Bank of Canada to publish Retail Payment Activities Act enforcement decisions

The Bank of Canada will publish NOVs in the Enforcement Decisions section of its website after a PSP has received a NOV and the period for making representations has expired. Each publication will include details regarding the nature of the violation and the amount of any administrative monetary penalty imposed. Enforcement decisions will remain publicly accessible for five years and will also be noted on the PSP’s entry in the Bank of Canada’s public Registry of PSPs.

Implications for payment service providers

This development marks a shift toward a more active and comprehensive exercise of the Bank of Canada’s enforcement powers under the RPAA. With NOVs now publicly accessible, PSPs face potential damage to their reputation. Non-compliant PSPs face not only financial penalties but also the risk of depreciating their credibility and trust among clients, competitors, investors, and business partners.

Key points

In light of these enhanced enforcement measures, PSPs should exercise diligence in ensuring compliance with the RPAA and its associated regulations. Key compliance areas include the following:

• Registration requirements: PSPs performing retail payment activities must register with the Bank of Canada before commencing such activities.
• Operational risk management: PSPs must establish, implement, and maintain a written risk management and incident response framework. This framework must be reviewed annually, as well as before making any material changes to the PSP’s operations, systems, policies, procedures, processes, controls, or other means of managing operational risk.
• Safeguarding of end-user funds: PSPs must hold end-user funds in a single-purpose trust account, or a segregated account combined with insurance or a guarantee in an amount equal to or greater than the funds held.
• Reporting requirements: PSPs must submit annual reports to the Bank of Canada confirming their compliance with the RPAA. PSPs must also notify the Bank of Canada of any significant changes or incidents that may be expected to impact the retail payment activities that the PSP performs.
• Record keeping: PSPs must retain records regarding their risk management and incident response framework, safeguarding of funds, incident notification, and reporting obligations for at least five years. Records must be protected to ensure their integrity and availability, and must be produced to the Bank of Canada upon request.

As noted above, the Bank of Canada will publish NOVs only after the period for making representations has expired. PSPs should be aware of applicable deadlines and exercise their rights promptly if they wish to contest a violation. Once a NOV has been served, a PSP has 30 days to make representations to the Governor of the Bank of Canada. The Governor will then determine whether the PSP has committed a violation. If a PSP fails to make representations within the specified time period, it is deemed to have committed the violation and is liable to pay the full penalty set out in the NOV.