Retail Payment Activities Act
In June 2021, the Retail Payment Activities Act (RPAA) received royal assent and set the wheels in motion for a new era in payments regulation in Canada. The new legislation, the first specifically geared toward retail payment activities in Canada, is designed to protect Canadian consumers, businesses and the financial system from certain risks. The Bank of Canada is the regulator of this new regulatory regime set out in the RPAA.
Following a nine-month consultation period, the Final Regulations under the RPAA were released in November 2023. The RPAA includes a requirement for payment service providers (PSPs) to register with the Bank of Canada, and the regulations set out detailed requirements for PSPs to manage operational risks, safeguard end-user funds, report to the Bank of Canada, and other administrative aspects of the RPAA regime.
Who does the RPAA apply to?
The legislation applies to the majority of PSPs, including payment networks, payment processors and digital wallets. It also applies to PSPs that do not have a place of business in Canada, but both direct services at, and perform services for, individuals or entities in Canada. There are several notable exclusions, however. Certain entities that are already closely regulated – like banks, authorized foreign banks and provincially regulated trust companies – are excluded from the PSP regulatory regime. Certain kinds of transactions like foreign PSP activities directed at end-users outside of Canada also fall beyond the scope of the legislation.
What's next?
PSP registration requirements came into force on November 1, 2024, together with the Bank of Canada's administration and enforcement powers under the RPAA. Eligible PSPs must register with the Bank of Canada no later than November 15, 2024.
Additional requirements with respect to risk management, incident response and funds safeguarding frameworks are scheduled to take effect on September 8, 2025.
Get ready
In light of the recent implementation of the RPAA and related regulations, businesses operating in the payment space in Canada should consider whether they will be considered a PSP under this new regulatory regime.
The RPAA introduces significant changes to the regulatory landscape, adding another layer of regulation to Canada's payments ecosystem. Accordingly, it is crucial for all PSPs to carefully review – and ensure they understand fully – their new compliance obligations. It is also a good time to reconsider your business' compliance with existing legal and regulatory obligations.
To ensure full compliance with the RPAA, we strongly advise that all PSPs conduct a thorough audit of their existing policies and protocols. Identifying registration requirements and any gaps in your current practices will allow you to be proactive and align with the new requirements.
If you have any questions or require guidance during this process, we encourage you to connect with a member of Gowling WLG's FSxT team. Our experienced financial services regulatory lawyers are well-versed in the intricacies of the RPAA and can provide tailored advice to ensure your compliance efforts are comprehensive and effective.