Search

Find answers to common questions about retail payments supervision.

This letter is in reference to the letter published by the Bank of Canada on September 8, 2025, indicating that there may be unintended consequences under the Income Tax Act for Payment Service Providers (PSPs) seeking to comply with the Retail Payment Activities Act (RPAA). Specifically, the September letter noted that there could be tax consequences or administrative burden under the Income Tax Act for PSPs seeking to safeguard end-user funds using the “in trust in a trust account” method while retaining interest income on the end-user funds they hold.

As of September 8, 2025, the Bank of Canada’s mandate to supervise Payment Service Providers (PSPs) under the Retail Payments Activities Act (RPAA) is in effect, including regulatory obligations related to operational risk and end-user funds safeguarding. The Bank and the Department of Finance have been made aware of possible unintended tax consequences for PSPs seeking to comply with the safeguarding requirements of the RPAA using the “in trust in a trust account” method.

This supplementary material is intended to provide an overview of the Operational risk and incident response guideline and summarizes a payment service provider’s (PSP) requirements for operational risk and incident response. It also includes scope considerations and a list of questions to help PSPs assess and achieve these requirements.

This supervisory guideline is intended to help payment service providers subject to the Retail Payment Activities Act comply with their obligations related to the identification and mitigation of their operational risks as well as their response to incidents.