Retail Payment Activities Regulations

Summary#

These are proposed Retail Payment Activities Regulations to put the new Retail Payment Activities Act into operation. They set rules for companies that run payment services (registration with the Bank of Canada, safety of user funds, risk-management and reporting) and would create penalties and a national-security review process. The government estimates total costs of $151.9 million (present value over 10 years) or about $21.6 million annually, and is asking for public comments over 45 days.

What it does#

• Requires non‑bank payment service providers (PSPs) to register with the Bank of Canada and appear on a public registry.
• Sets standards for how PSPs must manage operational risk and respond to incidents (cyberattacks, outages).
  • PSPs must have a written Risk Management and Incident Response framework, test it, review it regularly, and in some cases have independent audits.
• Requires PSPs that hold customer money to safeguard those funds. Options include holding funds in specific accounts at regulated institutions or holding insurance/guarantees that are payable to end users.
  • Insurance/guarantee providers must be prudentially regulated and not affiliated with the PSP. The Bank must be notified 30 days before cancellation.
• Creates reporting duties: annual reports (due by March 31 after the reporting year), incident reports, and notices before major changes (at least 5 business days’ notice).
• Gives the Minister of Finance a national‑security review power over registration applications, with an initial review window of 60 days and a formal review period of 180 days (extendable).
• Sets fees and cost recovery: a one‑time registration fee (starting at $2,500) and annual assessment fees based on a formula using PSPs’ transaction volume, value and funds held.
• Establishes enforcement tools and penalties: "serious" violations can carry penalties up to $1,000,000 and "very serious" violations up to $10,000,000. Some information failures carry daily penalties.
• Requires PSPs to keep records and retain them for 5 years and to protect supervisory information from public disclosure in many civil cases.

Who's affected#

• Mainly companies that run payment services outside traditional banks, such as card networks, payment processors, digital wallets and similar providers. The government estimates about 2,500 PSPs could be in scope.
• Small businesses among those PSPs — the analysis estimates 96.4% would be small businesses, with an average present‑value cost per small PSP of $1,931 over 10 years.
• End users (consumers and merchants) who use those payment services could notice improved protections and incident communication.
• The Bank of Canada and the Department of Finance will take on supervisory and review roles under the rules.

Why it matters#

• Puts basic protections in place for people’s money when they use non‑bank payment services. If a PSP becomes insolvent or has a data breach, the rules aim to make user funds easier to recover and reduce service disruption.
• Aims to raise operational resilience against outages and cyber risks by making providers plan, test and report incidents.
• Introduces government oversight and a national‑security check for certain PSPs — potentially affecting ownership, data storage and who can run payment services tied to Canada.
• Adds compliance costs for PSPs (and some ongoing fees). The government estimates the annualized cost is small relative to total payments — about $21.6 million versus $1.19 trillion in retail payments (roughly 0.0018%) — but these costs will be concentrated on PSPs, especially those handling funds.
• This is a proposal (not yet law). The public consultation runs for 45 days from the notice; details and timelines in the proposal could change after feedback.