The Retail Payment Activities Act (RPAA) represents a milestone in Canadian payments and is expected to build confidence in the retail payment sector and bring a new level of maturity to this ever-evolving industry.
However, it will require payment service providers (PSPs) to comply with a suite of new obligations, including
- registering with the Bank of Canada
- establishing and maintaining a risk management and incident response framework
- incident report notification
- safeguarding of funds
- reporting obligations
Stay up to date
To help PSPs prepare for the implementation of the RPAA and understand their obligations, Osler has assembled a team of leading experts to provide guidance on the RPAA and related regulatory developments. Our RPAA team includes partners Elizabeth Sale and Victoria Graham (payments), Michelle Lally (national security review), Adam Kardash (privacy), Simon Hodgett and Wendy Gross (contracting arrangements).
The RPAA will come into force in phases, starting on November 1, 2024, with the launch of the registration process. Subscribe to receive updates on recent developments or check back here often for additional information.
Timetable for upcoming RPAA milestones
| Date | Milestone |
|---|---|
| November 1–15, 2024 | 15-day registration application window* |
| November 16, 2024 – September 7, 2025 | Transition period |
| September 8, 2025 | Effective date for operational risk and safeguarding of funds frameworks |
* Individuals and entities who do not submit an application during this window must submit a registration application at least 60 days before they plan to start performing retail payment activities
Are you a payment service provider? You may be subject to the new Retail Payment Activities Act
Resources
Registration process:
Registration under the Retail Payment Activities Act is now open (Bank of Canada – November 1, 2024)
The Bank of Canada’s PSP Connect web portal is now live. PSPs must complete their registration application with the Bank by November 15, 2024. To apply, PSPs must:
- Create an account on PSP Connect. PSPs should read the step-by-step guide and watch a video on how to submit their application.
- Enter the required information and upload relevant documents. Progress can be saved and returned to later to complete the application.
- Submit the finalized application and pay the non-refundable application fee of $2,500 CAD. This fee must be paid in full for the application to be processed.
If assistance is needed with the registration process, PSPs should contact the Bank before the November 15 application window closes.
Reporting of retail payment activity metrics at registration (Bank of Canada – February 14, 2024; Updated October 16, 2024)
PSPs are required to report on quantitative metrics of their retail payment activities — first at registration and then as part of annual reporting. A guide is available to help applicants understand the reporting requirements of Section 9 and 10 of the registration application.
The Bank updated the policy on October 16, 2024 to add clarity to sections on Affiliates and Names of other PSPs to which services are provided.
Learn more about quantitative metrics reporting requirements
Reporting changes to registration information (Bank of Canada – October 16, 2024)
The Bank published its supervisory policy which explains how it expects PSPs to comply with updated information requirements once they become registered. PSPs are expected to provide updated registration information to the Bank when there are changes or anticipated changes to certain information provided by the PSP during registration.
Note that a separate process applies to applicants that undergo changes or learn of new information while their applications are under review. For that process see the Bank’s supervisory policy on Amendments to Registration Applications (see below).
Operational risk and incident response (Bank of Canada – Final Guideline, October 16, 2024)
The Bank published their final supervisory guideline to assist PSPs in complying with their identification and mitigation of operational risks and incident response measures obligations which includes information on how to establish, implement and maintain a risk and incident response framework.
Read the supervisory guideline [PDF]
Incident notification (Bank of Canada – Final Guideline, October 16, 2024)
The Bank published its final supervisory guideline regarding incident reporting requirements for PSPs, including further information about specific notification steps PSPs are expected to comply with to ensure operational incidents are reported in a timely manner.
Read the supervisory guideline [PDF]
Notice of significant change or new activity (Bank of Canada – Final Guideline, October 16, 2024)
The Bank published its final supervisory guideline regarding the notice requirements PSPs are expected to follow before making a significant change or performing a new retail activity. The Bank also provided further information about how PSPs are expected to comply with these reporting requirements.
Read the supervisory guideline [PDF]
Annual Reporting (Bank of Canada – October 16, 2024)
The Bank published its supervisory policy regarding annual reporting requirements which provides further information about how PSPs are expected to complete and submit their annual report to the Bank by March 31 each year in the PSP Connect portal.
Annual reporting of retail payment activity metrics (Bank of Canada – October 16, 2024)
The Bank published its supervisory policy regarding the retail payment metrics that PSPs are expected to retain to comply with record-keeping and annual reporting obligations. The policy provides guidance to PSPs on each metric that is required to be reported.
How to complete a registration application: A step-by-step guide (Bank of Canada – February 2024; Updated October 2, 2024)
PSPs must be registered with the Bank of Canada. A guide is available to help PSPs gather the documents needed to complete the application form during the initial 15-day registration phase.
The Bank updated the guide on October 2, 2024 based on feedback received during the registration pilot to ensure instructions are clearer and align with the application form applicants will need to complete in PSP Connect.
Explore the step-by-step guide [PDF]
Amendments to registration applications (Bank of Canada – Updated October 2, 2024)
During the initial 10 month coming-into-force transition period, applicants are still required to submit amendments. However, they will not know their registration status until the RPAA comes fully into force. Guidance is provided on how applicants should proceed when making changes to the information they provide as part of their application to become a registered PSP.
The Bank updated the supervisory policy on October 2, 2024 to provide clarity regarding amendments relating to the legal entity making the application during the transition period.
Criteria for registering payment service providers (Bank of Canada – Updated October 2, 2024)
Guidance is provided to help individuals and entities determine if they’re subject to the RPAA and if they should register with the Bank. The guidance breaks down each of the payment functions and sets out a series of questions PSPs should ask themselves in order to determine whether they’re performing a payment function that triggers the registration requirement. The guidance also includes information about incidental activities.
The Bank amended the supervisory policy on August 21, 2024 to clarify the sections dealing with (1) eligible financial contracts pursuant to the Canada Deposit Insurance Corporation Act and (2) securities transactions.
The Bank further amended the supervisory policy on October 2, 2024 to clarify the section dealing with holding funds.
Read the guidance to determine if you are subject to the RPAA
Case scenarios about retail payments supervision (Bank of Canada – Updated October 2, 2024)
Case scenarios are examples that reflect the Bank’s interpretation of certain requirements set out in the RPAA. They are organized by topic to help individuals and entities determine whether they are subject to the RPAA and should register with the Bank as PSPs. The Bank added the following case scenarios on October 2, 2024: acquirers, card program managers, cloud computing, holding funds, lending, marketplaces, providers of services backed by cryptocurrencies.
Acquisitions of control and prescribed changes (Bank of Canada – August 21, 2024)
This supervisory policy describes how a registered PSP should assess whether it will be the subject of a planned acquisition of control or a prescribed change. It also describes the process for re-registering when a PSP plans to undergo an acquisition of control or a prescribed change.
Administrative monetary penalties (Bank of Canada – June 17, 2024)
This supervisory policy provides an overview of the Bank of Canada’s administrative monetary penalties (AMPs) regime and how it determines AMP amounts.
Enforcement process (Bank of Canada – June 17, 2024)
This supervisory policy outlines the Bank of Canada’s enforcement process and what individuals, entities and PSPs should expect if the Bank of Canada takes enforcement action against them.
Enforcement tools (Bank of Canada – June 17, 2024)
This supervisory policy sets out the enforcement tools the Bank of Canada could use in connection with enforcement action against individuals, entities and PSPs.
Issuing public notice of decisions (Bank of Canada – June 17, 2024)
This supervisory policy describes the Bank of Canada’s issuing of public notice in connection with certain retail payments supervision and Governor’s decisions.
Governor’s review (Bank of Canada – June 17, 2024)
This supervisory policy describes the Bank of Canada’s Governor’s review process and explains what individuals, entities and PSPs should expect if they request a Governor’s review of a retail payments supervision decision.
Roles and responsibilities of the Executive Director and Managing Director (Bank of Canada – June 17, 2024)
This supervisory policy outlines the roles of the Executive Director of Payments, Supervision and Oversight and the Managing Director of Supervision and describes their responsibilities in connection with the Bank of Canada’s retail payments supervision mandate.
Significant adverse impact (Bank of Canada – June 17, 2024)
This supervisory policy outlines what the Bank of Canada will consider when evaluating whether a “significant adverse impact” is occurring or has occurred.
Prescribed supervisory information (Bank of Canada – April 17, 2024)
This supervisory policy provides an explanation of the prescribed supervisory information (PSI) provisions and sets out the Bank of Canada’s expectations for PSPs’ compliance with non-disclosure requirements related to PSI under the RPAA and its regulations. PSI must not be used as evidence in any civil proceedings, and cannot be disclosed by PSPs, in each case subject to certain exceptions. The supervisory policy provides examples of what is, and what is not, PSI, and explains the rationale for restricting the disclosure of PSI. The supervisory policy also explains the exceptions to the non-disclosure requirement and the evidentiary privilege restriction.
Final guidelines will be published during the second half of 2024.
Record keeping (Bank of Canada – April 17, 2024)
This supervisory policy outlines what records PSPs should keep and retain to comply with their record-keeping obligations under the RPAA and its regulations. The supervisory policy provides illustrative examples of some of the materials that PSPs should keep and retain as records in connection with their risk management and incident response framework, safeguarding of funds, incident notification, and reporting obligations. Typically, a record must be retained for at least five years after the day on which the record no longer demonstrates the PSP’s current compliance with the RPAA. The supervisory policy also outlines the Bank of Canada’s expectations on how records must be kept.
Bank of Canada opens consultation on draft supervisory guidelines — public consultation ends May 21, 2024
The Bank of Canada recently opened its public consultation on the draft supervisory guidelines covering the following topics: operational risk and incident response; incident notification; safeguarding end-user funds; and notice of significant change or new activity. In their current form, these guidelines are very detailed, building out the compliance obligations set out in the RPAA and its regulations in a manner that is likely to increase the compliance burden on PSPs. The Bank of Canada has specifically requested that respondents indicate whether any aspect of the draft guidelines could be clarified or challenging to implement. PSPs are strongly encouraged to review the draft guidelines and provide feedback by May 21, 2024.
Final guidelines will be published during the second half of 2024.
Provide feedback on the consultation
Registration application fee (Bank of Canada – December 12, 2023)
Details are provided about the one-time fee applicants must pay when submitting an application to register as a PSP with the Bank. As of November 1, 2024, the registration application fee is $2,500; in subsequent years, the fee will be determined in accordance with a formula as described in the guidance.
Key Contacts
Partner, Corporate, Toronto
Partner, Financial Services, Toronto
Latest Insights
-
Webinar Sep 24, 2024
Navigating the future of payments
This seminar features Victoria Graham and Elizabeth Sale discussing, among other topics, various aspects of RPAA, including the registration process,...
Read more
-
Video Apr 16, 2024
Are you a payment service provider? You may be subject to the new Retail Payment Activities Act
The Retail Payment Activities Act (RPAA) establishes a general supervisory framework for the regulation of payment service providers (PSPs). Under...
Read more -
Osler Update Dec 11, 2023
The future of payments regulation has arrived: final regulations to the Retail Payment Activities Act released
We look at the key changes between the draft and the final regulations, next steps and what payment service providers can do to prepare for...
Read more -
Osler Update Mar 2, 2023
Retail Payment Activities Act: Draft regulations published for comment
On February 11, 2023, the Department of Finance published draft regulations (the draft Regulations) under the Retail Payment Activities Act (the...
Read more
