The Retail Payment Activities Act (RPAA) is a significant step towards ensuring the safety and soundness of the Canadian financial system, protecting end users, and fostering innovation in the payments ecosystem. The RPAA was enacted in June 2021, and has been set in motion with the recent publication of final regulations on November 22. At this stage, it is important to promote global awareness and understanding of implementation of the RPAA and how it will impact you as a payment service provider (PSP), end user (payor or payee), or other stakeholder.

Global reach

The RPAA applies to retail payment activities performed by a PSP with a place of business in Canada or by a PSP located abroad if the PSP directs retail payment activities to individuals or entities in Canada. The scope is extremely broad and, with a few exceptions, applies generally to any payment function performed in relation to an electronic funds transfer involving the placement, transfer, or withdrawal of funds by electronic means initiated by or on behalf of an individual or entity.

Next steps

The Bank of Canada is expected to issue its Scope Guidance and Scope Self-assessment Tool by the end of this year, to help PSPs determine if they are in scope of the RPAA. For PSPs in scope of the RPAA, the 15-day registration window will open on November 1, 2024, and PSPs must meet risk management requirements by the time registration decisions are published by the Bank of Canada on September 8, 2025.

With this in mind, PSPs should start preparing now for RPAA registration and compliance. These efforts include taking measures to satisfy RPAA requirements for purposes of risk management and incident response, end-user funds safeguarding, accountability from a governance perspective, and new approval, review, reporting, and record-keeping obligations.

Compliance with the RPAA is mandatory for all PSPs globally, and the Bank of Canada has broad enforcement powers to ensure PSP compliance, including the possibility of issuing notices of violation and administrative monetary penalties. The Minister of Finance also has authority over PSPs for reasons of national security.

Industry engagement

There will be several opportunities for industry engagement in preparation for RPAA implementation. The Bank of Canada is inviting PSPs to register by December 15, 2023, to participate in a registration pilot, and in early 2024 the Bank plans to launch a consultation on its Guidance on requirements for Operational Risk, End-user Funds Safeguarding, Significant Change Reporting, and Incident Reporting.

All stakeholders should be considering how they are impacted by the RPAA, and exploring opportunities to support implementation of the new regime by helping PSPs with RPAA registration and compliance and otherwise. Prudentially regulated financial institutions should be considering their ability to provide the trust accounts and other solutions required by PSPs under the RPAA to safeguard end-user funds. Agents and third-party service providers to PSPs should be preparing to satisfy requirements applicable to them under the RPAA. Ultimately, broad industry collaboration is needed to ensure RPAA implementation occurs as seamlessly as possible.

To find out more about the RPAA and how you are impacted, please contact Lisa Ford, Partner, Banking & Payments.