Payment Service Provider | Outlier Solutions

Are You BOC Registration Ready?

By now, you have likely heard of the Retail Payment Activities Act (RPAA) and associated incoming requirements, which includes the requirement to register with the Bank of Canada (BOC). To help make this a bit easier, Outlier has put together a spreadsheet that will help if you are an organization that needs to register. The RPAA (including registration) generally applies to PSPs that perform any of the following five payment functions:

the provision or maintenance of a payment account;
the holding of end-user funds until withdrawn by the end user or transferred to another individual or entity;
the initiation of a payment at the request of an end user;
the authorization of an electronic funds transfer, transmission, reception, or facilitation of a payment message; or
clearing or settlement.

The requirements apply to businesses with payment activities with a place of business in Canada, or those that provide services to end users in Canada. This includes activities that many Money Services Businesses (MSBs) provide. The BOC has provided a tool to determine if an organization must register with the BOC. For organizations that do register, the registration provisions of the RPAA will take place between November 1, 2024 to November 15, 2024. It should be noted that this is different from your MSB registration under AML requirements.

The registration application itself consists of 18 sections and comprises over 200 questions. While a substantial amount of information and data is needed, the majority of information relates to business and corporate information. This includes:

Ownership structure and financial information;
Information related to your product services and flow of funds;
Information related users;
Value/volumes related to transactions;
Geographic perimeter; and
Information related to 3rd party vendors.

It is not a requirement to provide your operational risk management and incident response framework (policy and procedures) as part of the application process.

To help aid in the registration process, we have put together a spreadsheet that will allow you to keep needed data and information organized. It will also allow you to determine if you need assistance with sections of the registration, or understanding what these changes mean to your business. The spreadsheet is a tool to assist with registration and not meant to replace the registration guidance the BOC has published.

Note: requirements that introduce prescribed operational risk management standards under this new regime come into force at a later date on September 8, 2025.

Outlier is here to help, so please get in touch.

The Proposed Retail Payment Activities Regulations

Background

On February 11, 2023, the proposed Retail Payment Activities Regulations were published in the Canada Gazette. This is to support the Retail Payment Activities Act (RPAA) which was released under Bill C-30 and received royal assent in June 2021. The Retail Payment Activities Regulations are required to bring the RPAA into force.

A Payment Service Provider (PSP) is defined as an individual or entity who performs payment functions as a service or business activity that is not incidental to another service or business activity. Certain entities, such as financial institutions, are exempt as they are regulated under other federal obligations (i.e., Office of the Superintendent of Financial Institutions’ Operational Risk and Enterprise Risk management guidelines.)

The current lack of requirements and supervision increases risks, such as the risk of financial loss in instances of business insolvency, and threats to the security of sensitive personal information. The Regulations aim to address gaps in the supervision of unregulated PSPs and are meant to align with other jurisdictions which already have regimes for PSPs.

The principles that guide the Regulations are:

Necessity — supervision should address risks that lead to significant harm to end users and avoid duplication of existing rules;
Proportionality — level of supervision should be commensurate with the level of risk posed by the payment activity;
Consistency — similar risks should be subject to a similar level of supervision; and
Effectiveness — requirements should be clear, accessible and easy to integrate within different payment services.

PSPs will be required to apply and register with The Bank of Canada (no date for this yet). There is a proposed registration fee of CAD 2500. Additionally, an annual assessment fee will be required.

In the following sections, we have summarized what we feel are the most important requirements to note.

Operational Risk Management

PSPs will have to implement and maintain an Operational Risk Framework consisting of the following:

Identify its operational risks (i.e., business continuity, cybersecurity, fraud, data management, information technology, human resources, process and product design and implementation, change management, physical security and third parties);
Protect its retail payment activities from those risks;
Detect incidents and control breakdowns;
Respond to and recover from incidents;
Review, test and audit its Risk Management Framework;
Establish roles and responsibilities for the management of operational risk;
Have access to sufficient human and financial resources; and
Manage risks from third-party service providers, agents and mandataries.

PSP must ensure that the above are proportional to the impact that a reduction, deterioration, or breakdown of its payment activities could have on end users.

Incident Response

Under the proposed Regulations, PSPs must develop a comprehensive plan for investigating, responding to and recovering from incidents that have a material impact on an end user. An incident is defined as an event or series of related events that is unplanned and that results in or could reasonably be expected to result in the reduction, deterioration or breakdown of any payment activity performed by a PSP.

The incident would be reported to the Bank of Canada and would include the following at a minimum:

A description of the incident;
The impact on individuals or entities listed in the Act; and
Actions taken by the PSP to respond to the incident.

There would also need to be a notice to impacted end users and other impacted parties.

PSPs can only resume operations after an incident once they have verified the integrity and confidentiality of all systems, data and information have been restored, and that it is able to perform retail payment activities without reduction, deterioration or breakdown.

Audit, Testing and Training

Under the proposed Regulations, PSP’s will have to complete various types of testing related to the Framework and have training in place.

All staff who have a role in establishing, implementing or maintaining the PSP’s Risk Management Framework must be provided with the information and training that are necessary to carry out that role.

Framework Review

On at least an annual basis, PSP’s must evaluate its compliance with regulatory requirements. Such a review is also required before any significant changes are made to the PSP’s operations or controls after an incident (defined in the section above). The findings of the review must be reported to a senior officer.

Testing

PSPs must also establish and implement a testing methodology to determine the effectiveness of its Risk Management Framework. This must be tested at least once every three years and findings must also be provided to a senior officer.

Independent Review

In addition to the above, a PSP must have their Framework independently reviewed at least every three years. The review must be documented and describe the scope, methodology use and findings. Findings of the review must be reported to a senior officer.

Biennial Independent Review

PSPs must have requirements related to safeguarding of funds tested at least once every two years by a sufficiently skilled individual who has had no role in the establishment, implementation, or maintenance of the safeguarding requirements under a PSPs Framework. We discuss what safeguards requirements are below.

Safeguards

PSPs will be required to hold customer funds in a trust account or a segregated account, with insurance or a guarantee to safeguard end-user funds against financial losses due to insolvency.

For consumer protection, the Regulations contain requirements to protect the end user from loss. These requirements include:

End-user funds must be held at prudentially regulated financial institutions;
Insurance or guarantee cannot be from an affiliate of the PSP;
The proceeds from the insurance or guarantee cannot form part of the PSP’s estate;
The Bank of Canada must be notified at least 30 days in advance of the cancellation of the insurance or guarantee;
PSPs must implement and maintain a written fund safeguarding framework to ensure that end-users have reliable access to their funds without delay; and
PSPs must keep a ledger with the names of their end-users and the amount of funds held.

This will require detailed flow of funds documentation.

Reporting

Under the proposed Regulations , PSPs will have to complete various types of reports.

Annual Report

PSPs will need to provide an annual report to the Bank of Canada, no later than March 31 of each year. Some of the information that must be contained in the report is:

A description of any changes made to the payment service provider’s risk management and incident response framework;
A description of the human and financial resources for implementing and maintaining the risk management and incident response framework;
A description of the PSP’s operational risks in respect of the reporting year, their potential causes and the manner in which they were identified;
A description of the systems, policies, procedures, processes, controls, including any approvals required;
A description of training;
A description of all reviews, and independent reviews; and
A description of any incidents that the payment service provider experienced during the reporting year.

Also, the report will need to contain certain volume and value statistics related to the services a PSP is providing.

Significant Change Report

PSPs will be required to notify the Bank of Canada, at least five days in advance, before making a significant change that could materially impact operational risks or the safeguarding of end user funds.

The information that must be contained in the report is:

The name and contact information of the individual who may be contacted regarding the significant change;
A description of the change or new activity to be performed;
The reason for the change or new activity;
The date on which the change is to be made;
The PSP’s assessment of the effect that the change or new activity will have on its operational risks; and
A copy of all documentation in relation to the PSP’s Risk Management Framework, that has been amended to reflect the change or new activity, including any necessary approvals.

If a PSP has senior officers, the change or new activity must be approved and receive formal sign off by senior management before submission of a report. This should be taken into account from a planning perspective, as it can take some time to obtain such internal approvals.

Incident Report

PSPs must report incidents that have a material impact on an end user, other PSPs, or designated financial market infrastructures, to the Bank of Canada and other impacted individuals and entities.

The information that must be contained in the report is:

A description of the incident;
What impact does the incident have on individuals and entities; and
What actions have been taken by the PSP to respond and remediate.

The Regulations do not make it clear what timeframe is required for reporting such incidents, however they do state the standard time to respond to a request from the Bank of Canada is 15 days. Failure to report an incident can result in an administrative monetary penalty classified as very serious.

What Does This Mean?

From the highlights, it’s evident that these Regulations will create a substantial burden for PSPs, especially ones that are smaller or just starting. A significant amount of time, resources and cost are going to be needed to manage the compliance requirements that PSPs will need to follow. If a PSP does not comply or there is partial compliance, they may be subject to administrative monetary penalties that range from CAD 1,000,000 per each serious violation, up to CAD 10,000,000 per each very serious violation. The draft Regulations did not make clear what a dispute process would like.

It should be noted that most PSPs captured under the RPAA are also considered money services businesses (MSBs), and as such must also comply with anti-money laundering (AML) compliance obligations. Check out our blog related to that here.

What Next?

Due to these changes not being final, we wait. There is no set date for when we can expect final legislation or when they will come into force, but it is a good time to start budgeting and align resources.

Also, as there is a 45-day comment period for the proposed Regulations which closes on March 28, 2023, PSPs should review the Regulations carefully and provide feedback. Comments can be submitted online via the commenting feature after each section of the proposed Regulations, via email, or via regular mail to Nicolas Marion, Senior Director, Payments Policy, Department of Finance, 90 Elgin Street, Ottawa, Ontario K1A 0G5.

EFTs and PSPs

What may have seemed like an inconsequential change to the definition of EFTs, which removed certain exemptions, has significant impacts on payment services providers.

“As payment services are not a prescribed service under the PCMLTFA, FINTRAC is taking the position that persons or entities that provide invoice payment services or payment services for goods and services are engaged in the business of remitting or transmitting funds, or dealing in virtual currency.”

FINTRAC’s guidance goes on to define each of these activities and the (very limited) exemptions in each case.

Crowdfunding

While crowdfunding gets a nod in the title of the guidance, it doesn’t really factor into the substance of today’s piece. There are definitions in the amendments themselves in this case, and it’s likely that additional guidance will follow as FINTRAC works through these registrations.

“crowdfunding platform means a website or an application or other software that is used to raise funds or virtual currency through donations. (plateforme de sociofinancement)”

“crowdfunding platform services means the provision and maintenance of a crowdfunding platform for use by other persons or entities to raise funds or virtual currency for themselves or for persons or entities specified by them. (services de plateforme de sociofinancement)”

FINTRAC’s MSB/FMSB Registration Process

The guidance notes that FINTRAC is working on getting businesses registered “over the next several weeks.” As there are many businesses that will be newly registering as MSBs or FMSBs, industry participants should expect some delays. It has also become much more common for FINTRAC to ask for additional details about the business, such as the business model and flow of funds.

There is also a tool to check to see if your business should be registered: https://www.fintrac-canafe.gc.ca/msb-esm/questions/2-eng

If you’re ready to register, you can find an overview of the process and links to the pre-registration form here: https://fintrac-canafe.canada.ca/msb-esm/register-inscrire/reg-ins-eng

Requesting Policy Interpretations

There are two important FINTRAC email addresses. If you have a question specifically about whether or not your business should register, first try msb-esm@fintrac-canafe.gc.ca.

For other policy interpretation requests (or if your request is particularly complex), your best avenue is most likely guidelines-lignesdirectrices@fintrac-canafe.gc.ca.

Enforcement Actions

FINTRAC’s guidance indicates that the regulator will take a reasonable approach to entities required to register.

“We understand that there will be challenges in meeting certain obligations. FINTRAC will be reasonable in its assessment and enforcement approach, and is committed to working with reporting entities subject to the PCMLTFA and its Regulations to increase their awareness, understanding and compliance with their obligations. Please continue to monitor our website for updates or additional guidance.”

This gentle approach will not last indefinitely. If your business needs to be registered (and get its house in order AML compliance-wise), it’s time to get started.

We’re here to help.

Whether you want a hand drafting a policy interpretation request, an AML compliance program, or training for your newly minted AML Compliance Officer (congratulations, I’m sorry), we’re here to help. Please get in touch.

An MSB by Any Other Name

What’s in an MSB?

Under Canadian federal legislation, a money services business (MSB), in Canada, is a person or entity engaged in the business of any of the following activities:

Foreign exchange dealing;
Remitting or transmitting funds by any means or through any person, entity or electronic funds transfer network; or
Issuing or redeeming money orders, traveller’s cheques or other similar negotiable instruments (except for cheques payable to a named person or entity).

More detailed guidance on these specifications can be found in FINTRAC Interpretation Notice no. 1, published by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). There is also a number of excellent guidance documents for MSBs available on FINTRAC’s website.

Payment Service Providers (PSPs) and Payment Processors

We’ve had a lot of MSBs lately calling to ask if they can simply declare themselves as payment service providers (PSPs) or payment processors rather than MSBs.

The short answer is “no.”

The long answer is “only if you change your business model to include only PSP activities.”

PSP or payment processing services, in FINTRAC’s view are quite restricted. These include providing payment processing services for the purposes of:

Payroll and commission payments, or
Tuition fee payments, or
Utility bill payments, or
Mortgage and rent payment.

These services do not, generally, involve any element of foreign exchange. While this is probably not the answer that many MSBs are looking for, especially those that are labouring to maintain banking relationships in the current climate, it is important information. Operating an MSB without registering with FINTRAC or maintaining a compliance program can lead to penalties including administrative monetary penalties (AMPs) and the publication of the MSB’s name on FINTRAC’s website. To date, 36 MSBs have received a total of $814,805 in AMPs.

Corollary Services

There are also cases where MSB type activities are performed as a “corollary” another product or service. In these instances, the business does not offer MSB type products or services to the public as standalone services, but provides these in order to facilitate other services. The most common exemption that we have seen relates to lending services.

For example: A company that is in the business of automotive lending (loans) might make a payment on its customer’s behalf to a car dealership. In this case, the payment that is remitted to the car dealership could be considered “remitting or transmitting funds by any means or through any person, entity or electronic funds transfer network” (which would be an MSB service), however, it is only remitted for the purpose of issuing the loan, and is considered a corollary.

There are, however, a number of cases that might appear to be corollary services on the surface, which are not. Unless your business model is identical to a business model where FINTRAC has already issued a policy interpretation citing the MSB services offered as a corollary, we highly recommend seeking a policy interpretation from FINTRAC in order to ensure that you are not carrying out MSB business in the regulator’s view.

FINTRAC’s Policy Interpretations – Just Ask

Fortunately, FINTRAC publishes its policy interpretations on its website. We’ve pulled together the most relevant of these in this document.

MSB PSP FINTRAC Policy Interpretation at 16Jan2017

FINTRAC’s policy positions are provided as guidance to the industry. If you have specific questions about your business model, you may contact FINTRAC directly via email at: guidelines-lignesdirectrices@fintrac-canafe.gc.ca.

There is no cost to contacting FINTRAC directly, however, it generally takes 4-8 weeks (in our experience) to receive a response in writing. We recommend reading and referring to FINTRAC’s existing guidance (including guidelines and policy interpretations) in order to frame your question effectively.

Need a Hand?

If you have questions about this document, would like to receive a copy in Word, or need assistance with compliance, please feel free to contact us. We aim to answer all queries within 2 business days.

Phone: (844) 919-1623

Email: info@outliercanada.com

Web Form: https://www.outliercanada.com/contact-us/

Anti-Money Laundering
Consulting Services & Strategies