Bank of Canada to launch oversight of retail payment providers

Article content

The Bank of Canada is launching a new supervision program for payment service providers on Friday under its new mandate set by Parliament.

The Retail Payment Activities Act legislation was passed by the federal government in 2021 and gives the central bank the authority to oversee an estimated 3,000 payment service providers (PSPs) that operate in Canada, including payment apps and point-of-sale software companies.

Article content

“Every time you tap your card on a payment terminal or make a purchase online, there are at least two, maybe three or four payment service providers involved in getting the money out of your account and into a merchant’s account,” Ron Morrow, executive director of payments, supervision and oversight at the Bank of Canada, said.

“Every day, Canadians place their trust in these PSPs. The purpose behind the act is to ensure that trust is well founded, that the PSP is holding your money, that those funds are adequately protected.”

The Bank of Canada’s oversight will help ensure these companies are managing operational risk, which includes contingency plans against cybersecurity incidents, safeguarding end-user funds and submitting mandatory annual reports to the central bank.

Morrow said being registered with the central bank also allows these companies to be directly part of the country’s payment infrastructure, under the Bank of Canada’s umbrella, without having to seek a partner bank.

He said he doesn’t get the sense the retail payment sphere is a “Wild West” environment, but there have been cases in other jurisdictions where PSPs have gone out of business and lost users’ money.

Article content

Article content

“I’m not aware of any specific cases of that happening in Canada,” he said. “So, it’s to provide a framework that prevents those types of outcomes.”

PSPs that operate in Canada, including companies such as Moneris Solutions Corp. and Stripe Inc., will have from Nov. 1 to Nov. 15, to register with the central bank.

Parna Sabet-Stephenson, partner and leader of financial services and technology at Gowling WLG, said the pool of companies the Bank of Canada is seeking to regulate is large and her law firm has been busy assisting clients with their application processes.

“I have to say 3,000 is clearly massive,” she said. “There will be some very small companies, like startups, or just simply a small number of employees.”

Sabet-Stephenson said the differences between smaller tech companies and larger, more established companies such as PayPal Holdings Inc. are significant. She added that some companies in the fintech space may be subject to multiple regulatory regimes, including regulations that already exist under the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and the Office of the Superintendent of Financial Institutions.

Article content

“Let’s say you have a reporting requirement under one, which may be the same as under the second one and the third one,” she said. “Potentially, you may end up filing it three times. It will be interesting to see how things evolve.”

Morrow, who leads a team of 150 people, said registration is mandatory and failure to comply will lead to public notices that the company is not in compliance. If the company still fails to register following these notices, it could be subject to enforcement action.

“What that will look like is a public notice on our website that PSP XYZ has failed to register with us, has been found not in compliance with the Retail Payments Activities Act and that notice of violation could be accompanied by a monetary penalty for very serious violations,” he said. “The maximum monetary monetary penalty is $10 million.”

The regulatory regime will come into force starting in September of next year.

• Email: jgowling@postmedia.com

Bookmark our website and support our journalism: Don’t miss the business news you need to know — add financialpost.com to your bookmarks and sign up for our newsletters here.

Article content