As of 1 November 2024, all payment service providers (MSBs/PSPs) operating in Canada are required to undergo re-licensing with the Bank of Canada (BoC). This requirement arises from the new Retail Payment Activities Act (RPAA), which regulates companies engaged in processing retail payments.
The law applies to both Canadian companies and foreign MSBs/PSPs offering services to Canadian clients. The re-licensing process is mandatory for businesses wishing to continue lawful operations in Canada and involves meeting all regulatory requirements set by the Bank of Canada.
New rules and obligations for financial institutions in Canada
Previously, payment service providers, such as MSBs (PSPs), were regulated under the Proceeds of Crime and Terrorist Financing Act, which primarily focused on monitoring financial transactions. However, starting from 1 November 2024, the new Retail Payment Activities Act (RPAA) will come into force, placing PSPs under the oversight of the Bank of Canada. This reflects a stricter regulatory approach, similar to the European model.
The new law aims to establish tighter control and regulation of payment service providers and fintech companies, introducing new obligations for all market participants. Under the key requirements of the Retail Payment Activities Act (RPAA), payment service providers must implement an operational risk management and incident response framework (RMIR Framework), report significant incidents to the Bank of Canada, notify about substantial changes in their operations, and ensure the protection of users’ funds.
