Payment service providers: New surveillance regime for retail payments

The Retail Payments Activities Act (RPAA), enacted on June 29^th, 2021, introduces a new surveillance regime for retail payment activities by payment service providers (PSPs). 

This new framework enables the Bank of Canada, in the national interest, to supervise and regulate activities associated with retail payments in order to mitigate operational risks and protect the funds of end users, i.e. individuals or entities using a payment service in the capacity of payer or payee. 

If you are subject to this new regime, you will need to register with the Bank of Canada between November 1^st and November 15^th, 2024, and comply with a series of new obligations, such as protecting end-user funds and establishing risk management and fund protection frameworks in writing and in compliance with regulatory requirements.

Does this apply to me?

You may be required to register with the Bank of Canada if you answer affirmatively to the following four questions: 

1. Are you a PSP? A PSP is defined as any “individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity”.
2. Do you perform at least one of the following functions?
   • Provide or maintain an account on behalf of an end user (if you maintain personal or financial information of an end user for future electronic funds transfers (EFT*))
   • Hold funds for an end user (if you keep funds on hold so that they are accessible for future withdrawal by a beneficiary or transfer by a payer)
   • Initiate an EFT at the request of an end user
   • Authorize an EFT or the transmission, receipt or facilitation of an EFT instruction
   • Offer clearing or settlement services
3. Do you perform a payment function in respect of an EFT made in a legal tender currency or a unit specified by regulation?
4. Do you have an establishment in Canada or offer services to individuals or entities in Canada?

* An EFT, electronic funds transfer, is a means of transferring money between a payer and payee by any electronic means (not in cash). Common examples include debit, credit and prepaid card payments made online or at points of sale, direct deposits and electronic payments between individuals. 

What does this imply? 

The following obligations apply, among others: 

• Register with the Bank of Canada from November 1^st to November 15^th, 2024. 

• Protect and preserve funds and establish, implement and maintain a written safeguarding-of-funds framework to ensure that end users have reliable and timely access to held funds and that the funds, or the proceeds of insurance or guarantee, if applicable, are paid out in the event of insolvency. 

• Establish and maintain a risk management and incident response framework to identify and mitigate operational risks and respond to incidents in accordance with regulatory requirements. 

• Report incidents that have a significant impact on an end user, another PSP or a clearing house. You must inform this person or entity as well as the Bank of Canada. 

• Submit mandatory reports to the Bank of Canada. 

• Notify the Bank of Canada of any significant changes to the way you carry out a retail payment activity or add a new one.  

• Keep and maintain records. 

What should I do if I am subject to the RPAA? 

Delegatus recommends that affected individuals or entities begin taking the necessary steps in preparation for the registration period, which runs from November 1st to November 15^th, 2024.  

Our team has the expertise to provide you with the legal support you need to make your organization, its operations and its value chain compliant with regulatory requirements.