In 2021, the Government of Canada passed the Retail Payments Activities Act, which required the Bank of Canada, the nation’s central bank, to begin overseeing payment service providers (PSPs). Under the legislation, Canadian PSPs—along with any entities involved in the electronic transfer or storage of funds—must register between November 1 and 15.

In preparation of these new regulations, Ron Morrow, Executive Director of Payments, Supervision and Oversight at the Bank of Canada, spoke with Brian Riley, Co-Head of Payments at Javelin Strategy & Research in a recent PaymentsJournal podcast. They discussed how and why PSPs should ensure they are ready to comply with the upcoming requirements.

After the legislation was passed, the Bank of Canada worked with the Department of Finance to develop regulations for supervising PSPs. The focus is primarily on two key requirements for PSPs. First, they need to establish an operational risk framework to effectively manage business continuity, cyber threats, and other related operational risks. Second, if they hold funds on behalf of end users, they must ensure those funds are adequately safeguarded. In the event that a PSP holding client funds goes out of business, those funds would be considered bankruptcy-remote and could be returned to the end users.

“Many of the PSPs we’ve talked to actually embraced the regime,” Morrow said. “PSPs are largely unregulated in Canada, but coming into the regulatory fold will help their interactions with other regulated financial sector entities like banks and credit unions.”

Once payment service providers come under the supervision of the Bank of Canada, they will be eligible to become members of Payments Canada. This, in turn, will enable them to directly connect to Canada’s national payments infrastructure. As a result, they will be able to participate directly in Canada’s real-time payment system, which is currently being developed by Payments Canada and other payments infrastructure providers.

“The PSP, one way or another, is going to be dealing with regulated entities,” said Riley. “If they are not compliant with this, they’re going to have some downstream issues. If they are compliant, it sets the stage for being able to move into other markets and going deeper within Canada.”

When it was building out the regime, the Bank of Canada examined the approaches taken by other jurisdictions regarding payment regulation.

“Wherever possible, we align our standards with what is already out there in the world,” said Morrow. “If there was a standard that was becoming common practice or best practice, and it made sense for Canada, we incorporated it into our own rules.”

This should help PSPs in two key ways. First, domestic PSPs will be well positioned to conduct business in other jurisdictions due to the consistency of the rules with those implemented elsewhere. Second, it will alleviate the burden on PSPs that already operate in multiple jurisdictions, as the requirements from the Bank of Canada will align broadly with regulations in other parts of the world.

Every year, PSPs will be required to submit a standardized template of information to the Bank of Canada, including details about the volume and value of payments. They will also need to report any significant risk events that occurred throughout the year. Additionally, each year, the Bank of Canada will select a group of PSPs for a deep dive into their operational risk frameworks.  

“We’ll be digging into the details about how they’re complying with the act, with a view toward whether or not there any gaps with the approach the PSPs are taking,” Morrow said. “If there are no gaps, great. If there are gaps, then we’ll have a conversation with the PSP around whether or not they agree. If there’s disagreement on the gaps or the PSP doesn’t feel they need to take action, we might move the issue to our enforcement division, but our enforcement is really based around ensuring compliance. We want people to comply with the act. We don’t want to be punitive or punish people.”

The Bank of Canada has identified over 3,000 entities that are expected to fall under the scope of the Act. Once the registration window closes, they will follow up with those they believe are PSPs but did not register, informing them that failure to register will result in enforcement actions. 

The Bank of Canda’s website outlines the scope of the regime and the organizations to which it applies. If a PSP is performing one of five payment functions outlined on the site, they are potentially subject to being overseen by the regime.

The website offers guidance on both the safeguarding of end user funds and what PSPs need to take into account as they’re developing their operational risk framework.

“We have a number of scenarios on our website that highlight particular use cases or business models to help them help people get their heads around whether or not the regime applies to them,’” Morrow said. “If you’re in the business of moving people’s money electronically or holding their money electronically, and you’re not already prudentially regulated like a bank, it’s very likely that you’re subject to this regime.”