Introduction
Good afternoon. And thank you for inviting me to join you today.
I’m curious. With a show of hands, tell me, how many of you have already made at least one payment today? Maybe you stopped for a coffee? Paid a bill online?
We know that moving money is integral to our daily lives as consumers. We know that these transactions are crucial for entrepreneurs as well, not to mention the economy as a whole.
Central banks have long been focused on ensuring that the risks around payment activities are well managed. The failure of the Herstatt Bank in 1974 was a watershed moment that led to the creation of the Basel Committee on Banking Supervision. After the 2008–09 financial crisis, central banks put other measures in place as well. As a result, national payment systems have become more robust, and central banks are more rigorous in applying their supervisory roles.
The Bank of Canada takes very seriously its role in overseeing financial market infrastructures and prominent payment systems. If something were to go wrong with these essential infrastructures and systems, there could be significant damage to the functioning of our financial system. Moreover, their outage could pose a risk to the overall economy.
Given these high stakes, it should come as no surprise that we keep a close eye on the systems Canadians use to move and hold money. Recent years have seen big changes to these systems, including rapid growth in the number of products and services offered.
Beyond the important payment systems that are already regulated, thousands of other companies are now offering payment services. Some of these payment service providers (PSPs) are large and familiar, but some are much smaller and less well known. Until now, many of these PSPs have not been subject to supervision beyond being required to comply with anti-money laundering regulations. That is about to change.
The Bank’s traditional oversight role is expanding to meet today’s new reality. This afternoon I’ll talk about these changes. More specifically, I’ll look at some of the details of the new retail payments regime that will soon be coming into force.
With great power comes great responsibility
There is no denying that PSPs play a crucial role in our society. Facilitating payments is a powerful economic responsibility.
The great 20th-century philosopher Stan Lee once wrote that “with great power comes great responsibility.” The nerds among us will remember that these wise words belonged to Uncle Ben, and they helped his nephew Peter Parker come to terms with his newfound abilities as Spider-man.
Of course, we know that Uncle Ben wasn’t talking about the importance of safely and efficiently executing retail payments. He had a different type of power in mind. Still, I think the analogy is apt.
It’s worth pointing out that our retail payments ecosystem is currently working well. Maybe the greatest testament to the confidence Canadians have in PSPs is that they mostly take PSPs for granted when making a purchase or transferring funds.
The job of the new regime I’m discussing today is to make sure this trust is well founded, to reassure people that operational risks are being well managed and that their funds are being protected.
The Government of Canada got the ball rolling on this new regime in the summer of 2021 with the passage of the Retail Payment Activities Act. Under the Act, the Bank must ensure that PSPs meet certain standards for risk management and that they effectively safeguard any funds they hold for end users.
As I mentioned, we’ve seen many changes in the payments sector over the past few years. New players have emerged, and new technology has been introduced. These changes led to a concern over whether new providers were subject to formal supervision within Canada. Indeed, part of the motivation behind the Retail Payment Activities Act was to ensure all PSPs are supervised.
But the Act also has other benefits. Once it’s fully operational, the new regime will not only reduce risk but also foster innovation and competition.
For example, one of the stated policy objectives is to allow PSPs that will come under the Bank’s supervision to apply to become direct participants in national payments infrastructure, such as the forthcoming Real-Time Rail (RTR). The Government of Canada recently announced changes to the Canadian Payments Act to facilitate this. Of course, PSPs will need to meet other requirements before they can join. But for those that qualify, participating in RTR should bring many benefits, both for PSPs and for Canadians more broadly.
What did we learn from others?
Over the past couple of years, we’ve worked closely with the Department of Finance Canada as it developed this new regime. Specifically, we provided advice on how to build the legislative and regulatory framework. To do so, we benefited from looking at similar regimes in other jurisdictions to see how they were set up.
Wherever possible, we wanted to align ourselves with international standards.
So, we reached out to regulators directly to learn from their experiences. We looked at jurisdictions that had well-developed forms of regulation for payments, in particular places like the United Kingdom, the European Union and Singapore. We took a close look at how their regimes are set up, why regulators made the decisions they made and what standards they set. We found several elements in common, and, wherever possible, we adopted those approaches.
Generally, we found no need to create a unique, made-in-Canada approach. Since many PSPs operate in several jurisdictions globally, we saw the benefit of aligning with other supervisory regimes wherever possible. Like others, we wanted to strike the right balance between protecting the interests of end users and being as efficient and as frictionless as possible when it comes to the burden placed on PSPs.
What will be expected?
So, what exactly are we going to require of PSPs under this new regime? At a high level, it’s really three key things.
The first is that, in just under a year, the legislation will come into force, and entities that are considered PSPs will have to apply to register with the Bank of Canada.
At the outset, we’ll be asking for some basic questions:
- who they are
- the nature of their business
- the volumes and values of the payments they process
But registration is just the starting point. In 2025, the other requirements kick in. We will begin to hold PSPs to minimum standards for managing operational risk. PSPs will also need to demonstrate what they are doing to safeguard end-user funds.
To meet these requirements, PSPs will need to take a number of actions. I won’t go into all those details right now, but, basically, PSPs will have to:
- identify and manage risks
- respond to incidents
- periodically review their plans
And PSPs that hold end-user funds will be required under the new regime to show that they have measures in place to safeguard these funds until the funds are withdrawn or transferred. This means that PSPs must keep end-user funds separate from their operating funds and either hold them in trust or have insurance or a guarantee that covers end-user funds.
The goal here is twofold: to ensure that end users have reliable and timely access to their funds and to protect end users should a PSP go bankrupt.
For now, we know that compliance will involve some regular reporting from PSPs, including submitting information on an annual basis or when significant changes or incidents occur.
In addition, the Bank will also reach out to a proportion of PSPs every year to ask for more detailed information. We will use the responses to these information requests to gauge how well PSPs are meeting our supervisory expectations. When it comes to managing operational risk, for instance, we might ask about the framework a PSP has put in place. For example, was it approved by senior management? Or has it been tested?
From time to time, Bank staff or a third party may also need to visit PSPs in person. I expect this to be the exception rather than the rule.
For enforcement, we will have a range of tools at our disposal to promote compliance, everything from warning letters to public notices of violation to monetary penalties.
We will take a graduated approach when it comes to enforcement. This will allow us to use the tool that is appropriate for the circumstances. For example, if our initial enforcement action does not result in a timely correction, we would likely choose another enforcement tool to achieve the desired outcome.
All that to say, oversight is all about managing risk. Our goal is always to explain our expectations thoroughly at the outset in order to lessen the need for compliance action later. But if an enforcement decision does become necessary, we recognize that the process must be fair. For example, we will always provide notice that an enforcement action is pending to allow the PSP an opportunity to respond. In other words, the overall goal of this new regime is to proactively incentivize good behaviour and act as a general deterrent.
I should note here that the Bank will not take a one-size-fits-all approach to its supervision. We recognize that a wide variety of business models exist. Different providers will comply in their own way. That’s fine. But we will have a common standard, with enough flexibility to apply across all types of providers.
Who is a PSP?
This begs the question: who exactly are the PSPs that the Bank will oversee?
Currently, we estimate that around 2,500 providers will be subject to our supervision under the new Retail Payment Activities Act. They are a wide array of entities, both here in Canada and abroad. They include payment processors, digital wallets, currency transfer services and other payment technology companies that provide payment functions.
It's important to note that these entities don’t need to have a place of business in Canada to be subject to the Bank’s supervision. If they offer payment services to end users in Canada—for example, let’s say they have a Canadian website or directly market their services to Canadians—then they likely qualify as a PSP, and they will be subject to the new Act.
The simplest way to explain the scope of the new legislation is this: the new regime cares more about what entities do rather than who they are.
What does this mean? Well, as is laid out in the legislation, a PSP may fall under the regime if it performs any one of the following five payment functions:
- maintaining an account for the purposes of making payments
- holding consumers’ funds for the purposes of making payments
- initiating payment messages
- transmitting payment messages
- clearing and settling payments more broadly
Of course, there will be exceptions. For example, let’s take a merchant that sells vintage sneakers online. The merchant might allow customers to set up accounts, and it might collect personal and financial information from those customers so that they can buy shoes. But does this make the merchant a PSP? No, it doesn’t, because the payment functions the merchant is performing are incidental to its main business.
In addition, entities that are already prudentially regulated by Canada’s Office of the Superintendent of Financial Institutions will not be subject to the new regime. The same is true of credit unions that are overseen by a provincial regulator—although some of the partners they do business with might be considered PSPs.
The Bank’s own guidance materials, which I’ll talk more about in a minute, will help to clarify further who will fall under the new regime and who won’t.
What are the next steps?
So, what happens next?
First—and most important—any entity that is considered a PSP will need to register.
Registration for the regime will take place from November 1st to the 15th, 2024. But before that happens, the Bank will help entities determine whether they fall within the scope of this new legislation. To that end, later this year we will publish our registration criteria along with a questionnaire to help entities figure out whether they need to apply to register.
For entities that do need to register, early next year we will publish a step-by-step guide to help them complete their application through the online registration portal that will be created.
While we consider applications, we will be in an official period of transition. The government has indicated that this will last about 10 months. During this period, those that have applied for registration will be listed on our website. It is important to note that PSPs that continue to perform payment activities during this transition period without having submitted their application to register may face enforcement actions.
We will share the applications of PSPs that meet the criteria for registration with the federal Department of Finance. The minister may then initiate a national security review and, at the end of the review, issue a directive to the Bank to approve or refuse to register an applicant, or even revoke the registration of a PSP for national security reasons. We will then publish registration decisions on our website. These decisions will list PSPs that have been registered and those whose application to register was refused and the reasons why.
In the meantime, the Bank will begin providing its supervisory guidance. Starting next month, we will periodically publish updates on how the Bank will interpret the legislation and accompanying regulations. Our guidance will spell out what we expect PSPs to do to manage risks and safeguard funds. It will also outline what PSPs can expect from the Bank in terms of enforcement actions.
As we develop our guidance, some will be open for comment, such as the sections related to mitigating operational risks, safeguarding end-user funds, and reporting incidents and significant changes. We’re not experts in everything, so we’re trying to be humble as we set up this regime. Probably some things could be adjusted or done better. This is why we have sought input directly from the industry throughout this process, and it’s why our outreach will continue.
To put this new regime in place, we’ve been working closely with other domestic regulators, including the Financial Transactions and Reports Analysis Centre of Canada. Even though we’re each focused on different areas of the PSP business, the lines of communication between us and other relevant regulators have been, and will continue to be, open.
As PSPs begin planning for these changes to take effect, they can access a wealth of information on our website. At bankofcanada.ca/rps (that stands for retail payments supervision), you can find links to the legislation and regulations and information about the supervisory framework. It’s also where links to our more detailed guidance will soon be available.
If you want to receive up-to-date information about the new regime, you can also sign up on our website for a newsletter.
Conclusion
In the time that remains before the Act comes into force, we are doing everything we can to make our expectations known. By sharing information early and often, and by continuing to engage with the industry, we hope we are preventing the need for enforcement actions later.
If you retain one thing from this speech, it should be this: change is coming. Without question, now is the time for PSPs that do business in Canada to start preparing.
Remember, with great power comes great responsibility. Let’s not disappoint Uncle Ben.
Thank you.