Re-engineering Real Estate Deposits in Canada

1. The Structural Problem

Problems live at different levels. A weakness in the structure cannot be fixed at the process, technology or supervisory layers. It can only be managed there, at rising cost. Pooled trust accounts create a structural concentration of custody and control risk. Modern infrastructure now makes it possible to reduce that concentration without giving up the fiduciary protections the trust regime was designed to provide.

1.1 Concentration Risk

When a buyer's deposit enters a general trust account, it joins money from dozens or hundreds of other transactions. Three exposures follow.

Misappropriation. One dishonest signatory can reach every client in the account, and a shortfall in one file can be covered with money from another until the gap is too large to hide. iPro showed the pattern at scale.

Insolvency. When a firm fails, its pooled accounts freeze. The iPro trust accounts can only be released by court order, and the insurer is still seeking that order.³ Working out who is entitled to what becomes forensic accounting, measured in months.

Operational error. Reconciling commingled balances by hand leaves room for error and room for concealment. The ledger that hides an honest mistake hides a dishonest one just as well.

In each case, pooling moves risk from the party that controls the money to the consumer who is entitled to it.

1.2 Detective Controls, Not Preventive Ones

Supervision of pooled accounts runs on inspection. Inspectors sample. Auditors attest to a point in time. Between those points the regulator reads the firm's own records. In iPro, the independent review found the regulator learned of the shortfall in May 2025 and did not freeze or monitor the accounts for nearly three months. The board learned of it on August 10, two days after an agreement with iPro's principals was signed.^3,4 The controls existed. They were detective, and they depended on discretion at the top.

A complete control framework has three layers. Preventive controls stop the loss from occurring. Detective controls find it quickly. Recovery controls restore the client. Today's regime is strong on the last two and thin on the first. This paper is about adding the first.

1.3 The Regulatory Paradox

Canada does not lack rules. Ontario has TRESA, RECO's inspection regime, Law Society By-Law 9, the trust requirements of the Condominium Act and Tarion. Quebec has the Real Estate Brokerage Act and the OACIQ, the notaries' trust accounting regime, compensation funds for both professions, and the mandatory new home guarantee plan administered by GCR. FINTRAC obligations sit across the chain. The rules describe correct behavior in detail. They do less to make incorrect behavior structurally difficult. Each new reporting layer adds cost to the honest majority and changes little for the dishonest few.

1.4 Where the Float Goes

Pooling also determines who earns the interest. In Quebec, a notary's general trust account carries an irrevocable waiver of interest in favor of the Fonds d'études notariales.¹² Unclaimed interest on brokers' trust accounts goes to the OACIQ.¹¹ By December 2025 the notarial fund held $311 million and the Barreau's equivalent $122 million.¹⁴ In April 2026 the legislature directed 50 percent of the first $75 million of annual interest revenue, and 75 percent above that, to the Fonds Accès Justice.¹⁵

CPN takes no position on where that money should go. That is a policy choice, and it belongs to legislators and the professional orders. Our contribution is capability: governance embedded in the system rather than applied after the fact. Transaction-level safeguarding makes any allocation executable and visible, per transaction, by rule: interest to the depositor, to an access-to-justice fund, or divided between them. We note once, plainly, who is affected. If the default ever moved toward the depositor, the notarial and legal studies funds, the Fonds Accès Justice and the OACIQ would see less revenue. A pilot can preserve today's allocation exactly, so that no body whose guidance matters is asked to fund the experiment.

2. Two Provinces, One Exposure

2.1 Ontario

On a resale, the buyer's deposit usually sits in the listing brokerage's trust account under TRESA. The balance of the price moves through the lawyers' trust accounts at closing. On new condominiums, deposits must be held in trust under section 81 of the Condominium Act, 1998, with Tarion as a backstop capped at $20,000 per unit.⁷ Pre-construction deposits routinely run several times that figure. Above the cap, protection rests on the trust account being properly kept and the builder staying solvent. That risk is no longer theoretical. Urbanation counted a record 28 active condominium projects, totaling 7,243 units, cancelled in the Greater Toronto and Hamilton Area in 2025, more than double the 3,469 units cancelled in 2024.⁸

RECO's reforms are real. About 3,800 brokerages must now file annual financial information, including trust assets and liabilities, unclaimed trust money and an attestation by the broker of record. The first filings are due October 30, 2026.⁶ The regulator will see more, more often. It will still be looking at pooled balances through the firm's own records.

2.2 Quebec

Quebec begins with better instruments. On a resale, the buyer's deposit goes directly into the trust account of the agency or broker named in the promise to purchase, never through the firm's operating account, and stays there until the notary requires it for the deed.^9,10 The OACIQ is explicit that the deposit remains the buyer's until the deed is signed or a court orders a transfer of title.¹⁰ The brokerage regulation already provides a special trust account in the depositor's name, with interest to the depositor, when the depositor expressly asks for it.¹¹ The notarial regime has the same instrument.¹³

At the deed, every sum in the transaction moves through the notary's trust account: the buyer's down payment, the lender's mortgage advance and the payout of the seller's mortgage. The notary must confirm that funds are available and sufficient before closing.¹⁷ Quebec has a regulated, impartial professional at the center of every residential closing. That is a real strength.

The special account, however, is the exception. Funds enter the general account first, move to a special account only on request, and return through the general account before they are paid out.¹¹ The request is rarely made, because the cost of opening a special account usually exceeds the interest it earns.¹³ The default remains pooled.

Compensation is capped well below the size of a modern closing. The real estate indemnity fund (FICI) pays up to $100,000 per claim for fraud or misappropriation by a broker.¹⁶ The notaries' compensation fund is also capped per claim by regulation.¹⁸ A Montreal resale, with a buyer and a lender both entrusting funds to the same notary, passes those limits easily. New construction follows the same pattern. The mandatory guarantee plan refunds deposits up to $50,000, and only for buildings with no more than four superposed private units. Above that amount, covered builders must protect deposits through a plan, insurance, a surety or a trust deposit, and buyers in larger buildings fall outside the mandatory plan altogether.¹⁹

2.3 The Common Thread

Both provinces protect deposits with the same three layers: a trust account controlled by a professional, periodic inspection by a regulator, and a capped compensation fund that pays after a loss. The compensation funds are the tell. A system that must pre-fund its own failures has accepted that failures will happen. Quebec has already written the preventive instrument into its rules. It has not yet made it the default.

3. What Is Being Done

Supervisory reform. RECO's annual filing and planned monthly reconciliation will shorten the time between a breach and its discovery. Quebec's April 2026 legislation governs where trust interest goes. Neither changes where the money sits or who can move it.

Digital workflow. SureFund replaces cheques with electronic transfers into the same pooled trust accounts. GoVeyance digitizes conveyancing workflow on the same structure. Deeded simplifies virtual closings without altering custody. Quebec brokers and notaries already accept deposits by electronic transfer. These tools make the existing model faster. They leave its architecture unchanged.

Faster rails. Canada's Real-Time Rail has had its legal framework in force since August 24, 2026, and launches in phases from the fourth quarter.²⁰ It will carry richer data and settle in seconds. Faster money does not make pooled money safer. It makes a misdirected payment final sooner.

4. Transaction-Level Safeguarding

4.1 The Outcome, Not the Account

The goal is not a particular bank account. It is an outcome: legally segregated, transaction-specific funds, held at a regulated institution, with release controls that can be independently enforced. Several banking designs can produce that outcome. They include individual trust accounts, special trust accounts in the depositor's name, virtual accounts mapped to segregated beneficial interests, pooled structures with transaction-level sub-ledgers that meet prescribed safeguarding standards, and tokenized deposit contracts where the holding institution issues them. Scheme rules should specify the control outcome and the evidence that proves it. Each participating institution should propose its own compliant implementation. That keeps the model economic for banks and keeps CPN out of their ledger design.

4.2 Design Principles

The following design principles guide any solution.

1. Segregation by design. One transaction's funds cannot be used to satisfy or conceal another transaction's obligations. Fraud, error and insolvency are contained within the transaction where they occur.

2. One source of truth. Every authorized party sees the balance from the institution that holds it and the entitlement and release state from the scheme registry, not from an intermediary's records.

3. Embedded compliance. Identity, AML and trust obligations are met when funds enter and leave, not rebuilt at year end.

4. Conditional, multi-party release. Money moves only when the recorded entitlement allows it, the evidence for each release condition has been validated against the rulebook, and more than one authorized party has acted. No single credential is enough.

5. Custody independent of technology. Funds sit at the regulated institution in the transaction's name. If any software provider fails, the money stays where it is.

6. Float allocated by rule. Interest follows whatever allocation law and the parties set, visibly and per transaction.

4.3 Entitlement State

The scheme does not decide who owns a deposit. Entitlement depends on the jurisdiction, the contract, the conditions and sometimes a court. The scheme records and enforces the entitlement and release authority established by applicable law, the transaction agreement, professional obligations and, where necessary, court or tribunal orders. In the ordinary Quebec resale, that means the deposit is recorded as the buyer's, releasable to the notary for the deed or back to the buyer if the promise becomes null.¹⁰ The rulebook defines how each state is evidenced and who may change it. The law defines what the states are. The scheme registry, operated by CPN, holds the state. The holding institution holds the money.

4.4 How It Works

The following outlines the basic functions.

1. 01

   Opening. When the promise to purchase or agreement of purchase and sale is accepted, the fiduciary opens a safeguarded position for that transaction at a participating institution. It carries the transaction reference, the parties, the entitlement state and the release conditions.

2. 02

   Funding. The buyer pays from their own account directly into the transaction. The payer sees a verified payee name before the money moves.

3. 03

   Verified deposit status. The seller and the seller's broker do not receive a PDF receipt. They receive an authoritative status from the holding institution, attested under scheme rules: amount received, institution, property, safeguarded status, release authority and time. No account number is exposed. The deposit becomes evidence the whole transaction can rely on.

4. 04

   Closing day. Release conditions map onto the sequence the profession already follows. In Quebec, that means waiver of conditions, the notary's request for the deposit, confirmation of the lender's advance, signature of the deed and publication at the land register. Each second authorization is an event already in the file, such as the lender's advance or the notary's confirmation. None is a phone call. When the control layer has validated the evidence for each condition, it issues the release instruction to the holding institution, which executes the payment on the rail it already uses. The design standard is simple: closing should be no slower than it is today.

5. 05

   Collapse. If the deal fails, funds return under the agreed terms from a known balance. There is no question of which money belongs to whom.

4.5 The Control Layer

Rules prevent loss only if something enforces them on every transaction before the money moves. In this scheme that something is the control layer, which CPN operates. It has three parts.

The registry. A directory of verified participants: holding institutions, professionals and firms in good standing with their order or regulator, certified service providers, and the safeguarded account each is authorized to use. A buyer funding a transaction or a notary receiving a release sees a verified payee drawn from the registry, not an account number typed into an email. France reached the same outcome by requiring every notary account to carry the Caisse des Dépôts identifier. The registry generalizes it.

Entitlement and evidence. For each safeguarded position the control layer holds the entitlement state and the release conditions set by law and by the agreement. Each condition names the evidence that satisfies it and the party entitled to supply it: the accepted promise to purchase, the waiver of conditions, the lender's confirmation of its advance, the notary's request, the signed deed, the publication at the land register. The control layer checks each document against the criteria in the rulebook when it arrives, records the result, and does not accept an instruction whose evidence is missing, inconsistent or supplied by the wrong party.

Orchestration. When every condition on a release is satisfied and the required authorizations are in place, the control layer issues the payment instruction to the holding institution, carrying the transaction reference and the evidence trail in ISO 20022, and the institution executes it on whichever rail it uses. The same mechanism returns a deposit when a promise becomes null, applies a freeze when a dispute is filed, and routes a court order to the one position it names. Nothing in the sequence requires a professional to key a wire or a bank to interpret a letter.

The control layer holds no money. It decides, on recorded evidence, whether money may move, and instructs the institution that holds it. That is the difference between a rule written down and a rule enforced.

4.6 Matching Controls to Failure Modes

Different failures need different controls. No single design feature answers all of them, and the new model carries risks of its own.

Impostor fraud deserves emphasis, because segregation alone does not stop it. In Malo c. Chambre des notaires, decided by the Court of Appeal in November 2025, a notary received two deposits totaling more than $7 million from parties dealing with a fraudster, and funds were sent to Cambodia. The court found the notary had not knowingly made an unauthorized transfer.²⁶ The money moved anyway. Verification of payee and a release condition outside the fraudster's reach are the controls that answer that case.

4.7 Supervisory Access

Supervisors need timely visibility, not unlimited access. Under the rules, a supervisor sees balances, status, exceptions, reconciliation state and alerts for its registrants, continuously. Personal information is available only where the supervisor's statutory authority requires it. CPN does not replace the regulator. It operates a standard supervisory interface and an evidence layer. Regulatory authority stays where the statute puts it.

5. The Hard Cases Are the Argument

A simple closing needs little governance. The hard cases are where pooled trust accounts strain and where a shared rulebook earns its place.

Disputes. Who may freeze a deposit, and on what notice? What happens when buyer and seller make competing demands? The rules define the notice, the freeze, the evidence required to lift it and the path to a tribunal.

Orders and seizures. Court orders, garnishments and insolvency proceedings must reach the right transaction without touching others. A position that already names its transaction makes that precise.

Death, incapacity and representation. Estates, mandates and powers of attorney change who may act. The rules define how that change is evidenced and recorded.

Errors and late information. Funds sent in error, a sanctions match after funding, a fraud investigation opened mid-transaction. Each needs a defined hold and release path.

Today, each firm answers these questions alone, and each bank answers them differently. One vendor answering them builds a product. A dozen vendors answering them differently build fragmentation, and no regulator can endorse either. A scheme answers them once, in writing, with the participants who will live under the answers, and the control layer applies each answer the same way on every transaction.

6. The Legal Pathway

The technology is ready. The desired legal outcome largely exists. The open question is what recognition, rule amendment or legislative change would make transaction-level safeguarding the default rather than the exception. The map below is our working view, to be confirmed by counsel in each province.

Deposit insurance. The account structure does not by itself determine coverage. CDIC protects deposits held in trust up to $100,000 per beneficiary, provided there is a valid trust under provincial law and the required trustee and beneficiary information sits on the institution's records.²⁷ A pooled account with proper disclosure can qualify as well. A Montreal resale with a mortgage advance will exceed the limit regardless. What transaction-level safeguarding changes is the evidence. Beneficiary disclosure becomes automatic and current, so the insurance question is answerable on the day it matters rather than reconstructed afterward. Treatment of caisse deposits under the Autorité des marchés financiers regime needs the same confirmation.

7. What Each Participant Gets

7.1 The Holding Institution

A bank or caisse will ask a simple question: why would I do this? The honest answer starts with cost. Account lifecycle, identity checks, trust classification, reconciliation, exceptions and supervisory records are real work. Nobody should claim it costs cents until an institution has measured it.

The answer continues with the franchise. Average safeguarded balances equal the number of transactions, times the average deposit, times the average holding period. For resale, holding periods are weeks. For pre-construction, they run to years. The institution also gains verified prospective mortgage borrowers, early sight of property transactions, relationships with brokers, notaries and lawyers, and the payment flows at closing. The scheme reduces the cost side. Onboarding, identity, exception handling and supervisory reporting follow one standard rather than a bespoke build for every professional, release instructions arrive validated and ready to execute, and liability is allocated in the rules before anything goes wrong. CPN is not asking institutions to provide infrastructure as a public service. It is offering a structured deposit and transaction franchise.

7.2 Brokers, Notaries and Lawyers

The professional's first question is equally direct: are you taking my trust account away? The answer is no. The professional keeps the client relationship, the contractual role, the deposit instruction, full visibility, the authority their role carries and the transaction record. What they shed is pooled-money reconciliation, cheque handling, wire instruction risk, dormant balance administration, much of the audit preparation, and exposure to a catastrophic trust failure caused by someone else in the firm. They remain the trusted professional in the transaction. They stop being its bank.

7.3 Buyers, Sellers and Supervisors

Buyers gain protection they can verify, not merely trust. Sellers gain an authoritative confirmation that the deposit is real and safeguarded. Supervisors gain preventive controls and continuous evidence in place of sampling and forensics.

8. Why a Scheme, and Where CPN Fits

CPN's rules are independent and configured for the specific network. Provincial law is written into jurisdictional rules from the start, so a Quebec network operates in Quebec civil law and in French rather than translating an Ontario product after the fact.

The roles are simple. A Network Sponsor, an industry body or consortium, brings the network into being, carries its purpose and may brand it as its own. The rulebook, registry and control layer under that brand are CPN's, and CPN operates them. Holding institutions safeguard the funds and move them on existing rails. Certified service providers, such as practice management software and closing platforms, connect under certification. Professionals authorize within their fiduciary role. Lenders and title insurers confirm advances and coverage as recorded events, and receive verified deposit status in return. Supervisors receive the view the rules define.

CPN brings three things and operates all three. The rulebook, with certification of participants and a clear allocation of liability. The registry of verified participants and their safeguarded accounts, through which verification of payee, sanctions screening and business verification reach every participant at once rather than being rebuilt by each firm. And the control layer described in Section 4.5, which holds entitlement state, validates the evidence behind each condition and issues the release instruction to the holding institution.

Its data standards follow ISO 20022, so the transaction reference, its conditions and its evidence travel with the payment on whichever rail carries it. CPN is a payment service provider registered with and supervised by the Bank of Canada under the Retail Payment Activities Act, a regime built on the same principles this paper applies to deposits: segregation of end-user funds, operational risk management and incident reporting.

What CPN does not do. CPN never holds, moves or takes custody of client funds. It extends no credit and carries no balance-sheet position in any transaction. It does not determine entitlement; law, contract and, where necessary, a court do. It does not replace any regulator. It is not a software vendor selling to brokers. That neutrality is the point. A caisse and a chartered bank can join the same rulebook without handing a competitor their clients, and a regulator can recognize a set of rules without endorsing a company. The operator is bound by the rulebook like every other participant, and the funds never depend on it. If CPN failed tomorrow, every deposit would still sit at its institution, in its transaction's name.

9. Why Quebec Is a Strong Place to Start

The notary is already the center. Every Quebec closing settles through one regulated, impartial professional. Change the instrument that professional uses and the market structure changes with it.

The instrument already exists. Both the brokerage and notarial regimes recognize a special trust account in the depositor's name. The reform is to make the protected form the default, not to invent something new.

Deposits already stay out of operating accounts. OACIQ rules require deposits to go straight to trust, never through the firm's own account.⁹ The discipline that transaction-level safeguarding extends is already in place.

The financial network fits. A deep cooperative network with provincial deposit insurance, alongside the chartered banks, gives a pilot credible holding institutions from day one.

The policy conversation is open. Quebec has just legislated on trust interest. A capability that executes any allocation transparently arrives at a useful moment for legislators and the orders alike.

10. Comparative Analysis

The comparison below is meant to be fair to both models. The proposed model is stronger on prevention and evidence. It also introduces new dependencies that the rules must manage.

11. A Controlled Pilot

This should not start as a product launch. It should start as a controlled regulatory experiment.

Scope. One holding institution, 10 to 20 notaries and brokerages, one transaction class, resale deposits in a defined region of Quebec. A legal opinion before the first deposit. The OACIQ and the Chambre des notaires invited to observe from the start. Today's interest allocation preserved exactly.

Measures. Funding errors, reconciliation effort, time to release on closing day, exceptions and how they were resolved, fraud attempts and their outcome, quality of audit evidence, and cost per transaction for the institution and for the professional. Control tests set in advance, results published to the observers.

What follows. If the pilot proves out, the path runs from guidance recognizing transaction-level safeguarding as compliant, to industry adoption as lenders and insurers price it, to a possible mandate where the protection gap is widest. The deposit is the first transaction class, not the last. The same control layer that releases a deposit can sequence the rest of closing day, the lender's advance, the payout of the seller's mortgage and the adjustments, against the same evidence, so that settlement follows recorded events rather than a hand-run ledger. Pre-construction deposits above compensation caps are the next candidates, and staged release is the pattern construction already knows. Existing closing platforms and practice software keep the workflow and connect as certified participants.

12. Conclusion

Canada's deposit system rests on pooled accounts and periodic audits. Those tools were built for a paper-era market, and they carry more weight today than they were designed for. Ontario learned that in 2025. Quebec has written the better instrument into its rules and left it as the exception.

Today's reforms improve convenience and supervision. They leave the concentration of custody and control intact. Transaction-level safeguarding adds the missing preventive layer. It contains fraud, error and insolvency within the transaction where they occur, turns oversight from retrospective to continuous, and makes any policy on interest executable and visible.

The strongest version of this idea is not a new kind of bank account. It is a governed standard, with a network that enforces it. Funds remain at regulated institutions. Professionals keep their legal and fiduciary roles. CPN provides the rulebook, operates the registry and the control layer that validate every release before it happens, and gives supervisors continuous evidence, so that each deposit is protected and controlled on its own.