register of ISCs on its website. This register can be found at: https://ised-isde.canada.ca/site/corporations-canada/sites/default/files/documents/2023-12/04.3_isc-register-template_en.xlsx This template can be found at: This template can be found at: https://ised-isde.canada.ca/site/corporations-canada/sites/default/files/documents/2023-12/06.1_request_for_information_template_isc_en.pdf The three territories, Yukon, Northwest Territories and Nunavut, still have yet to amend their legislation to require a register of individuals with significant control to be maintained for business corporations incorporated under the business corporation acts of those territories.

Like many other governments, the Government of Quebec decided to invest in infrastructure to help mitigate the impact of the COVID-19 pandemic and stimulate Quebec’s economy. A significant number of investments will be made in the transportation sector, and the government wants to accelerate the realisation of several previously announced transportation infrastructure projects in the greater Montréal area. This focus on construction as a way of speeding up the recovery from the crisis arises in a context where construction contractors’ and professionals’ interest in public contracts has fallen sharply. According to a recent study conducted by three Raymond Chabot Grant Thornton professionals1, mandated by six major players in the Quebec construction industry, this lack of interest in public contracts can be explained by a number of factors: poorly structured payment terms, unappealing contract clauses, issues related to the tender process, cumbersome contract management, and, as far as construction professionals are concerned, hourly rate ceilings set out in existing government regulations. The Quebec government is acutely aware of this decline in interest for public contracts and tabled an action plan for the construction industry in late March 2021 to address it. Four categories of measures are included in this action plan. First, the government has reiterated its desire to accelerate the realisation of a number of projects already included in the Québec Infrastructure Plan and to implement this plan more effectively. The Act respecting the acceleration of certain infrastructure projects introduced in June 2020 and adopted in December 2020, even before the action plan was tabled was a concrete example of the government’s intent. The other two categories of measures in the action plan aim to implement solutions to reduce the current labour shortages and to increase productivity in the construction industry. The Act respecting the acceleration of certain infrastructure projects covers approximately 180 projects, most of which are in the transportation, education and health and social services sectors. It focuses, in particular, on a number of transportation infrastructure projects in the greater Montréal area, such as the projects that will  link the east, northeast and southwest of Montréal to the city’s downtown area by way of an electric public transit system (including the REM de l’Est and the first phase of the pink metro line), to improve access to the Port of Montréal, to rebuild the Île aux Tourtes Bridge, to build the Longueuil tramway, to extend the REM to Laval and to implement an express bus service in Laval. The Act focuses onfour main areas. First, if expropriation required to carry out a particular project, its procedure has been simplified. Second, in connection with compliance with environmental legislation provisions, the requirement of a certificate of authorization will waived for certain projects; for others, the BAPE project assessment procedure has been simplified. An expedited process to authorize the use of governmental property is provided for projects where such use is necessary. Lastly, city or municipal authorizations have been simplified for projects that require such an authorization. Extraordinary measures were required to deal with the unique situation caused by the COVID-19 pandemic. We applaud the Quebec government’s efforts to address the impacts of this pandemic. The chosen approach, however, is not without risks. Some critics have warned the government about the risks of possible collusion between tenderers, as collusion is thought to be more likely to occur in a context where projects are being accelerated. To mitigate this risk, the Actconfers on the Autorité des marchés publics more oversight functions, and in clear cases of collusion, the power to suspend the performance of contracts. Concerns have also been raised as to the quality of the constructed works, thereby underscoring the importance of maintaining and not ditching adequate public consultations. Finally, the Act addresses the issue of delays in payments by the government that was not only raised in the Raymond Chabot Grant Thornton report, but also during public consultations preceding the adoption of the Act. The Act extends the existing pilot project to facilitate payment to enterprises applicable to all projects covered by the Act. Hopefully, the Act respecting the acceleration of certain infrastructure projects, paired with the other measures announced in the government’s action plan for the construction industry, will make infrastructure a key component of Quebec’s economic recovery, as we finally start to see the end of the COVID-19 pandemic. A short version of this publication was published as an open letter in La Presse. Click here to read it. Plante, Nicolas, Jean-Philippe Brosseau and Marie-Pier Bernard, Consultation visant à évaluer le niveau d'intérêt des entrepreneurs et des professionnels envers les marchés publics [French Only], Montréal, Raymond Chabot Grant Thornton, April 2021, 85 p. (see in particular pages 17 to 34).

Various ways of doing e-commerce E-commerce can take different forms. For the purposes of this article, we will refer to e-commerce where the contract of sale or of supply of services is concluded by electronic means, E-commerce will be said to be “direct” when the product or service is delivered electronically, such as in the online conclusion of a contract for a subscription to an online-only publication, and “indirect” when the item sold is tangible or the service is rendered otherwise than online. E-commerce can be conducted entirely online or in a hybrid manner, where the vendor operates both online and through brick-and-mortar stores. It is considered “closed” when it is between a relatively small number of participants who already have a contractual or professional relationship with each other. It can be conducted between a business and a consumer, in which case it is called “B2C,” or between a business and another business and is then known as “B2B.” E-commerce poses particular challenges for businesses and if these challenges are not properly addressed, they are likely to expose the business to additional liability. This means that e-commerce can be particularly risky for novice businesses that start to do carry out business electronically, without adequate preparation. For example, a merchant who transacts electronically will necessarily have to take direct possession of some of its customers’ personal data, such as their names, addresses and credit card numbers, or have an e-commerce service provider take indirect possession of it. The use of such personal data is subject to the provisions of privacy laws, and, given that the data is of great value to potential thieves or fraudsters, it must be protected. A merchant may also be the victim of fraudulent orders or payments made with stolen credit cards numbers. To better control its risks, a novice in e-commerce may be better off doing business with established e-commerce service providers such as Shopify, BigCommerce, Squarespace or GoDaddy, which have set up robust infrastructures for their customers. A corporation should nonetheless do its homework before choosing an e-commerce service provider. It should, for example, inquire about the terms and conditions of the service agreement to be entered into with the chosen provider, and, in particular, about the services offered (including how returns and chargebacks are handled), how the service provider protects its customers in the event of data theft or fraud, what fees are charged, and so forth. In all cases, whether or not a corporation does business with an e-commerce service provider, it should ensure that the information kept on its own servers and computers is limited to what is absolutely necessary. Likewise, once a transaction is completed, it should avoid, as far as possible, keeping personal data belonging to its customers, such as their names, addresses and credit card numbers. Moreover, a corporation that decides to engage in e-commerce must be aware of certain specific legal aspects relating first, to the particularities of e-commerce itself and second, to the fact that its customers may be located anywhere in the world. For the purposes of this article, we will focus on the rules generally applicable to all types of e-commerce. A future article will deal with the specific rules provided in the Consumer Protection Act (Quebec). Consumption tax The majority of governments impose a consumption tax on goods (and sometimes services) sold within their jurisdiction. Applicable consumption tax laws generally provide that businesses with a presence in a jurisdiction must collect applicable taxes and remit them to the competent tax authorities. For a corporation that is otherwise not present in a jurisdiction, the mere fact of selling goods in that jurisdiction is generally not sufficient to require registering with its tax authorities and collecting and remitting applicable taxes. However, the definition of what constitutes a sufficient presence to require business registration and the collection and remittance of consumption taxes varies from one jurisdiction to another. A corporation wanting to sell its goods and services electronically must therefore ensure that it is aware of the applicable consumption tax rules in the main jurisdictions where it will sell these goods or provide these services. Licences and permits Although it is generally not necessary for a manufacturer or seller to obtain a license, permit or other governmental authorization for the vast majority of goods typically sold online, they  may be required before certain products, in particular medical or pharmaceutical products, can be sold online or otherwise, domestically or internationally. It is also important to note that a licence, permit or other authorization may not be required to sell goods in a jurisdiction while the sale of the same goods in another may require such license, permit or other authorization. Thus, if a merchant wants to sell its product in a jurisdiction where a permit, licence or other authorization is required, it will be required to obtain it before proceeding with any sales. In addition, in some territories, the sale of certain goods must necessarily be done through a State monopoly. For instance, such restrictions are still the norm in Canada for the sale of alcoholic beverages. For example, a resident of Ontario may not order alcoholic beverages directly online from a producer in another province and have them delivered to Ontario, which prevents a small-scale producer of alcoholic beverages in Quebec from selling its products online to Ontario customers, for delivery in Ontario. Shipping Not all goods can be shipped in the same way. Some must be specially packaged, and some may even not be shipped by regular means, such as Canada Post and major courier companies. For example, Canada Post requires that fish, game, meat, fruit, vegetables or other perishable products be properly prepared and meet certain other applicable requirements for mailing. Other products, such as objects classified as hazardous materials, may simply not be shipped by mail. To ship these products, it will be necessary to deal with a specialized courier service. Finally, Canadian laws prohibit the export of certain goods or require special permits for their export. In addition, merchants must ensure that the laws of the destination jurisdiction allow the goods shipped to be imported into that jurisdiction. Indeed, all countries either prohibit the import of certain goods into their jurisdiction or require the importer to obtain a permit or licence issued by their government. Age restrictions Under applicable laws and regulations, certain goods may only be sold to persons who have reached a certain age or may not be sold to children. These restrictions vary from jurisdiction to jurisdiction. For instance, in Quebec, one must be 18 years old to legally buy alcohol, while elsewhere in Canada the age is 19 and in the United States, 21. Merchants wishing to sell alcoholic beverages online must take these restrictions into account. The same applies to the sale of any other goods that are subject to age restrictions. PCI DSS compliance In 2006, the main credit card issuers, American Express, Discover Financial Services, JCB International, MasterCard and Visa formed the PCI Security Standards Council to standardize the rules and standards applicable to payments made with their credit cards. The council adopted a set of rules called “Payment Card Industry Data Security Standard,” better known by its acronym, PCI DSS. All merchants wishing to accept credit card payments, including direct online payments, must adhere to these rules. Any merchant, regardless of its size, wishing to process credit card payments on its website must also be PCI DSS compliant, unless it is doing business through a compliant payment service provider. The PCI DSS include the following 12 compliance requirements, which are grouped into six categories called “control objectives.” The following table, taken from the document entitled “Payment Card Industry (PCI) — Data Security Standard — Requirements and Security Assessment Procedures”1, provides a summary of these requirements.   Control objectives PCI DSS conditions Build and Maintain a Secure Network and Systems 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data over open, public networks Maintain a Vulnerability Management Program 5. Protect all systems against malware and regularly update anti-virus software or programs 6. Develop and maintain secure systems and applications Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes Maintain an Information Security Policy 12. Maintain a policy that addresses information security for all personnel   Although the PCI DSS are mandatory, only Visa and MasterCard require merchants and service providers that accept their cards to comply with these standards. However, a non-compliant corporation will nevertheless be held fully liable if fraud associated with theft of cardholder data occurs. In addition, should a security breach occur, all exposed merchants that are not PCI DSS compliant will be fined. It is up to merchants and service providers to achieve, demonstrate and maintain compliance through annual validations. Merchants may use the services of specialized service providers to help them comply with PCI DSS standards. Useful tools to ensure compliance are also available online for these purposes2. Should a merchant not wish to go through the PCI DSS compliance process, it may always use the services of a PCI DSS compliant payment service provider3.   PCI Security Standards Council, Payment Card Industry (PCI) Data Security Standard Requirements and Security Assessment Procedures (Version 3.2.1, May 2018), online (PDF): Official website of the PCI Security Standards Council These can be found through a search using the keywords “PCI DSS compliance” or “PCI DSS conformity.” These can be found through a search using the keywords “PCI DSS Payment Gateway.”