.svg)
In June 2021, the Retail Payment Activities Act (RPAA) was enacted, granting the Bank of Canada supervisory authority over payment service providers. According to the Bank of Canada, the aim of the RPAA is to build confidence in the safety and reliability of payment service providers’ (PSP) services while protecting end users from specific risks.
The RPAA set forth a series of requirements for PSPs, including registering with the Bank of Canada, establishing and maintaining an operational risk and incident response framework, safeguarding end-user funds, and submitting mandatory reports.
This report is part of a four-part series analyzing the RPAA and identifying key components of the law that PSPs should consider when doing business in Canada. This report focuses on the requirement to register with the Bank of Canada, and the subsequent reports will focus on the remaining key requirements: operational risk management and incident response; end-user funds safeguarding; and mandatory reporting and recordkeeping.
Who does the RPAA apply to?
Pursuant to Sections 4 and 5 of the RPAA, the act applies to any retail payment activity that is performed by a PSP that has a place of business in Canada or any retail payment activity that is performed for an end-user in Canada by a payment service provider that does not have a place of business in Canada but directs retail payment activities at individuals or entities that are in Canada.
Section 2 of the RPAA defines a payment service provider as an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity. Section 2 of the RPAA also defines a retail payment activity as a payment function that is performed in relation to an electronic funds transfer that is made in Canadian currency or that of another country, or using a unit that meets prescribed criteria.
Key considerations
Pursuant to Section 23 of the RPAA, a PSP must register with the Bank of Canada before performing any retail payment activities.
The registration requirements of the RPAA are scheduled to take effect on November 1, 2024. The registration period is open from November 1 to November 15, 2024. During this time payment service providers must apply for registration with the Bank of Canada.
The RPAA also provides for a transition period between November 1, 2024 and September 7, 2025, during which the Bank of Canada will assess registration applications. PSPs that have submitted an application for registration may continue to offer retail payment services during the transition period.
According to the Bank of Canada, to register, payment service providers must:
- Create an account in PSP Connect.
- Access to PSP Connect will be available once registration opens.
- Prepare the information required for the registration application form. According to Section 29 of the RPAA, an application for registration must include the following:
- Applicant’s name and any name under which the applicant performs or plans to perform payment functions as a service or business activity.
- Applicant’s address and any prescribed contact information.
- A declaration that states whether the applicant operates or plans to operate out of a dwelling-house.
- A description of how the applicant is organized or structured, and as applicable, any prescribed information in relation to the applicant’s incorporation, affiliated entities, directors and managers or owners.
- List of the applicant’s agents and mandataries that perform retail payment activities in the scope of their authority as an agent or mandatary and any prescribed information in relation to those agents and mandataries.
- A description of the retail payment activities the applicant performs or plans to perform, including any prescribed information in relation to the volume and value of those retail payment activities.
- The number of end users or estimated number of end users for whom the applicant performs or plans to perform retail payment activities.
- Any prescribed information in relation to end-user funds that the applicant holds or plans to hold.
- A description of the applicant’s risk management and incident response framework or the framework that the applicant intends to establish and implement.
- Any prescribed information in relation to the manner in which the applicant safeguards or plans to safeguard end-user funds.
- Any prescribed information in relation to any of the applicant’s third-party service providers that have or will have a material impact on the applicant’s operational risks, or the manner in which the applicant safeguards or plans to safeguard end-user funds.
- A declaration that states whether the applicant is registered with FINTRAC.
- A declaration that states whether the applicant has a place of business in Canada.
- A declaration that states whether the applicant has applied for registration or is registered under a provincial act respecting retail payment activities.
- For any applicant that does not have a place of business in Canada, the name and address of an agent or mandatary in Canada that is authorized, on behalf of the applicant, to accept notices given or served under this act as well as orders made under this act.
- Any information in relation to the applicant or the retail payment activities the applicant performs or plans to perform that is prescribed for the purposes of Sections 34 to 45 of the RPAA.
- Complete the application form.
- Pay the registration application fee.
- The fee for 2024 is $2,500, and the fee must be paid in full using a credit card or an electronic funds transfer. The Bank of Canada will start assessing an application only once the application fee has been paid.
Once an application has been submitted, applicants will receive a notice through PSP Connect confirming the receipt of the application and fee.
The Bank of Canada will begin reviewing applications, and applicants may need to respond to requests for additional information. The Bank of Canada will also share the applications of individuals and entities that meet the registration criteria of the RPAA with the Department of Finance Canada to conduct a national security review and the Financial Transactions and Reports Analysis Centre of Canada, also known as FINTRAC.
Under the RPAA, the Bank of Canada cannot inform an applicant about the outcome of their application during the transition period unless the minister of finance issues a directive to the bank to refuse to register an applicant. However, the bank will publish and maintain a list of all applicants on its website during the transition period.
Why should you care?
PSPs subject to the RPAA should consider preparing for the registration period that is rapidly approaching. A PSP is only allowed to continue to offer retail payment services during the transition period if it has applied for registration. According to the Bank of Canada, if a PSP operates during the transition period without having submitted an application, it may be in violation of Section 104 of the RPAA. This violation could result in the issuance of a notice of violation that may be accompanied by a substantial administrative monetary penalty.
It is important to note that the Bank of Canada may refuse or revoke a PSP’s registration for various reasons, including:
- Failing to meet the criteria for registration.
- Failing to provide additional information that was requested.
- Providing false or misleading information.
- Committing a violation under the RPAA.
- Failing to pay the annual assessment fee.
The Bank of Canada may also refuse or revoke a registration based on information it received from FINTRAC. If a registration has been refused or revoked, the PSP can request a review within 30 days after the date on which it receives the decision. The bank will continue to monitor unregistered, refused or revoked applicants that perform retail payment services to ensure that those that are subject to the RPAA register with the bank.
