The Retail Payment Activity Act and its impact on Payment Service Providers in Canada
The Bank of Canada is Canada's central bank and is responsible for promoting the country's economic and financial well-being. In November 2023, the Bank of Canada published updated regulations for the registration of payment service providers (PSPs) under the Retail Payment Activities Act (RPAA).
PSPs located in Canada and those outside of Canada that are providing services to Canadian merchants are affected. Impacted PSPs are required to register with the Bank of Canada between November 1 and November 15, 2024. A fundamental aspect of the Act is that once it is in full effect, in September 2025, registration will need to be completed before the PSP performs any payment activities. Current providers who do not meet this year’s registration timeframe may be subject to a delay in approval.
Why is the RPAA important? Since banks are already regulated, they want every leg of the transaction to have oversight and assurance that requirements for risk management, incident response, and end-user fund safeguarding are in place.
The RPAA does not define nor distinguish between provider types such as ISV, ISO, Payment Facilitator, or extended terms like PayFac Lite or Hybrid PayFac. Fortunately, the Bank of Canada has established detailed criteria for PSP registration. Published in December 2023, this guidance helps PSPs determine if they must register with the Bank and what criteria must be considered.
The Bank is strongly encouraging PSPs to do a gap analysis based on the requirements. Supervisors will review the registration and documentation and, if needed, give time to correct gaps. There are enforcement tools if the PSP is not working toward compliance. On November 15th a list of the PSPs who have applied for registration will be published.
The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) is Canada's financial intelligence unit and anti-money laundering supervisor. Its mandate is to facilitate the detection and deterrence of money laundering and the financing of terrorist activities while ensuring the protection of personal information. FINTRAC has a role to play inside the RPAA, which is to inform whether the PSP is a Money Service Business, which may impact the registration criteria.
Additionally, the Bank of Canada works closely with Finance Canada (Canada’s governmental agency) to ensure the RPAA registration criteria and records support the department’s policies and frameworks for the country’s financial stability and security.
Finance Canada believes that only the strong will survive the RPAA. We agree. Now is the time to establish whether you are responsible for registration, and to get your company ready for the new obligations. RPY is prepared and ready to assist. Contact RPY at hello@rpyin.com.
