Retail payments supervision
In 2024, the Bank of Canada’s mandate to supervise retail payment service providers (PSPs) came into effect. These new responsibilities are outlined in the Retail Payment Activities Act (RPAA), which received royal assent in 2021.
On November 1, the Bank reached an important milestone when it started registering PSPs that are subject to the RPAA.
In the lead-up to this milestone, the Bank:
- readied its operations for the registration launch
- raised industry awareness of its supervision mandate
- continued to build its supervisory program
Launching the Bank’s new supervision mandate
The opening of the registration period for PSPs marked the official start of a new mandate for the Bank. It was also a significant date for the payments industry, which came under regulation for the first time in Canada.
Companies that are subject to the RPAA were required to apply for registration through the Bank’s portal between November 1 and 15, 2024. The Bank saw a strong registration response from companies based in Canada and around the world, which shows that members of the payments community are taking their obligations under the law seriously. The Bank is following up with companies it believes are covered by the RPAA but have not yet applied to register.
Raising awareness within the payments industry
The Bank’s new mandate to supervise PSPs has important implications for participants in the payments industry. Therefore, it was critical that the Bank reach as many companies as possible before the registration period began. The Bank also used this time to build relationships with key stakeholders in the industry.
Staff raise awareness about the Bank’s new retail payments supervision mandate at September’s Canada Fintech Forum in Montreal.
Reaching out to payment service providers around the world
Throughout 2024, the Bank used a variety of communications channels to promote registration, including:
- a special section of the Bank’s website
- trade shows and industry events
- public speaking engagements
- a regular newsletter that reached more than 1,500 subscribers
- YouTube videos
- webinars in English and French
Consulting industry stakeholders
The Bank sought feedback from industry stakeholders on draft versions of its risk management guidelines. The purpose of these consultations was to identify where additional clarity was needed, especially around requirements that may be challenging for PSPs to meet.
The guidelines outline the standards and practices PSPs must implement to comply with the RPAA and its associated regulations. They include requirements on:
- operational risk and incident response
- safeguarding end-user funds
- incident notification
- reporting on significant change
Final versions of the guidelines were published in late 2024.
Collaborating with domestic and international regulators
Before the registration period, the Bank worked closely with domestic and international regulators operating in the financial and payments sectors. This enabled the Bank to build and strengthen relationships with key counterparts and to develop information-sharing agreements that will be essential to fulfilling its supervision mandate.
Building the Bank’s supervisory program
The Bank took important steps to develop the various aspects of its supervisory program. This included developing policies that clarify how the Bank will carry out its responsibilities under the new mandate. The Bank published supervisory policies on its website, providing PSPs with quick access to relevant information. Industry participants visited the site to learn more about:
- the RPAA and its scope
- PSP obligations for registration, compliance, reporting and record-keeping
- the Bank’s enforcement approach, including tools and processes
In addition, the Bank conducted a pilot project with PSPs to ensure it would be ready to begin processing applications. The pilot also served as a trial run of the Bank’s ability to collaborate seamlessly with external partners, such as the Financial Transactions and Reports Analysis Centre of Canada and the Department of Finance Canada.
https://www.instagram.com/reel/C7mOi8nqAy2/?utm_source=ig_web_copy_link
Looking forward
In 2025, the Bank will:
- continue following up with companies it believes are covered by the RPAA but have not yet applied to register, and take enforcement action as required
- publish the list of registered PSPs and, as of September 8, 2025, begin actively supervising their risk management practices
- continue to raise awareness and understanding of risk management and reporting requirements under the RPAA, and what it means to be a supervised PSP
- continue developing its supervisory practices and policies
More information
Retail payments supervision: Key milestones
Future-proofing our payments systems (remarks by Ron Morrow, Executive Director of Payments, Supervision and Oversight)