Fintech companies be warned … regulation is on the way – Regulatory Update on the Canada Retail Payment Activities Act

Recently, a senior official from the Bank of Canada (the “Bank”) announced in an interview that regulation of payment service providers (“PSP”) pursuant to Act on retail payment activities (“RPAA”) will soon come into effect and will drastically transform the retail payment services landscape in Canada. Since the announcement, the Ministry of Finance and the Treasury Board have worked together to ensure that industry stakeholders are consulted before the Act comes into force.

This article discusses why PSPs should be concerned and how the law will apply to their day-to-day operations. The bank, the central regulator under the law, expects 2,000 units to fall under the new regime. The majority of entities expected to be affected are FinTech companies, approximately one-fifth of which offer payment services. The bank official was quoted as saying that the bank’s role as supervisor of retail PSPs “is to ensure that the trust Canadians have in payment service providers on a day-to-day basis is justified.” Before we address the registration requirements, let’s delve deeper into the RPAA’s goals.

Background of the law

Which retail payment activities are regulated by law?

Although not yet in force, the RPAA is a recent piece of legislation and will govern the oversight of retail PSPs. Under the RPAA, the following retail payment activities are regulated if they are either:

• performed by a PSP that has a place of business in Canada, or
• performed by an end user in Canada by a PSP that does not have a place of business in Canada but manages retail payment activities or entities that are in Canada.

Providers of payment services – Who is regulated by law?

The bank considers a PSP to be a company that offers any of the following services:

• provide or maintain a payment account
  • individuals or entities meet this definition if they store personal or financial information about end users to facilitate future transactions.
• hold funds:
  • The bank has not yet interpreted the definition of “holding fund”, but is scheduled to issue a definition soon.
• initiate an electronic money transfer.
  • when a payer or payee sends the first instruction to start a transaction, either as a push or pull payment. Both forms of payment require the payer’s consent.
    • push payment: instructions sent by the payer to move funds to the payee’s account.
    • pull payment: instruction sent by the payee to move funds from the payer’s account.
• authorize, transfer, receive or facilitate instructions for an electronic money transfer
  • sends, receives or facilitates an instruction for an electronic money transfer if it:
    • sending payment instructions
    • receives payment instructions
    • provides the infrastructure that makes it possible to send or receive payment instructions
• clearing or settlement
  • clearing: involves the transmission, reconciliation and, in some cases, confirmation of transactions before they are settled
  • settlement: releases the payment obligations between two or more PSPs according to the terms of the transaction.

Similar to the structure of the Act with respect to retail payment activities, the RPAA provides an exclusion for the following types of entities (presumably because they are already subject to regulatory oversight):

• banks and authorized foreign banks
• credit unions, insurance companies and trust and loan companies
• provinces or their agents and mandates
• The Canadian Payments Association
• a company that the Insurance Companies Act or Act on trust loan companies applies

Finally, the law also exempts the following:

• designated systems: The Act does not apply to a payment function that is carried out in connection with an electronic money transfer if the payment function is carried out using a system designed in accordance with Payment Clearing and Settlement Act (Canada).
• agents and authorized persons: The Act does not apply if the agent or authorized person carries out retail payment activities within the scope of his activity as an agent or authorized person, under certain conditions.

Updated registration requirements

Who must register under the law?

In addition, a PSP must satisfy at least one of the three criteria to be required to register under the Act:

• must be a payment service provider
  • perform one or more payment functions as a service or business activity that is not subordinate to another service or business activity. Incidental retail payment activities were clarified by the Retail Payments Advisory Committee as conducted “incidentally to another service or business activity.” Random activities are often conducted by, but not limited to, the following entities: telecommunications companies or Internet providers, online casinos, or law or accounting firms.
• must perform a retail payment activity
  • perform payment functions related to an electronic funds transfer made in Canadian or foreign currency (excluding cryptocurrencies).
• must fulfill a certain geographical scope
  • has a place of business in Canada
  • has a place of business outside Canada but performs retail payment activities for an end user in Canada and direct retail payment activities to individuals or entities in Canada

It should be noted that the geographic scope criteria are comparable to those existing for money services businesses under Proceeds of Crime (Money Laundering) and Terrorism Financing Act.

The above-mentioned activities are broadly formulated and the RPAA provides clarification on which retail payment activities are exempt from the application of the Act. The excluded activities can be summarized as:

• transactions using automated teller machines
• internal transactions between affiliated entities
• prepaid payment products: Exclusion for electronic funds transfers made with an instrument issued by a merchant – or by an issuer that is not a payment service provider and has an agreement with a group of merchants – and which allows the holder of the instrument to purchase goods or services only from the issuing merchant in the group . The most common example is a gift card from a particular seller.
• qualified financial contracts/securities transactions: Electronic money transfers that are made with the purpose of giving effect to a qualified financial contract – mainly derivatives – or with the purpose of giving effect to a prescribed transaction in relation to securities.

The Legislative Pipeline: When Can Entities Expect Regulatory Changes?

The implementation process

The bank announced a four-stage implementation period before the law comes into force. The first phase occurred on 29 June 2021 when the legislation was passed by Parliament. From and including 19 October^th, 2022, the bank is currently in the second phase of rolling out the legislation, which is the publication of regulations. The Ministry of Finance is responsible for designing the regulations, while at the same time engaging stakeholders to ensure that the law’s provisions and purposes are met with broad public approval. In the second phase, the Treasury Department is required to send the regulations to the Treasury Board, at which time they will be published for public comment in Part I of the Canada Gazette. By publishing in the Canada Gazette, the Treasury Board hopes to reach a broad national audience and receive public feedback, after which changes will be made if necessary. Thereafter, the final draft of the regulations will be published in Part 2 of the Canada Gazette. There is currently no indication that regulations have been drawn up or submitted to the Board of Finance.

The third and final phase of the implementation process includes the following:

• 3) The bank provides guidance on specific topics related to RPAA to further clarify supervisory expectations.
• 4) the law coming into force, where PSPs will be required to register with the bank

How can stakeholders get involved?

There are two ways PSPs and other affected parties can be further involved in RPAA consultations with the bank. It is a subscription service via e-mail where interested parties can register. In addition to a subscription service, the bank has set up an advisory committee for Retail Payment. The committee consists of industry leaders who supply industry expertise to the bank. RPAC members meet as needed to discuss issues related to retail payments.

Enforcement

In addition to a company registering under the RPAA, they are required to comply with the law’s enforcement mechanisms. In particular, the bank states that each payment service provider will be required to:

• submit an annual report
• notify the bank before making a material change to the way it carries out a retail payment activity.
• provide other regulatory information.

In addition to requiring compliance with the RPAA’s enforcement mechanisms, PSPs are also required to reduce operational risk and secure end-user funds. For example, a payment service provider will need to demonstrate that it has a framework in place to manage risk and respond to incidents. Furthermore, to protect end user funds, a payment service provider will be expected to keep end user funds separate from other money used in its business operations.

Conclusion

Despite the fact that the RPAA has not yet passed the second implementation stage, the bank’s advice to FinTechs and other PSPs is clear: regulation is on the way. It is predicted that the RPAA will be completed in coordination with a new payment system, Real-Time Rail (“RTR”). Work on the RTR is expected to be completed in 2023. The RTR is a new payment system established by Payments Canada that allows financial institutions and PSPs to develop improved ways for Canadians to pay for goods and services, and transfer money. For further updates on the RPAA and future updates on RTR developments, please subscribe to our Banking & Financial Services mailing list.