FinTech Companies be warned… regulation is on the way

Recently, a senior official from the Bank of Canada (the “Bank”), announced in an interview that regulation of payment service providers (“PSPs”) under The Retail Payment Activities Act (“RPAA”) would soon come into effect and would drastically transform the retail payment services landscape in Canada. Since the announcement, the Department of Finance and the Treasury Board have been working together to ensure that industry stakeholders are consulted prior to the Act coming into force.

This article discusses why PSPs should be concerned and how the Act will apply to their daily operations. The Bank, the central regulator under the Act, expects 2,000 entities will fall under the new regime. The majority of the entities expected to be affected are FinTech companies, of which roughly one-fifth offer payment services. The Bank official was quoted as stating that the Bank’s task as supervisors of retail PSPs “is to make sure that the trust Canadians are placing in payment service providers on a daily basis is warranted.” Before we address the registration requirements, let’s delve deeper into the RPAA’s objectives.

The Act’s background

What retail payment activities are regulated under the Act?

Although not yet in force, the RPAA is a recent piece of legislation and will govern the supervision of retail PSPs. Under the RPAA, the following retail payment activities are regulated if they are either:

• performed by a PSP that has a place of business in Canada, or
• performed by an end user in Canada by a PSP that does not have a place of business in Canada, but directs retail payment activities or entities that are in Canada.

Payment service providers - Who is regulated under the Act?

The Bank considers a PSP to be a company that offers any of the following services:

• providing or maintaining a payment account
  • individuals or entities satisfy this definition if they store personal or financial information about end users to make it easier to carry out future transactions.
• holding funds:
  • the Bank has yet to interpret the definition of “holding funds” but is scheduled to soon release a definition.
• initiating an electronic funds transfer.
  • when a payer or payee sends the first instruction to start a transaction, either as a push or pull payment. Both forms of payments require the payer’s consent.
    • push payment: instruction sent by the payer to move funds to the payee’s account.
    • pull payment: instruction sent by the payee to move funds from the payer’s account.
• authorizing, transmitting, receiving or facilitating instructions about an electronic funds transfer
  • transmits, receives or facilitates an instruction about an electronic funds transfer if it:
    • sends payment instructions
    • receives payment instructions
    • provides the infrastructure that enables payment instructions to be sent or received
• clearing or settling
  • clearing: involves transmitting, reconciling and, in some cases, confirming transactions before they are settled
  • settlement: releases the payment obligations between two or more PSPs according to the terms of the transaction.

Similar to the Act’s structure with respect to retail payment activities, the RPAA provides exclusion for the following types of entities (presumably because they are already subject to regulatory oversight):

• banks and authorized foreign banks
• credit unions, insurance companies, and trust and loan companies
• provinces or their agents and mandataires
• The Canadian Payments Association
• a company to which the Insurance Companies Act or Trust Loan Companies Act applies

Lastly, the Act also exempts the following:

• designated systems: The Act does not apply in respect of a payment function that is performed in relation to an electronic funds transfer if the payment function is performed using a system designed under the Payment Clearing and Settlement Act (Canada).
• agents and mandataries: The Act does not apply if the agent or mandatary is performing retail payment activities in the scope of their activity as agent or mandatary, subject to certain conditions.

Updated registration requirements

Who must register under the Act?

In addition, a PSP must satisfy at least one of the three criterion in order to be required to register under the Act:

• must be a payment service provider
  • perform one or more payment functions as a service or business activity that is not incidental to another service or business activity. Incidental retail payment activities was clarified by the Retail Payments Advisory Committee as performed “incidental to another service or business activity.” Incidental activities are often conducted but not limited to, the following entities: telecommunications companies or internet service providers, online casinos, or law or accounting firms.
• must perform a retail payment activity
  • perform payment functions related to an electronic funds transfer made in Canadian or foreign currencies (excluding cryptocurrencies).
• must meet certain geographic scope
  • have a place of business in Canada
  • have a place of business outside of Canada but perform retail payment activities for an end user in Canada and direct retail payment activities to individuals or entities in Canada

It is to be noted that the geographic scope criteria is comparable to what exists for money service businesses under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act.

The above activities are broadly worded and the RPAA provides clarification as to which retail payment activities are excluded from the Act’s application. The excluded activities can be summarized as:

• transactions using automated banking machines
• internal transactions among affiliated entities
• prepaid Payment Products: Exclusion for electronic funds transfers made with an instrument that is issued by a merchant - or by an issuer that is not a payment service provider and has an agreement with a group of merchants - and that allows the holder of the instrument to purchase goods or services only from the issuing merchant in the group. The most common example of which is a gift card from a specific merchant.
• eligible financial contracts/securities transactions: Electronic funds transfers that are made for the purpose of giving effect to an eligible financial contracts - essentially derivatives - or for the purpose of giving effect to a prescribed transaction in relation to securities.

The legislative pipeline: When can entities expect regulatory changes?

The implementation process

The Bank announced a four stage implementation period prior to the Act taking effect. The first stage occurred on June 29, 2021 when the legislation was passed into law by Parliament. As of October 19^th, 2022, the Bank is currently at the second phase of its legislation rollout, which is the publication of regulations. The Department of Finance is responsible for drafting the regulations, while engaging stakeholders to ensure the Act’s provisions and purpose are met with widespread public approval. In the second phase, the Department of Finance is required to submit the regulations to the Treasury Board, at which point they will be published for public comment in Part I of the Canada Gazette. By posting in the Canada Gazette, the Treasury Board hopes to reach a broad national audience and receive public feedback, after which amendments will be made if necessary. Thereafter, the final draft of the regulations will be published in part 2 of the Canada Gazette. To date, there is no indication that any regulations have been drafted or submitted to the Treasury Board.

The third and final stage of the implementation process includes the following:

• 3) the Bank issuing guidance on specific topics related to the RPAA to further clarify its supervisory expectations.
• 4) the Act coming into force, where PSPs will be required to register with the Bank

How can stakeholders become involved?

There are two ways PSPs and other affected parties can become further involved in RPAA consultations with the Bank. There is a subscription service via email where stakeholders can register. In addition to a subscription service, the Bank has established a Retail Payment Advisory Committee. The Committee is comprised of industry leaders who provide industry expertise to the Bank. RPAC members meet as required to discuss issues related to retail payments.

Enforcement

In addition to a company registering under the RPAA, they are required to comply with the Act’s enforcement mechanisms. Notably, the Bank states that every payment service provider will be required to:

• submit an annual report
• notify the Bank before making a significant change in the way it performs a retail payment activity.
• provide other regulatory information.

In addition to requiring compliance with the RPAA’s enforcement mechanisms, PSPs are also required to mitigate operational risk and safeguard end-user funds. For example, a payment service provider will need to show that it has a framework in place to manage risk and respond to incidents. Further, to protect the end-user funds, a payment service provider will be expected to keep end-user funds separate from other money used in its business operations.         

Conclusion

Despite the RPAA not having yet passed the second implementation stage, the Bank’s advice to FinTechs and other PSPs is clear: regulation is on its way. It is predicted that the RPAA will be finalized in coordination with a new payment system, Real-Time Rail (“RTR”). The work on RTR is expected to be complete in 2023. RTR is a new payment system established by Payments Canada allowing financial institutions and PSPs to develop enhanced ways for Canadians to pay for goods and services, and transfer money. For further updates on the RPAA and future updates on RTR developments, please subscribe to our Banking and Financial Services distribution list.

This article provides only general information about legal issues and developments, and is not intended to provide specific legal advice. Please see our disclaimer for more details.