CASL for Mortgage Brokers: What You Can Send (and When Consent Expires)

CASL covers more than email newsletters

CASL, in force since 2014 and enforced primarily by the CRTC, applies to commercial electronic messages (CEMs) — email, SMS, and social media DMs that encourage participation in commercial activity. A rate-update blast, a “time to review your mortgage” note, and a renewal offer are all CEMs. Messages that purely service an active file — requesting documents, confirming an appointment, delivering a commitment — generally fall under exemptions from the consent requirement, though the formal content requirements below can still apply. When a message mixes servicing with selling, treat it as a CEM.

Express vs. implied consent

Express consent is a clear, affirmative opt-in — and it does not expire. It survives until the person withdraws it. To be valid, it has to be collected properly: you identify yourself, state what they're consenting to, and note that they can unsubscribe. A pre-checked box doesn't count.

Implied consent arises automatically from a business relationship or an inquiry — no form, no signature. The catch is that it runs on a timer, and the burden of proving it sits with you, not the recipient.

One trap catches brokers constantly: once implied consent lapses, you cannot email the contact to ask for express consent — a consent request is itself a CEM. Collect express consent while you're already lawfully in contact: at intake, at signing, or by phone (live two-way voice calls are not electronic messages under CASL — though voicemail and recorded messages are treated differently, and calls fall under the CRTC's telemarketing and do-not-call rules — verify those separately before building a call campaign).

The implied-consent clocks

• Existing business relationship: commonly framed as roughly two years from a purchase of a product or service, or from the end of a contract — verify the current windows against CRTC guidance before relying on them. For a broker, the conservative reading starts the clock when your service completes — at funding — not when the mortgage matures.
• Inquiry: commonly framed as roughly six months from an inquiry or application. A lead who filled out your rate form and went quiet is on this clock, not the two-year one.
• Conspicuous publication: a narrow B2B basis — a referral partner who publishes their business email without a no-solicitation note can generally be messaged about things relevant to their role.

Notice the structural problem: a five-year mortgage term outlives a two-year implied window by three years. If you did nothing at funding, the contact goes legally dark long before renewal season.

Can you email this contact?

What every CEM must contain

Consent gets you the right to send; the message itself still has formal requirements. Every CEM must identify who is sending it (and anyone on whose behalf it's sent), include contact information that remains valid after the send, and carry a functioning unsubscribe mechanism that can be actioned easily and honoured promptly — commonly framed as within ten business days, with the mechanism staying operational for a period after sending. Verify the current specifics before templating your campaigns. There is no “it's just a market update” exception.

The renewal problem — and how disciplined brokers solve it

Renewal outreach does its real work in the final year of the term — exactly when implied consent has usually expired. Ongoing newsletters don't extend the window; only a new transaction or express consent changes the math. The clean fix costs nothing: capture express consent at intake, in the same sitting where you're already collecting ID and consent paperwork for your FINTRAC obligations. Do that on every file and your entire renewal playbook runs on consent with no clock attached — years 4 and 5 included.

Record-keeping: consent you can't prove doesn't exist

Because the onus of proving consent rests on the sender, every contact in your database needs four fields: consent type (express, implied, or none), date obtained, how it was obtained (intake form, funded transaction, web inquiry), and evidence (the signed form, the timestamp, the application record). Unsubscribes need the same rigour — logged and actioned, not just deleted. This is where generic CRMs quietly fail brokers: a marketing checkbox with no basis, date, or source recorded is not a CASL defence.

The penalties are not symbolic

CASL carries administrative monetary penalties with commonly cited maximums reaching seven figures per violation for individuals and eight figures for businesses — verify current figures and enforcement posture before you calibrate risk. Directors and officers can face personal exposure, and CRTC enforcement has not been limited to mass spammers. For a brokerage, the realistic downside of a sloppy database campaign is an investigation, an undertaking, and a penalty that dwarfs whatever the campaign earned.

Build campaigns on a database you can defend

CASL compliance is ultimately a data problem: who consented, on what basis, when, and when it expires. Inside BrokerOS, consent lives on the client file next to funding dates and renewal timelines — so “can I email this segment?” is answerable before a campaign goes out, not after a complaint comes in. Start free and put your database on a defensible footing.