Prepare for Regulation: Bank of Canada Introduces New Retail Payments Supervisory Framework

Prepare for Regulation: Bank of Canada Introduces New Retail Payments Supervisory Framework

Overview

The Retail Payments Activities Act (the “RPAA”) was enacted in June 2021, creating a new regulatory regime for retail payment activities under the supervision of the Bank of Canada (the “BOC”).[1] The introduction of the RPAA is a significant milestone in the Canadian retail payments sector, which had previously been largely unregulated. The RPAA’s introduction also represents unchartered territory for the BOC, which will be assuming the role of a regulator for an entire industry sector for the first time.

The BOC recently introduced a supervisory framework under the RPAA, which sets out how it will oversee payment service providers (“PSPs”), foster compliance, and monitor and assess trends and issues in the payment system.[2] For more information about who qualifies as a PSP, please read our bulletin titled Who is Caught by Canada’s New Retail Payment Systems Regulation?

In a recent speech, Ron Morrow, the BOC’s Executive Director for Retail Payments Supervision, noted that the new supervisory framework will apply to organizations “in the business of helping people and companies make day-to-day payments, or store or transfer their money through electronic means.”[3] This signals that the RPAA’s broad definition of PSP is unlikely to be significantly limited in the regulations to the RPAA, which will be published for comment in the near future.[4] The BOC estimates that over 2,500 entities, including many FinTech payment companies, will be subject to its supervision, and urges them to begin planning and preparing for the new regulatory regime.[5]

This bulletin provides an overview of the BOC’s new supervisory framework as it pertains to registration, risk monitoring and enforcement.

Registration

Both domestic PSPs and foreign PSPs that direct retail payment activities at individuals or entities in Canada will be required to register with the BOC when the provisions of the RPAA requiring registration come into force, which will likely be in 2024.[6] The RPAA provides a transition period to allow the BOC to process applications and to permit individuals or entities currently offering retail payments services to continue doing so as long as they have submitted an application.[7] The length of this transition period is unknown, but the period will commence once section 29 of the RPAA (which requires registration of PSPs) comes into force.[8] In order to facilitate the registration process, the BOC is currently developing a web portal through which applicants and registered PSPs will be required to submit their registration details, pay the registration fee, and comply with the reporting obligations under the RPAA.[9]

The BOC will share the applications of those who meet the RPAA’s registration criteria with the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”) and Department of Finance Canada to perform a national security review.[10] Money services businesses (“MSBs”) performing retail payments activities covered by the RPAA must register with the BOC as a PSP.[11] Note, however, that MSBs already registered with FINTRAC were not subject to a national security review during the MSB registration process and so must undergo a national security review before registering as a PSP. Once registered, PSPs must adhere to the RPAA’s requirements and pay an annual assessment fee.[12] The BOC may refuse or revoke registration on several grounds, including based on information provided by FINTRAC, a directive from the federal Minister of Finance citing national security concerns, or an applicant ceasing to perform retail payment activities.[13] The BOC will monitor unregistered individuals and entities performing payment services to ensure adherence to the registration requirement, and may use enforcement measures to compel compliance.[14] The BOC may also monitor individuals and entities whose registration has been refused or revoked to ensure that they are no longer performing payment services.[15]

Risk Monitoring

PSPs will be required to implement a framework for mitigating operational risk and responding to incidents. Under this framework, PSPs must report to the BOC incidents that have a material impact on end users, other PSPs or certain clearing and settlement systems. In addition, PSPs holding end-user funds must institute measures to protect those funds until they are withdrawn or transferred.[16]

PSPs will also be required to submit three types of reports to enable the BOC to assess their compliance with the supervisory framework. The first is an annual report containing details about operational risk mitigation, incident response and protective measures for end-user funds, if applicable. The second is a significant change or new activity report notifying the BOC before a PSP performs a new retail payment activity or significantly changes the way it performs an existing activity. The third is an incident report alerting the BOC of incidents that have a material impact on end users or other entities.[17]

Enforcement

In addition to risk monitoring, the BOC has developed a set of enforcement tools to address violations under the RPAA and promote compliance. For example, the BOC can enter into a formal compliance agreement with a PSP to remedy non-compliance. The BOC can also issue a notice of violation (“NOV”) for contraventions of the RPAA and publish the company’s name and the nature of its violations on the BOC website. A NOV may be accompanied by an administrative monetary penalty (“AMP”) or an offer to enter into a compliance agreement. If a PSP enters into a compliance agreement, the PSP will only be required to pay one half of the AMP. However, if the PSP breaches the compliance agreement, it will be liable to pay the remaining half of the AMP as well as an added penalty that will be specified in the regulations.[18] The AMP will be made public and could be as high as $10 million for an egregious violation.[19]

The BOC Governor may also issue a compliance order against a PSP if the Governor believes that a PSP is engaging, or is about to engage in an act that could detrimentally affect end users, other PSPs or certain clearing and settlement systems. Furthermore, the Governor may apply to a superior court for an order mandating that a PSP stop an action that contravenes the RPAA, adhere to a provision of the RPAA, or obey a compliance order.[20]

Conclusion

The BOC’s new supervisory framework is the product of consultations with multiple stakeholders, including the Retail Payments Advisory Committee (“RPAC”), which was established by the BOC to provide industry expertise on Canada’s retail payment services sector.[21] The RPAC’s mandate has recently been extended past its one-year term ending September 2022, which will allow it to offer continued support to the BOC as it begins its journey of regulating the Canadian retail payments sector.

Players in the Canadian retail payments space would be well advised to prepare for the new regulatory regime, including conducting an assessment to determine whether they will need to register as a PSP once the requirements come into force. The BOC notes that its approach to supervision may evolve and that it may update the supervisory framework, before or after the RPAA’s registration requirements come into effect, in order to respond to the pending publication of regulations by the Department of Finance Canada, which are expected to clarify the details of the RPAA, and changes in the retail payments landscape.[22] Such regulations are expected to be published for comment in 2023.[23]

[1] Retail Payment Activities Act, SC 2021, c 23, s 177.
[2] Bank of Canada, About the retail payments supervisory framework, online: Bank of Canada [Retail Payments Supervisory Framework].
[3] Ron Morrow, Preparing for Payments Supervision (November 2, 2022), online: Canadian Innovation Exchange Summit [Bank of Canada Speech].
[4] Though the BOC is not responsible for drafting the regulations to the RPAA, there has likely been significant cooperation between the Department of Finance Canada and the BOC in preparing the regulations.
[5] Bank of Canada Speech.
[6] Ibid.
[7] Retail Payments Supervisory Framework.
[8] Retail Payment Activities Act, SC 2021, c 23, s 177.
[9] Retail Payments Supervisory Framework.
[10] Ibid.
[11] Bank of Canada, Retail payments supervision, online: Bank of Canada.
[12] Retail Payments Supervisory Framework.
[13] Ibid.
[14] Ibid.
[15] Ibid.
[16] Ibid. A general description of the measures that will be required to protect end user funds will likely be published in the regulations. More specific descriptions of the measures to be taken will likely be published as guidelines by the BOC. The exact nature of the measures to protect end user funds remains the single greatest uncertainty around Canadian retail payments regulation.
[17] Ibid.
[18] Ibid.
[19] Bank of Canada Speech.
[20] Retail Payments Supervisory Framework.
[21] Bank of Canada, Retail Payments Advisory Committee, online: Bank of Canada.
[22] Retail Payments Supervisory Framework.
[23] Bank of Canada Speech.

by Shahen Mirakian, Darcy Ammerman, Pat Forgione, Robert Piasentin and Srinidhi Akkur (Articling Student)

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2022