On August 21, 2024, the Bank of Canada (the "Bank") published additional guidance with respect to the Retail Payment Activities Act (Canada) (the "RPAA"), including additional case studies regarding application of the RPAA (the "Additional Case Studies"), amendments to its Criteria for Registering Payment Service Providers, and a new supervisory policy related to acquisitions of control and prescribed changes (the "Acquisitions Supervisory Policy").
Read our earlier blog posts regarding the RPAA and associated guidance previously issued by the Bank to follow the new regulatory framework's developments and determine whether your business will need to submit a registration application between November 1 and November 15, 2024.
1. Who Does and Doesn't Need to Register as a PSP: Additional Case Studies
The Additional Case Studies contemplate different scenarios than those published by the Bank on December 12, 2023 (which we discussed in one of our previous blog posts), and address some common questions about the application of the RPAA. In particular, the Additional Case Studies assist with clarifying the following:
- E-Commerce Software Providers: Companies that provide software tools for merchants to build e-commerce websites will not be subject to registration as a payment service provider ("PSP") under the RPAA if they do not provide a payment function, and instead when a merchant's customer clicks on the "check-out" or similar button, the customer is re-directed to a page or portal hosted by another service provider (which would be a PSP) that performs the payment functions.
- Payment Gateways: Companies that provide software interfaces that allow for the encryption and transfer of a payer's personal information and payment credentials between a payment portal and the front-end processor or a merchant's acquirer to facilitate the checkout process and accept payments will be required to register as a PSP under the RPAA. These companies would be considered to be performing the payment functions of initiating an EFT by capturing and packaging the relevant payment information to generate the first payment instruction that triggers the EFT, and authorizing an EFT or the transmission, reception or facilitation of a payment instruction in relation to an EFT, by prompting the payer to click to consent to the transaction and by receiving a confirmation that the payment has been approved and processed from another participant in the payment chain.
- E-Wallets: Companies providing e-wallet services where funds are loaded onto an e-wallet by a customer transferring funds to the company's bank account, which is then credited to the customer in the e-wallet application, will be considered to be holding funds and be subject to the safeguarding of end user funds requirements under the RPAA (the "Safeguarding Requirements") as soon as the funds are received from the customer and a PSP will only be considered to stop holding funds on behalf of that customer when an instruction to transfer all of the funds to another person is received by the PSP.
- Money Transfer Businesses and Intermediaries: Companies that allow customers to make immediate transfers of funds, are in possession of customer funds only while processing a transfer and do not hold such funds or a portion thereof to fund future transfers (i.e., no pre-funding of transfers), will not be considered to be holding funds and subject to the Safeguarding Requirements. This is the case even if it takes multiple days for a transfer to process because the funds will be considered to be subject to an instruction for immediate transfer since they cannot be used for any other transfer or withdrawal. The same applies to intermediaries that exchange payment instructions as part of a transfer.
- Payroll Services: Companies that conduct their own payroll services to pay employees directly on their own behalf (and not for any other third parties) will not need to register as PSPs. Conversely, companies that provide software and associated payment services to perform payroll services for corporate customers by receiving such customers' payment details and employee information, and making required payments to employees by EFT, will be required to register as a PSP. Examples of such companies that will need to register include those that: provide and maintain an account containing personal or financial information of the employees to whom payments will be made, initiate EFTs to employees at the request of the customer, hold the customer's funds at rest before initiating the EFTs, or authorize EFTs and transmit, receive or facilitate instructions in relation to EFTs.
- Remittance Services and Immediate Transfers: Companies providing remittance services will generally be required to register under the RPAA; however, the Safeguarding Requirements only apply where funds are kept at rest or can be stored by customers with the remittance service provider for future use (e.g., where a company also offers a multi-currency wallet). The Safeguarding Requirements will not apply where the funds are immediately subject to an instruction to transfer to a beneficiary's account.
- Exemption for Securities Dealer Services: Companies that are registered as investment dealers with the provincial securities regulators and perform payment functions in relation to EFTs by permitting customers to fund their account through an app for the purposes of trading in securities can rely on the exemption for securities transactions to avoid application of the RPAA; however, if such companies perform other payment functions that are outside of retail payment activities for the purposes of securities-related transactions (such as also offering a cash account), then registration will be required under the RPAA for such activities.
Companies that are registered money services businesses ("MSBs") for payment or money transferring activities with the Financial Transactions and Reports Analysis Centre of Canada ("FINTRAC") for anti-money laundering ("AML") purposes should carefully review the Additional Case Studies. Despite similarities between the guidelines on what constitutes registerable activities under the RPAA and AML regimes, and the fact that the Bank will be sharing PSP applicant information with FINTRAC, the two regimes are separate; a business that has to register under one regime is not automatically required to register under the other.
2. Amendments to Exemptions for PSP Registration
The Bank also published amendments to its Criteria for Registering Payment Service Providers (the "Amendments") to clarify certain exemptions from the PSP registration requirements.
The Amendments clarify the scope of the exclusion from the application of the RPAA for retail payment activities made for the purpose of "giving effect to" an eligible financial contract as defined in Section 39.15(9) of the Canada Deposit Insurance Corporation Act (Canada) (the "CDIC Act"). Under the CDIC Act, what is considered to be an "eligible financial contract" is set out in Sections 2(a)–(i) of the Eligible Financial Contract Regulations and includes, among other things, certain derivatives agreements and agreements related to borrowing, lending or repurchasing of securities or commodities.
The Bank considers an activity to be "giving effect to" an eligible financial contract if it is: (i) done for the purpose of entering into or acquiring, amending, transferring or disposing of rights under an eligible financial contract; (ii) done for the purpose of satisfying any entitlement, liability, debt or obligation under an eligible financial contract; or (iii) relates to trading or advising in eligible financial contracts.
The Amendments also clarify that the exclusion from the application of the RPAA for retail payment activities that are performed by an individual or entity that is regulated, or exempt from regulation, under Canadian securities legislation is available, if both of the following are met:
- the retail payment activity performed is for the purpose of giving effect to a transaction in relation to securities (with "giving effect to" having the same considerations as stated above regarding eligible financial contracts except instead with respect to securities); and
- the relevant individual or entity must be regulated or exempted from regulation under Canadian securities legislation.
3. Acquisitions Supervisory Policy: Transaction Impacts
The Acquisitions Supervisory Policy provides guidance to PSPs that plan to undertake: (i) a change of control or an acquisition by an individual or entity; or (ii) an acquisition of certain interests in the PSP by a state-owned enterprise ("SOE").
Under Section 24 of the RPAA, if an individual or entity plans to acquire control of a PSP (or certain interests in the case of an acquisition by an SOE), the PSP must, before acquiring such control or interest:
- submit a new application for registration as a PSP under the RPAA to the Bank that takes the planned transaction into account (referred to as "re-registration" by the Bank); and
- be re-registered with the Bank as a PSP before the transaction is completed.
We note that although this section of the RPAA and the Acquisitions Supervisory Policy do not come into effect until September 8, 2025, that if any acquisitions of interests or control occur following a PSP's submission of its registration application before that date, the PSP should contact the Bank to advise it of any changes to information included in its registration application.
A. Possible Significant Delays for Certain PSP Transactions
The requirement to submit a new application for registration before an acquisition of or change of control of a PSP, or the acquisition of certain interests in a PSP by an SOE, may have significant implications on transactions and investment activities involving PSPs.
The requirement for a PSP to re-register under the RPAA before completion of a potential transaction introduces uncertainty given that re-registration will be a necessary condition precedent to closing the transaction. Further, the Acquisition Guidelines make clear that it is the PSP's responsibility to ensure it allows for sufficient time for the application to be reviewed.
The timeline for review has the potential to be lengthy:
- The Bank has up to 45 days to determine whether to refuse an application once the application is complete—this timeline may be extended if the re-registration application needs to be amended due to a material change in the details of the transaction (e.g., change in parties, change in corporate structure post-closing, etc.).
- Following the Bank's review, the Minister of Finance (the "Minister") has up to 60 days to determine if it wants to review the re-registration application for national security purposes, and may extend this by one or more 60-day periods.
- If the Minister decides to review an application, the Minister has up to 180 days to complete the review, which may be extended by one or more 180-day periods.
It remains to be seen in practice what the typical approval timelines for an acquisition or change or control will be, but PSPs should be aware that this time frame could be three months or longer, particularly if the Minister determines that it will review an application.
Accordingly, PSPs should ensure that:
- re-registration under the RPAA is accounted for in transaction timelines and the expectations of the parties are aligned accordingly;
- any letter of intent or purchase agreement includes re-registration as a condition precedent to completion of the transaction and an outside date for completion that accounts for the above-noted timelines; and
- the application for re-registration is submitted as soon as possible once the PSP has sufficient certainty regarding the terms of the transaction (including information about the business structure and an updated organization chart, information on all entities that will control or be controlled by the PSP and any changes to payment function, values and volumes of transactions or end-user funds held, and any changes to agents, mandataries or affiliates that may perform retail payment functions on the PSP's behalf).
If a PSP's re-registration is approved, the Bank will notify the PSP. Once the transaction has been completed, the PSP must notify the Bank within 5 business days after closing, and the Bank will update the public registry accordingly. The PSP will remain registered under its existing registration until closing of the transaction.
The Acquisitions Supervisory Policy confirms that if the entity seeking to acquire control of a PSP is itself a PSP, that entity does not need to submit an application for re-registration, but other reporting requirements may apply, including updating specified information and reporting a "significant change".
B. Definition: Acquisition of Control Triggering PSP Re-registration
A transaction that will result in any of the following will be considered an "acquisition of control" under the RPAA and require the PSP to re-register with the Bank before closing:
- PSP Corporations: an individual or an entity (including in combination with its affiliates) will acquire, directly or indirectly, securities of the PSP (or of an entity that controls the PSP), that are attached to one third or more of the votes that may be cast to elect directors of the PSP.
It is notable that the Acquisitions Supervisory Policy confirms that the Bank considers an acquisition of control to also occur upon conversion of non-voting securities (e.g., non-voting shares, warrants or options) into voting shares where the above threshold would be met and that re-registration must occur prior to conversion. PSPs should consider if amendments are needed to the rights associated with any convertible securities to avoid conversion or exercise by the holder that would result in an acquisition of control without the PSP first being approved for re-registration.
- PSP Limited Partnerships: a new general partner will be added to a PSP that is a limited partnership; re-registration is required before the individual or entity becomes a general partner.
- Other PSP Entities: if a PSP is neither a corporation nor a limited partnership, an individual or entity will acquire an ownership interest in the PSP if it will be entitled to one third or more of the PSP's profits, one third or more of the PSP's assets upon dissolution or otherwise will acquire control over an entity that controls the PSP (in each case, whether directly or indirectly, including in combination with any affiliates).
C. Definition: Acquisition of Certain Interests in a PSP by a State-Owned Enterprise
Under the RPAA, the term "SOE" has the same definition as in Section 3 of the Investment Canada Act (Canada) and, as summarily stated in the Acquisitions Supervisory Policy, "is any individual or entity that is owned, controlled or influenced, directly or indirectly, by a foreign government".
The following are considered to be acquisitions of an interest in a PSP by an SOE that requires re-registration by the PSP before such transaction can be completed:
- Power to Appoint: an acquisition of an interest in the PSP that will result in the SOE having the power to appoint the PSP's chief executive officer, other senior management officers including the PSP's chief financial officer, chief operating officer, chief risk officer, president and other individuals who are responsible for the highest level of decision-making within the PSP, or one or more members of the PSP's board of directors;
- Voting Rights: an acquisition of an interest in the PSP if it is a corporation and the SOE will obtain any voting rights that would give the SOE the power to cast a vote to elect one or more directors of the PSP; or
- Ownership Interests: an acquisition of an interest in the PSP if it is not a corporation and the SOE would obtain any ownership interest in the PSP—the Acquisitions Supervision Policy emphasizes that "acquisition of even the smallest possible unit of ownership" may only be completed after the PSP is re-registered.
***
Fintechs and others that may be subject to the RPAA should be mindful that the initial registration application period is fast approaching and runs from November 1, 2024 to November 15, 2024 (the "Initial Registration Period"). Beginning on November 16, 2024, entities that have not applied for registration during the Initial Registration Period will continue to be able to apply but must wait at least 60 days following submission of an application to commence retail payment activities.
Registration decisions approving or refusing a PSP's registration application under the RPAA for those entities that applied during the Initial Registration Period will be issued by the Bank beginning on September 8, 2025. See the Bank's Step-By-Step Guide for the information required to be included in the application. Please do not hesitate to reach out to your legal professional at McCarthy Tetrault LLP for assistance.
To view the original article click here
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.