The Bank of Canada (the "BoC") has released its supervisory framework for retail payments under the Retail Payment Activities Act (the "RPAA").

In June 2021, the Federal Government enacted the RPAA, a new legislative framework to regulate retail payment activities in Canada. Pursuant to the RPAA, the BoC has been designated as the authority responsible for retail payments governance (see Federal Government Releases Draft Legislation to Regulate Retail Payments). The BoC's new supervisory framework explains how it will assess Payment Service Providers ("PSPs") for compliance with the RPAA, promote compliance, and monitor and evaluate trends and issues in the payment system.

This framework covers three activities: (1) registration; (2) risk monitoring; and (3) enforcement. Further guidance on these activities is to be published in the near future to help PSPs better understand what is expected of them. The RPAA, regulations and guidance will collectively set out the BoC's supervisory expectations.

Registration

One of the burning questions with respect to the new retail payments framework is who will be required to register. The supervisory framework provides some further information to address this, although questions remain. Individuals or entities who a) are payment service providers, b) perform a retail payment activity, c) meet a certain geographic scope and d) perform a payment function that is caught by the RPAA (and its regulations) will be required to register as a PSP. The BoC has provided the following further information about the four criteria:

  • Being a PSP means that the person would perform one or more payment functions as a service or business activity other than as incidental to another service or business activity. Payment functions are any of the following: providing or maintaining a payment account, holding funds, initiating an electronic funds transfer (EFT), authorizing or transmitting instructions about an EFT and clearing or setting payments. Further information about what constitutes these functions (in particular the holding of funds) is still forthcoming.
  • Performing a retail payment activity means performing payment functions with respect to an EFT in any currency other than a digital currency.
  • Geographic scope means having a place of business in Canada or having a place of business outside of Canada but performing retail payment activities for an end user in Canada and directing retail payment activities at individuals or entities in Canada.
  • The list of payment functions that are excluded from the RPAA and associated regulations include transactions using automatic teller machines and internal transactions among affiliated entities. Persons exempted from registration as a PSP, regardless of activity, include regulated financial institutions, provincially regulated loan companies, PSP's agents and mandataries, and Payments Canada.

Registration will be done via an online portal that is currently being developed. Among the tools under consideration for development is a questionnaire to assist persons in determining whether they are required to register. The BoC consulted industry stakeholders with respect to the design of this portal, and responses received can be reviewed here: consultation document (PDF).

The coming into force of Section 29 of the RPAA kicks off a transition period for registration of PSPs. During this period, while an application is being considered by the BoC, persons who are providing any payment services that are caught by the RPAA will be permitted to continue providing services during the transition period if they have submitted an application.

Importantly, the application review process for registration will include a national security review by the Department of Finance Canada pursuant to the RPAA, meaning that any persons applying to become a registered PSP must pass a national security review. Information about the applicant will also be shared by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and a registration can be refused on the basis of information provided by FINTRAC. In addition, registration can be refused or revoked for various reasons, including failing to meet the criteria for registration, failing to provide additional information, providing false or misleading information, ceasing to perform retail payment activities, or committing a violation under the RPAA or pursuant to a directive of the Minster of Finance (Canada).

Risk Monitoring

The second aspect of the supervisory framework includes the BoC assessing registered PSPs' operational risk management, incident response frameworks, and safeguarding of end-user funds. The BoC will use information gathered from PSPs to assess these areas and ensure compliance with the supervisory framework at a designated minimum frequency.

To assist with information gathering, PSPs must respond to information requests from the BoC, and are required to submit annual reports, incident reports, and significant change or new activity reports to the BoC. Further, the BoC may also request a desk review, an on-site visit, or a special audit for assessment purposes. If the BoC identifies any non-compliance with the RPAA in their assessment efforts, the PSP will be notified and will be permitted to decide how to address and correct the issues identified.

Enforcement

If the BoC's assessment provides reasonable grounds to believe that a violation has occurred, the BoC may also take enforcement action against a PSP. Violations that may warrant enforcement measures include failing to: register; submit mandatory reports; respond to information requests; comply with required practices set out in the RPAA; and comply with required safeguarding practices for end-user funds.

There are several different tools that can be used by the BoC in their enforcement measures, one of which includes entering into formal compliance agreements with PSPs to rectify non-compliance. In some cases, if a PSP does not adhere to the terms of a compliance agreement, the BoC can issue a notice of violation, which can include an administrative monetary penalty ("AMP") and an offer to enter into a compliance agreement. This compliance agreement can in turn reduce the AMP by half if complied with, but if it is not complied with, then this half will need to be paid in addition to other penalty payments. The BoC can also issue compliance orders before a violation is committed, if the Governor suspects that one may occur. Lastly, the BoC has the power to issue a superior court order in response to a violation.

If a PSP does not agree with an enforcement measure, they may request a review by the Governor within 30 days of receiving: a notice of refusal of registration; a notice of intent to revoke registration; a notice of violation; or a notice of default. This may then be appealed to the Federal Court if upheld.

What's Next?

The supervisory framework provides some clarity on how the BoC will approach regulation of PSPs. However, the RPAA is largely not yet in force yet and we are still waiting on draft regulations and further guidance. Businesses in the payments space will need to continue to be patient as this new regime continues to develop.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.