Regulations under the Retail Payment Activities Act to apply to Payment Service Providers published

How the Retail Payment Activities Act and newly-published regulations will impact businesses

By: Michael Garellek, Sarah Mavula and Jae Gee

In brief

On 22 November 2023, the finalized regulations enacted under the Retail Payment Activities Act (RPAA) were published, with registration-related requirements expected to come into force beginning in November 2024 and the remainder in September 2025. The RPAA and Retail Payment Activities Regulations (“Regulations“) make up Canada’s new retail payment supervisory regime overseen by the Bank of Canada, Canada’s central bank. The finalized Regulations provide much relief to thousands of payment service providers (PSPs), as it generally eases the compliance obligations placed on businesses imposed by earlier draft regulations. Together with the RPAA, the Regulations will offer a path forward for PSPs towards Payments Canada membership and system participation. The 2,500 PSPs likely to be affected will need to register with the Bank of Canada by no later than 15 November 2024 and take necessary steps to comply with the regulatory requirements that come into force on 8 September 2025.

Background

The RPAA creates, along with its newly finalized Regulations, a federal retail payment supervisory framework. Under the RPAA and Regulations, the Bank of Canada will supervise PSPs that perform retail payment activities¹ in an effort to address national security risks posed by PSPs, mitigate operational risks, safeguard end user funds, and build confidence, reliability and trust in Canada’s retail payment sector. The RPAA will also be a regime that can provide a path for registered PSPs to obtain Payments Canada² membership and access to Canada’s Real-Time Rail payment system once the Canadian Payments Act is amended to expand the membership eligibility requirements.

Who is affected?

The RPAA and the Regulations apply to the retail payment activities of both PSPs with a Canadian place of business and PSPs outside Canada that provide services to end users in Canada (i.e., payers and payees that use payment services). A PSP is an individual or entity that performs any of the following five payment functions as a service or business activity:

• Provide or maintain end user payment accounts in relation to electronic fund transfers (EFTs).
• Hold end user funds until withdrawn or transferred by the end user.
• Initiate EFTs requested by end users.
• Authorize EFTs or provide instructions of a transmission, reception or facilitation in relation to EFTs.
• Provide clearing or settlement services.

Virtual currencies are not regulated under the RPAA however, electronic payment functions involving transfers of funds to/from digital wallets are captured under the RPAA.

The RPAA will not apply to the retail payment activities of regulated financial institutions, such as banks and credit unions, or those activities that involve closed-loop gift cards. Parties subject to Canadian securities legislation (e.g., securities dealers) will also not be regulated under the RPAA in relation to securities transactions. Additionally, the RPAA will not apply to ATM withdrawals, SWIFT transactions or to PSPs that perform payment functions incidental to other services they provide. More clarity on the exclusion of incidental payment functions will be provided in forthcoming Bank of Canada guidance.

What are the requirements?

The Regulations will create the following standards, which (with the exception of registration) must be complied with by 8 September 2025:

Registration and recordkeeping

• From 1 November 2024 to 15 November 2024, PSPs will be required to register with the Bank of Canada before performing any retail payment activities. PSPs that register outside of this 15-day period will be subject to a 60-day delay in performing retail payment activities.
• There is a prescribed one-time registration fee of CAD 2,500 (to be adjusted for inflation in following years). The Bank of Canada will maintain a public registry of these PSPs, and PSPs must also maintain records sufficient to demonstrate compliance with the RPAA for five years.
• A PSP may be subject to new registrations if it plans to make “prescribed changes”, which include an acquisition by a state-owned enterprise, or if the storage or processing of certain information by the PSP or its third-party service provider outside Canada changes.

Operational risk management

• PSPs must establish, implement and maintain a written risk management and incident³ response framework. The objective of the framework is to preserve the integrity and confidentiality of retail payment activities.

Safeguarding end user funds

• PSPs must, among other requirements, hold funds until withdrawn or transferred by the end user and have a written fund safeguarding framework. The Regulations require that PSPs maintain end user funds in either a trust account pursuant to prescribed financial institutions (e.g., banks and credit unions), provided that the trust account is not used for any other purpose; or with a guarantee or insurance, provided that such insurance or guarantee comes from a regulated financial institution that is not an affiliate of the PSP, and it does not form part of the PSP’s estate in bankruptcy.

Reporting to the Bank of Canada

• PSPs must provide annual reports (the first being due 31 March 2026), incident reports and significant change reports, and respond to Bank of Canada information requests within 15 days.

National security

• PSPs may undergo a national security review by the Minister of Finance (“Minister”), which is automatically triggered upon initial registration with the Bank of Canada. In its power, the Minister may refuse a PSP’s application, revoke its registration, order undertakings or conditions, as well as issue national security orders for a PSP to take or refrain from any action.

Enforcement

• PSPs may be subject to administrative monetary penalties of up to CAD 1 million for “serious violations”, and up to CAD 10 million for “very serious violations” (with some exceptions) as classified under the Schedule to the Regulations. “Very serious violations” include violating requirements to hold end user funds or not assisting the Bank of Canada in its audit of the PSP.

Changes from the draft regulations

The published Regulations, while substantially similar, diverge from earlier draft regulations subject to consultation. In comparison to earlier draft regulations, the finalized Regulations ease many requirements for PSPs, including extending timelines and removing certain reporting requirements.

A number of rigorous reporting and testing requirements in the draft regulations were also relaxed.

Next Steps

As the Bank of Canada gets ready to implement the RPAA, it will:

• Start to issue supervisory policies and guidelines on specific topics related to the RPAA and the final regulations, including with respect to:
  • Managing operational risks
  • Safeguarding end-user funds
  • Reporting on incidents
• Offer a registration pilot program. As part of this work, the Bank of Canada will ask persons that are subject to the RPAA to test the registration process. Participants will be able to provide feedback on the overall process for registering. The Bank of Canada is looking for volunteers to participate in this pilot and requests those interested to sign up using their online form until 15 December 2023.
• Impose a registration deadline of 15 November 2024.

Recommended actions

PSPs located in Canada and foreign PSPs serving Canadian users should:

• Confirm that the RPAA applies to their activities.
• Take note of the updated registration and reporting timelines under the Regulations.
• Assess and create internal risk and compliance frameworks and policies to align with the Regulations’ requirements for risk management, incident response and end user fund safeguarding frameworks.
• Form clear internal roles, responsibilities, and pathways for identifying, reporting and responding to ‘incidents’, material and significant changes as identified in the Regulations.
• Stay tuned for further guidance on the application of the RPAA and Regulations to be published by the Bank of Canada.

Baker McKenzie is ready to assist PSPs in their future compliance with the RPAA. Let’s talk about it.

---

1 Retail payment activities refer to payment functions performed in relation to an electronic funds transfer that is made in the currency of Canada or another country or using a unit that meets prescribed criteria.
2 Payments Canada owns and operates Canada’s core payment clearing and settlement system, including the Automated Clearing Settlement System, which underpin the vast majority of payments and value transfers in Canada. Newly registered PSP members will be expected to receive access to participate in these systems, as well as Real- Time Rail, a new payment system that will exchange and settle retail payments in real-time, and can be represented in the governance and decision making processes of Payments Canada.
3 ‘Incidents’ are defined in the RPAA as an unplanned event or series of related events that results in or could reasonably be expected to result in the reduction, deterioration or breakdown of any retail payment activity that is performed by the PSP.