Order Fixing the Days on Which Certain Provisions of the Retail Payment Activities Act and the Budget Implementation Act, 2021, No. 1 Come into Force: SI/2023-70

Canada Gazette, Part II, Volume 157, Number 24

Registration
SI/2023-70 November 22, 2023

BUDGET IMPLEMENTATION ACT, 2021, NO. 1

Order Fixing the Days on Which Certain Provisions of the Retail Payment Activities Act and the Budget Implementation Act, 2021, No. 1 Come into Force

P.C. 2023-1105 November 3, 2023

Her Excellency the Governor General in Council, on the recommendation of the Minister of Finance, under section 187 of the Budget Implementation Act, 2021, No. 1 (“the Act”), chapter 23 of the Statutes of Canada, 2021, fixes

EXPLANATORY NOTE

(This note is not part of the Order.)

Proposal

The Order Fixing the Days on Which Certain Provisions of the Retail Payment Activities Act and the Budget Implementation Act, 2021, No. 1 Come into Force (the Order in Council), pursuant to section 187 of the Budget Implementation Act 2021, No. 1, Chapter 23 of the Statutes of Canada, 2021 (BIA 2021, No. 1), fixes three days on which certain provisions of the Retail Payment Activities Act (the Act) and the BIA 2021, No. 1 come into force. The Order fixes

Objective

The objective of the Order in Council is to bring into force provisions of the Act, which promotes the safety and integrity of the financial system while ensuring responsible innovation for the benefit of Canadians.

Beginning on November 1, 2024, individuals and entities that perform retail payment activities are required to apply to the Bank of Canada for registration as a PSP. Also on this date, the legislative provisions necessary for enforcement actions, and authorities for the Minister of Finance to commence national security reviews of individuals and entities, as part of their registration as PSPs, will be in force.

PSPs that perform or plan to perform retail payment activities will have up to — but not including — November 16, 2024, to submit their application for registration to the Bank of Canada to immediately commence or continue their retail payment activities. Beginning on November 16, 2024, PSPs that have not applied for registration will continue to be able to apply to the regime but may be subject to delays in commencing their retail payment activities and could also be offside the requirement to be registered before performing retail payment activities (section 23 of the Act). If a PSP refuses or fails to submit an application to register, the Bank of Canada has various tools to encourage compliance including the ability to impose administrative monetary penalties.

On September 8, 2025, the requirement for the Bank of Canada to register PSPs and publish a registry of PSPs will be in force, as well as the remaining substantive provisions of the Act, including the requirements for PSPs to safeguard end-user funds against losses and mitigate operational risks that could cause a reduction, deterioration or breakdown of its payment activities.

Background

The Act, which received royal assent in June 2021, introduced a new retail payment supervisory regime for PSPs, such as card networks, payment processors and digital wallets. The Bank of Canada is responsible for supervising PSPs’ compliance with the Act and maintaining a registry of registered PSPs, as well as a list of refused individuals or entities and revoked PSPs.

The safe and efficient movement of funds is essential to the health and strength of the national economy. The digitalization of money, assets and financial services is transforming financial systems around the world. These innovations carry many benefits; however, the lack of requirements and supervision increases risks to Canadians, such as the risk of financial loss in instances of business insolvency, insufficient risk-management practices that impact Canadians’ ability to reliably use payment services provided, and threats to the security of sensitive personal and financial information of Canadians and Canadian businesses.

The core elements of Canada’s retail payments supervisory regime are set out in the Act, which establishes obligations falling broadly into the following categories: operational risk management, end-user (payor or payee) funds safeguarding, registration requirements, reporting requirements, administration and enforcement.

The Act also provides the Minister of Finance with the authority to address risks related to national security that could be posed by PSPs. National security provisions in the Act allow the Minister to initiate a national security review and, at the end of the review, to issue a directive to the Bank to approve or refuse to register an applicant or revoke the registration of a PSP for reasons related to national security. The Minister may also, by order, require any individual or entity to provide an undertaking, or impose conditions, in relation to an application for registration or any registered PSP if the Minister is of the opinion that it is necessary for reasons related to national security.

The Act applies to payment functions that are related to an electronic transfer of funds from one end user to another end user using a PSP.

PSPs are defined under the Act as any individual or entity that performs one or more of the payment functions as a service or business activity that is not incidental to another service or business activity. For PSPs with a place of business in Canada, the Act applies to all of their payment activities, and for foreign PSPs, the Act applies to payment activities that the PSP directs to and performs for end users in Canada.

The Act excludes certain entities from the regime for all its activities, such as financial institutions that are prudentially regulated under other federal statutes, including banks and credit unions. In addition, the Act excludes certain activities, such as internal transactions among affiliated entities.

Implications

The Order is required to bring into force the Act and supporting Regulations, which introduce a new retail payment supervisory regime for PSPs’ retail payment activities.

Bringing into force the Act and Regulations by order will address an important gap in financial sector supervision benefiting consumers and the Canadian economy. As noted in Payments Canada’s Canadian Payment Methods and Trends Report 2022, Canadians are using less cash, writing fewer cheques, and are relying on electronic payment methods more than ever. Canadians’ increasing reliance on digital payment solutions provided by PSPs make them vulnerable to financial losses in the event of failures or mismanagement of these unregulated entities.

The Act and Regulations provide minimum standards to reduce the risk of disruptions in payment services that result in end users being temporarily unable to access their funds or make payments. The Act and Regulations are also intended to provide safeguards to reduce the risk of financial losses to end users due to business insolvency or insufficient risk-management practices and enhance end users’ ability to reliably use payment services provided by PSPs where PSPs do not currently have sound operational and funds safeguarding practices in place.

The Canadian Security Intelligence Service recently noted in its annual public report that state-sponsored threat actors seek to acquire access or control over sensitive technologies, data, and critical infrastructure to advance their own military and intelligence capabilities, deprive Canada of access to economic gains, employ economic coercion against Canada, and support other intelligence operations against Canadians and Canadian interests. Consistent with the Minister of Finance’s national security authorities under the Bank Act, the Act and Regulations related to the Minister’s national security authorities are intended to obtain the information needed by the Government to assess and respond to national security-related risks posed by presently unregulated PSPs.

There will be direct and indirect costs to applicants and future registered PSP from the Order bringing into force the Act and associated Regulations. Based on early estimates, it is expected there could be approximately 2 500 PSPs in scope, with 96.4% being small businesses. This is based on an analysis of payment values expected to generate less than $5 million in revenue, which is similar to Statistics Canada’s estimate that 98.1% of businesses are small businesses. However, it will be difficult to know the true number of in scope PSPs, or their characteristics, until after November 1, 2024, when entities begin to submit an application to register with the Bank of Canada.

For applicants, the Regulations set the registration fee at $2,500. Further, for registered PSPs, there are various requirements to report to the Bank of Canada to demonstrate their compliance, which will impose indirect costs. The costs for PSPs to comply with the Act and Regulations are expected to be small relative to the $1.19 trillion in total transaction value for debit, credit and online transfer transactions for 2021 (Payments Canada’s Canadian Payment Methods and Trends Report 2022). All Canadians benefit from the stable, efficient, and safe movement of their funds, while ensuring responsible competition to keep transaction costs low. However, the monetary benefits to Canadians from the improvements to stability, efficiency and safety, as a result of the Act and Regulations, cannot be estimated.

The Act and the Regulations account for the impacts on small businesses through the principle of proportionality — the level of supervision should be commensurate with the level of risk posed by the individual or entity’s payments activities. For example, the provisions of the Regulations for operational risk provide that a PSP must ensure that all aspects of its Risk Management Framework are proportional to the impact that a reduction, deterioration, or breakdown of its retail payment activities could have on end users and other PSPs. Therefore, a smaller PSP, as measured by the value and volume of its payment activity, would see a lower regulatory burden to fulfill the proposed Regulations’ operational risk requirements than a larger PSP.

Once the Regulations are published in the Canada Gazette, Part II, the Bank of Canada will issue guidance on specific topics related to the Act to further clarify its supervisory expectations. These documents will explain how the Bank of Canada interprets the Act and provide transparency around the Bank of Canada’s supervisory role.

The Bank of Canada has discussed its scope and registration guidance with industry and incorporated feedback from them into this guidance which will be available within a month of publication of the Regulations. The Bank of Canada will begin broad consultations on its guidance concerning operational risk, end-user fund safeguarding, significant change notification and incident notification approximately three months following publication of the Regulations and will provide final guidance on these topics to industry approximately one year prior to the relevant provisions coming into force. The overall approach the Bank of Canada is taking in releasing its supervisory guidance ensures PSPs will have sufficient time to prepare for compliance and the timing aligns with other Canadian financial sector supervisors that have registration and reporting requirements, such as the Financial Transactions and Reports Analysis Centre of Canada.

The remaining provisions of the Act, which are not being brought into force by this Order, require the Bank of Canada’s supervisory costs to be recovered from registered PSPs through annual assessment fees, net of registration application fees. The annual assessment fee provisions of the Act require regulations to specify the assessment fee formula. This formula was prepublished in the Canada Gazette, Part I, and will be finalized after PSPs register with the Bank of Canada. Registration information is needed to better understand the number of PSPs and their characteristics before distributing the Bank of Canada’s costs among them to achieve the intended policy intent and ensure fees are fairly distributed. Until the assessment fee regulations are finalized and brought into force by order, the Bank of Canada is covering its supervisory costs estimated at up to $44 million annually, through its revenue and registration application fees, reducing its contribution to the government’s consolidated revenue fund.

A number of jurisdictions have already established supervisory regimes to regulate retail PSPs, including the European Union, and the United Kingdom. The Act and Regulations are consistent with the approach taken in these jurisdictions.

Consultation

The Act and Regulations were developed through extensive consultation with payment industry stakeholders, such as PSPs, industry associations, academics and industry experts. The Department of Finance conducted two separate public consultations on retail payments oversight in 2015 and 2017. The Department of Finance also sought views from stakeholders through the Department of Finance’s Payments Consultative Committee (FinPay). In designing the national security provisions of the Act and Regulations, the Department of Finance consulted with the Canadian Security Intelligence Service, the Communications Security Establishment and the Royal Canadian Mounted Police, government organizations with mandates and expertise in national security.

Throughout 2020 and 2021, to support the Department of Finance in its development of the Regulations, the Bank of Canada published various discussion papers on industry practices and policy issues relevant to the Regulations and implementation of the Act through its Retail Payments Advisory Committee (RPAC). The RPAC comprises a group of regionally diverse PSPs that may be subject to the Act, ranging in business model, size, maturity, and geographic location. The RPAC met nine times between February 2020 and November 2021 to discuss policy topics, including best practices for funds safeguarding, operational risk management practices that PSPs currently adhere to, as well as registration procedures and information that would help the Bank of Canada fulfil its supervision responsibilities.

The Regulations were published in the Canada Gazette, Part I, for a 45-day consultation period in early 2023. The Department of Finance received comments through the Online Regulatory Consultative System, and directly from certain entities. The Department of Finance received 44 submissions on the proposed Regulations from various stakeholders, such as industry associations, individual PSPs and other interested parties.

During and following the consultation period, at RPAC meetings and through industry events and meetings with industry associations, the Bank of Canada and Department of Finance outlined proposed timing, consistent with the Order, to bring the Act into force. Industry is generally supportive, provided that sufficient guidance is published by the Bank of Canada to aid them in applying for registration and complying with the fund safeguarding and operational risk management requirements.

Contact

Nicolas Marion
Senior Director
Payments Policy
Financial Services Division
Financial Sector Policy Branch
Department of Finance Canada
90 Elgin Street
Ottawa, Ontario
K1A 0G5
Email: fin.payments-paiements.fin@canada.ca