Case studies and registration updates

As the retail payments industry approaches the long-awaited implementation of the Retail Payment Activities Act (the "RPAA") the Bank of Canada (the “Bank”) has gradually released guidance to assist payment service providers (“PSPs”) on the registration process and related obligations under the RPAA.

This article is the first installment in our Retail Payment Activities Act implementation series, offering a concise overview of the Bank’s guidance and the registration process. Part one of the series discusses the Bank’s guidance released on August 21, 2024, which includes additional case scenarios on the RPAA's application and a new supervisory policy on acquisitions of control and associated requirements (the "Acquisitions Supervisory Policy").

For a primer on the RPAA and its associated regulations, implications and requirements, we invite you to revisit our previous articles on the topic: A new era for payment service providers in Canada: A review of the scope and requirements of the Retail ‎Payment Activities Act and Update on the implementation of the Retail Payment Activities Act.

Case scenarios about retail payments supervision

The Bank has released a number of case scenarios that are intended to supplement the criteria for registering PSPs. The intent of these case scenarios is to complement the criteria for registering PSPs and provide specific examples that entities may find useful when determining if their business is engaging in one of the five payment functions under the RPAA. Some of the case studies include:

• Financing company partnering with a merchant: Certain finance companies may decide to partner with merchants to offer loans to the merchant’s customers for certain high-cost goods (i.e. appliances). In providing these loans, the finance company is generally storing personal and financial information of these consumers and receiving electronic funds transfers (“EFTs”) to pay back the loans, meaning, the finance company is performing the payment function of providing or maintaining of an account on behalf of an end user in relation to an EFT. However, the performance of this payment function is incidental to the lending services as the finance company is not in the business of facilitating payments between merchants and their customers. As a result, a finance company in this scenario is not required to register as a PSP with the Bank.
• Payroll services: If a company performs payroll for their own employees, then they are not required to register as a PSP since their payment function is incidental to their business operations. Conversely, there are companies who provide payroll services for other Canadian businesses. Their business includes using and maintaining accounts, holding funds for an end user, initiating and authorizing an EFT, etc. In the latter case, the company’s provision of payment services is not incidental to its business. As a result, the latter company is required to register as PSP.
• Remittance services: Generally, organizations that provide remittance services will be required to register as a PSP. The Safeguarding Requirements of the RPAA only apply where funds are kept idle or can be stored by customers with the organization for future use.
• Payment gateway providers: If a company’s software captures and encrypts information about the payer and payment credential (e.g., a credit card), and transfers that payment information between a payment portal and front-end processor used by the merchant, then the company is considered to initiate an EFT. As a result, the company is required to register as a PSP with the Bank.
• Cryptocurrency exchanges: Companies that offer the exchange of cryptocurrencies but do not process, nor offer the ability for their clients to store, Canadian dollars or foreign currencies are generally not required to register as a PSP with the Bank. This is due to the fact that, while the cryptocurrency exchange may be performing payment functions, none of these would relate to an EFT in a FIAT currency.

These summaries are just some of the case scenarios provided by the Bank and do not provide the full details included in each case scenario. Businesses who may fall under one of these case scenarios can contact a member of our Financial Services or Compliance team for further advice on the applicability of the RPAA.

The supervisory policy on acquisitions of control

The Acquisitions Supervisory Policy offers guidance to registered PSPs considering a change of control, or an acquisition, by an individual or state-owned enterprise (“SOE”). Pursuant to section 24 of the RPAA, prior to such an acquisition, the PSP must submit a new registration application that reflects the planned transaction, also known as “re-registration.” The PSP must be re-registered before the acquisition is finalized. The provisions in the RPAA and the Policy will take effect on September 8, 2025.

An “acquisition of control” under the RPAA requires a PSP to re-register with the Bank before closing if an individual or entity, directly or indirectly, acquires one third or more of the voting securities of the PSP. This includes the conversion of non-voting securities into voting shares that meet this threshold, which necessitates re-registration before conversion occurs. Additionally, if a new general partner is added to a limited partnership PSP, re-registration is required prior to that appointment. For other PSP entities, acquiring an interest that entitles an individual or entity to one third or more of profits or assets also constitutes an acquisition of control.

Meanwhile, a SOE is defined as any entity owned, controlled, or influenced, directly or indirectly, by a foreign government. There are several scenarios which constitute an acquisition of interest in a PSP by an SOE, which necessitate re-registration before the transaction can proceed:

• Power to appoint: If the SOE gains the authority to appoint key executives—such as the CEO, CFO, or the board of directors—this qualifies as an acquisition of interest.
• Voting rights: For corporations, if the SOE acquires any voting rights that enable it to elect one or more the board of directors, then it triggers the requirement for re-registration.
• Ownership interests: In the case of non-corporate entities, any acquisition of ownership interest by an SOE—even the smallest unit—requires the PSP to re-register before the transaction can be finalized.

The requirement for PSPs to submit a new registration application before a change of control or acquisition by an SOE could lead to significant delays in transactions. Since re-registration must be completed before closing, this process introduces uncertainty. While the timelines are unknown in practice, it is estimated this entire process may take three months or more, particularly if additional scrutiny is involved.

Conclusion

PSPs may begin registering with the Bank as soon as November 1, 2024. If you feel your business may be impacted, please contact a member of our Financial Services or Compliance teams for assistance in preparing your business for registration under, and compliance with, the RPAA.