Whereas the safe and efficient movement of funds is essential to the health and strength of the national economy;
Whereas evolving technologies permit retail payment activities to be performed in new and increasingly complex ways by a larger variety of payment service providers across Canada;
Whereas Parliament considers that it is desirable and in the national interest to address risks related to national security that could be posed by payment service providers;
Whereas Parliament considers that it is desirable and in the national interest to supervise and regulate retail payment activities performed by payment service providers in order to mitigate operational risks and to safeguard end-user funds;
And whereas Parliament considers that it is desirable and in the national interest to supervise and regulate retail payment activities performed by payment service providers in order to foster competition and innovation in payment services by building confidence in the retail payment sector;
Now therefore, Her Majesty, by and with the advice and consent of the Senate and House of Commons of Canada, enacts as follows:
Short Title
This Act may be cited as the Retail Payment Activities Act.
Interpretation
The following definitions apply in this Act.
Bank means the Bank of Canada. (Banque)
Centre means the Financial Transactions and Reports Analysis Centre of Canada. (Centre)
electronic funds transfer means a placement, transfer or withdrawal of funds by electronic means that is initiated by or on behalf of an individual or entity. (transfert électronique de fonds)
end user means an individual or entity that uses a payment service as a payer or payee. (utilisateur final)
entity means a corporation, trust, partnership, fund, an unincorporated association or organization, the government of a foreign country or of a political subdivision of a foreign country, or an agency of a foreign country or of a subdivision of a foreign country. (entité)
government authority includes the Royal Canadian Mounted Police, the Communications Security Establishment and the Canadian Security Intelligence Service. (autorité administrative)
Governor has the same meaning as in section 2 of the Bank of Canada Act. (gouverneur)
incident means an event or series of related events that is unplanned by a payment service provider and that results in or could reasonably be expected to result in the reduction, deterioration or breakdown of any retail payment activity that is performed by the payment service provider. (incident)
Minister means the Minister of Finance. (ministre)
operational risk means a risk that any of the following will result in the reduction, deterioration or breakdown of retail payment activities that are performed by a payment service provider:
a deficiency in the payment service provider’s information system or internal process;
a human error;
a management failure; or
a disruption caused by an external event. (risque opérationnel)
payment function means
the provision or maintenance of an account that, in relation to an electronic funds transfer, is held on behalf of one or more end users;
the holding of funds on behalf of an end user until they are withdrawn by the end user or transferred to another individual or entity;
the initiation of an electronic funds transfer at the request of an end user;
the authorization of an electronic funds transfer or the transmission, reception or facilitation of an instruction in relation to an electronic funds transfer; or
the provision of clearing or settlement services. (fonction de paiement)
payment service provider means an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity. (fournisseur de services de paiement)
prescribed means prescribed by regulation. (Version anglaise seulement)
registered means registered under section 25. (enregistré)
retail payment activity means a payment function that is performed in relation to an electronic funds transfer that is made in the currency of Canada or another country or using a unit that meets prescribed criteria. (activité associée aux paiements de détail)
third-party service provider means an individual or entity that, under a contract, provides a payment service provider with a service related to a payment function and that is not an employee or agent or mandatary of the payment service provider. (tiers fournisseur de services)
one entity is affiliated with another entity if one of them is the subsidiary of the other or both are subsidiaries of the same entity or each of them is controlled by the same individual or entity;
two entities are deemed to be affiliated with each other if they are affiliated with the same entity at the same time; and
an individual is affiliated with an entity if the individual controls the entity.
For the purposes of subsection (1), an entity is a subsidiary of another entity if it is controlled by that other entity.
For the purposes of this section,
a corporation is controlled by an individual or entity if
securities of the corporation to which are attached more than 50% of the votes that may be cast to elect directors of the corporation are held, directly or indirectly, whether through one or more subsidiaries or otherwise, otherwise than by way of security only, by or for the benefit of that individual or entity, and
the votes attached to those securities are sufficient, if exercised, to elect a majority of the directors of the corporation;
a limited partnership is controlled by its general partner; and
an entity other than a corporation or a limited partnership is controlled by an individual or entity if the individual or entity, directly or indirectly, whether through one or more subsidiaries or otherwise, holds an interest in the entity that is not a corporation that entitles them to receive more than 50% of the profits of that entity or more than 50% of its assets on dissolution.
Application
General
Subject to sections 6 to 10, this Act also applies in respect of any retail payment activity that is performed for an end user in Canada by a payment service provider that does not have a place of business in Canada but directs retail payment activities at individuals or entities that are in Canada.
Non-application
This Act does not apply in respect of the following retail payment activities:
a payment function that is performed in relation to an electronic funds transfer that is made with an instrument that is issued by a merchant — or by an issuer that is not a payment service provider and has an agreement with a group of merchants — and that allows the holder of the instrument to purchase goods or services only from the issuing merchant or any merchant in the group;
a payment function that is performed in relation to an electronic funds transfer that is made for the purpose of giving effect to an eligible financial contract as defined in subsection 39.15(9) of the Canada Deposit Insurance Corporation Act or for the purpose of giving effect to a prescribed transaction in relation to securities;
a payment function that is performed in relation to an electronic funds transfer that is made for the purpose of a cash withdrawal at an automatic teller machine; and
a prescribed retail payment activity.
This Act does not apply in respect of a payment function that is performed in relation to an electronic funds transfer if the payment function is performed using a system that is designated under section 4 of the Payment Clearing and Settlement Act.
This Act does not apply in respect of a retail payment activity that is performed by a payment service provider if
the payment function in question is performed in relation to an electronic funds transfer that is made between affiliated entities;
the payment service provider is one of the affiliated entities; and
no other payment service provider performs payment functions in relation to that electronic funds transfer.
This Act does not apply to a payment service provider that performs retail payment activities if the payment service provider is one of the following:
a bank;
an authorized foreign bank as defined in section 2 of the Bank Act in respect of its business in Canada;
a cooperative credit society, savings and credit union, caisse populaire or central cooperative credit society that is regulated by a provincial Act or an association regulated by the Cooperative Credit Associations Act;
Her Majesty in right of a province or an agent or mandatary of Her Majesty in right of a province, if Her Majesty in right of a province or the agent or mandatary accepts deposits transferable by order;
a company to which the Insurance Companies Act applies or an insurance company regulated by a provincial Act;
a company to which the Trust and Loan Companies Act applies;
a trust company that is regulated by a provincial Act;
a loan company that accepts deposits transferable by order and is regulated by a provincial Act;
the Canadian Payments Association;
the Bank; or
a prescribed individual or entity or an individual or entity of a prescribed class.
This Act does not apply to an agent or mandatary of a registered payment service provider if the agent or mandatary is performing retail payment activities in the scope of their authority as agent or mandatary and is included on the list of agents or mandataries that was provided by the payment service provider under paragraph 29(1)(e) and is updated in accordance with subsection 59(1).
If a provision of a federal or provincial Act or regulation applies to or in respect of a payment service provider that performs retail payment activities or a class of payment service providers that perform retail payment activities and the Governor is of the opinion that the provision is substantially similar to any of the following provisions of this Act or its regulations, then the Governor may, by order, specify the provision of this Act or its regulations and the payment service provider or class of payment service provider:
subsection 29(2);
A provision that is specified in an order made under subsection (1) does not apply to or in respect of the payment service provider or class of payment service provider specified in the order.
Bank and Minister
The Bank’s objects under this Act are to
supervise payment service providers that perform retail payment activities in order to determine whether those payment service providers are in compliance with this Act;
promote the adoption by those payment service providers of policies and procedures that are designed to implement their obligations under this Act; and
monitor and evaluate trends and issues related to retail payment activities.
In pursuing these objects, the Bank must consider the efficiency of payment services and the interests of end users.
The Bank may, for the purpose of exercising its powers or performing its duties and functions under this Act, enter into an agreement or arrangement with any government authority or regulatory body.
The Bank may issue guidelines respecting the manner in which this Act, with the exception of the provisions referred to in subsection (2), is to be applied.
The Governor may delegate to an officer of the Bank any of the Governor’s powers, duties or functions under this Act.
If a power, duty or function is delegated, the Bank must cause to be published in the Canada Gazette a notice that includes
the title of the officer to whom the power, duty or function is delegated;
the power, duty or function that is delegated; and
the day on which the delegation takes effect.
If the Governor revokes a delegation, the Bank must cause to be published in the Canada Gazette a notice that includes the day on which the delegation ceases to have effect.
No action lies against Her Majesty in right of Canada, any officer, employee or director of the Bank or any person acting under the direction of the Governor for anything done or omitted to be done in good faith in the administration or discharge of any powers or duties that under this Act are intended or authorized to be executed or performed.
No action lies against Her Majesty in right of Canada, the Minister or any person or government authority acting under the direction of the Minister for anything done or omitted to be done in good faith in the administration or discharge of any powers or duties that under this Act are intended or authorized to be executed or performed.
Operational and Financial Measures
Operational Risk Management and Incident Response
For the purposes of identifying and mitigating operational risks and responding to incidents, a payment service provider that performs retail payment activities must, in accordance with the regulations, establish, implement and maintain a risk management and incident response framework that meets prescribed requirements.
The Bank or a person designated by the Bank may assess the payment service provider’s risk management and incident response framework or any portion of it and the Bank may provide the payment service provider with a list of corrective measures that the Bank considers appropriate.
The payment service provider must give all assistance that is reasonably required to enable the Bank or the designated person to carry out an assessment referred to in subsection (2) and must provide any documents or information and access to any data that are specified by the Bank or the designated person.
If a payment service provider that performs retail payment activities becomes aware of an incident that has a material impact on any of the following individuals or entities, the payment service provider must, without delay, notify that individual or entity and the Bank of the incident:
an end user;
a payment service provider that performs retail payment activities, whether or not this Act applies to the payment service provider; and
a clearing house of a clearing and settlement system, as those expressions are defined in section 2 of the Payment Clearing and Settlement Act, that is designated under subsection 4(1) of that Act.
The notice must be given in the prescribed form and manner and contain the prescribed information.
The Bank may, by order, direct a payment service provider that has given a notice in accordance with section 18 to provide any follow-up notice that the Bank considers relevant.
The order must specify
the individuals or entities to be notified;
when the follow-up notice is to be given and its form and manner; and
the information to be contained in the notice.
The payment service provider must comply with the order.
Safeguarding of Funds
If a payment service provider performs a retail payment activity that is the holding of end-user funds until they are withdrawn by the end user or transferred to another individual or entity, the payment service provider must
hold the end-user funds in trust in a trust account that is not used for any other purpose;
hold the end-user funds in a prescribed account or in a prescribed manner and take any prescribed measures in relation to the funds, the account or the manner; or
hold the end-user funds in an account that is not used for any other purpose and hold insurance or a guarantee in respect of the funds that is in an amount equal to or greater than the amount held in the account.
Subsection (1) does not apply to a payment service provider in respect of end-user funds it holds in a province if the payment service provider accepts deposits that are insured or guaranteed under an Act of that province and those end-user funds are deposits that are guaranteed or insured under that Act.
No right of set-off or compensation may be asserted by an individual or entity that maintains an account that is referred to in paragraph (1)(a), (b) or (c) in respect of the funds held in that account.
Provision of Information
A payment service provider that performs retail payment activities must, at the prescribed time and in the prescribed form and manner, submit an annual report to the Bank that includes
the prescribed information respecting the payment service provider’s risk management and incident response framework;
any other prescribed information in relation to the holding of end-user funds for the purposes of subsection 20(1) and any regulations made for the purposes of that subsection; and
any other prescribed information.
A payment service provider must notify the Bank before the payment service provider makes a significant change in the way it performs a retail payment activity or before it performs a new retail payment activity. The notice must
be given within the prescribed period;
be in the prescribed form and manner; and
include the prescribed information.
For the purposes of subsection (1), a change is significant if it could reasonably be expected to have a material impact on operational risks or the manner in which end-user funds are safeguarded.
Registration
General
A payment service provider must be registered with the Bank before it performs any retail payment activities.
If an individual or entity plans to acquire control of a registered payment service provider, the registered payment service provider must, before the acquisition, submit a new application for registration that takes the planned acquisition into account and be so registered.
If a registered payment service provider plans to make a prescribed change, the registered payment service provider must, before the change takes effect, submit a new application for registration that takes the planned change into account and be so registered.
The Bank must, as soon as feasible, notify the applicant in writing that the applicant has been registered.
The Bank must maintain a registry of registered payment service providers and must make public the name of each registered payment service provider, its address and any prescribed information in relation to the payment service provider, the activities it performs or its registration.
The Bank must maintain and publish a list of the individuals or entities that the Bank has refused to register and the payment service providers that have had their registrations revoked. The list must set out the reasons for a refusal or revocation.
Any document required or permitted to be executed or signed by more than one individual for the purposes of this Act may be executed or signed in several documents of similar form, each of which is executed or signed by one or more of the individuals. The documents, when executed or signed by all individuals required or permitted, as the case may be, to do so, are deemed to constitute one document for the purposes of this Act.
Applications for Registration
An applicant for registration must submit an application in the prescribed form and manner that includes
the applicant’s name and any name under which the applicant performs or plans to perform payment functions as a service or business activity;
the applicant’s address and any prescribed contact information;
a declaration that states whether the applicant operates or plans to operate out of a dwelling-house;
a description of how the applicant is organized or structured and, as applicable, any prescribed information in relation to the applicant’s incorporation, affiliated entities, directors and managers or owners;
a list of the applicant’s agents and mandataries that perform retail payment activities in the scope of their authority as an agent or mandatary and any prescribed information in relation to those agents and mandataries;
a description of the retail payment activities the applicant performs or plans to perform, including any prescribed information in relation to the volume and value or estimated volume and value of those retail payment activities;
the number of end users or estimated number of end users for whom the applicant performs or plans to perform retail payment activities;
any prescribed information in relation to end-user funds that the applicant holds or plans to hold;
a description of the applicant’s risk management and incident response framework or the framework that the applicant plans to establish and implement;
any prescribed information in relation to the manner in which the applicant safeguards or plans to safeguard end-user funds;
any prescribed information in relation to any of the applicant’s third-party service providers that have or will have a material impact on the applicant’s operational risks or the manner in which the applicant safeguards or plans to safeguard end-user funds;
a declaration that states whether the applicant is registered with the Centre;
a declaration that states whether the applicant has a place of business in Canada;
a declaration that states whether the applicant has applied for registration or is registered under a provincial Act respecting retail payment activities;
in the case of an applicant that does not have a place of business in Canada, the name and address of an agent or mandatary in Canada that is authorized, on behalf of the applicant, to accept notices given or served under this Act as well as orders made under this Act; and
The applicant must include the prescribed registration fee with the application.
The applicant must provide the Bank with any additional information that the Bank requests in relation to the information referred to in subsection (1) within 30 days after the day on which the request is made.
An applicant that becomes aware that information provided as part of the application has changed or is about to change must notify the Bank of the change or anticipated change as soon as possible after becoming aware of it and the Bank must then, as soon as possible, notify the Minister and any person or government authority designated under section 32.
The Bank must, as soon as feasible after it is of the opinion that an application for registration is complete, notify the applicant that the application is complete and provide the Centre with the information referred to in paragraphs 29(1)(a) to (f) and any information respecting the applicant that is under the Bank’s control and is prescribed for the purposes of this section.
National Security Review
The Bank must, as soon as feasible after it is of the opinion that an application for registration is complete, provide the Minister and any designated person or government authority with a copy of the application.
The Minister may, within the prescribed period, decide to review an application for registration if the Minister is of the opinion that it is necessary to do so for reasons related to national security. In that case, the Minister must notify the Bank of the decision and the Bank must then notify the applicant.
The Minister may extend the prescribed period for one or more prescribed periods if the Minister considers it necessary to do so and notifies the Bank. In that case, the Bank must notify the applicant of the extension.
If the Minister decides to review an application for registration, the Minister must conduct the review within the prescribed period but the Minister may extend the period for conducting the review for one or more periods equal to the prescribed period if the Minister considers it necessary to do so and notifies the Bank. In that case, the Bank must notify the applicant of the extension.
If the Minister notifies the Bank of a decision to review an application for registration, the Bank must not register the applicant unless the Minister notifies the Bank under section 38 of a decision not to issue a directive.
The Minister must notify the Bank if, after completing a review of an application, the Minister decides not to issue a directive under section 40.
An applicant or registered payment service provider must provide the Minister and any designated person or government authority with any additional information that the Minister, person or government authority requests in relation to the applicant or registered payment service provider or the retail payment activities the applicant performs or plans to perform.
The Minister may, for any of the following reasons, issue a directive to the Bank to refuse to register an applicant:
there are reasons related to national security;
the applicant has failed to provide additional information in accordance with section 39;
an order made under section 42 or an undertaking provided in accordance with that section that is in relation to the application in question has not been complied with;
a condition imposed under section 43 in relation to the application in question has not been complied with; and
the applicant has provided false or misleading information.
An applicant that has been notified under section 49 may, within the prescribed period, make a request to the Minister for a review of the directive to refuse registration.
On completion of the review, the Minister must, after giving the applicant an opportunity to make representations, confirm or revoke the directive. The Minister must notify the Bank of the decision and the Bank must then, as soon as feasible, notify the applicant.
The Minister may, by order, require any individual or entity to provide an undertaking in relation to an application for registration or in relation to any registered payment service provider if the Minister is of the opinion that it is necessary to do so for reasons related to national security.
The Minister may, by order, impose conditions on any individual or entity in relation to an application for registration or in relation to any registered payment service provider if the Minister is of the opinion that it is necessary to do so for reasons related to national security.
The Minister may, for any of the following reasons, issue to the Bank a notice of intent to issue a directive to the Bank to revoke a payment service provider’s registration:
there are reasons related to national security
the payment service provider has failed to provide additional information in accordance with section 39;
an order made under section 42 or an undertaking provided in accordance with that section that is in relation to the payment service provider has not been complied with;
a condition imposed under section 43 in relation to the payment service provider has not been complied with;
the payment service provider has provided false or misleading information; and
the payment service provider has not complied with an order under section 96.
The Bank must, as soon as feasible, notify the payment service provider in writing of the issuance of the Minister’s notice of intent.
A registered payment service provider that has been notified under subsection 45(2) may, within the prescribed period, make a request to the Minister for a review of the notice of intent.
On completion of the review, the Minister must, after giving the payment service provider an opportunity to make representations, either withdraw the notice of intent or issue a directive to the Bank to revoke the registration.
The Minister must notify the Bank of a decision to withdraw the notice of intent and the Bank must, as soon as feasible, notify the payment service provider of the withdrawal.
If a registered payment service provider that has been notified under subsection 45(2) does not make a request to the Minister for a review of the notice of intent within the prescribed period, the Minister may issue a directive to the Bank to revoke the payment service provider’s registration.
Refusal to Register
The Bank may, within the prescribed period, refuse to register an applicant for a prescribed reason or for any of the following reasons:
the applicant has failed to provide additional information in accordance with subsection 29(3);
the applicant has provided false or misleading information;
during the five-year period before the day on which the application was submitted, the Director of the Centre, under subsection 73.15(4) of that Act, caused a notice of a decision or of an imposed penalty to be issued and served on the applicant in respect of a serious violation, a very serious violation or a compliance order violation under that Act;
the applicant is not registered in accordance with section 11.1 of that Act;
the applicant has ceased to perform or no longer plans to perform retail payment activities; and
the applicant has committed or has been deemed to have committed a violation under this Act.
If an applicant that does not have a place of business in Canada has committed a violation under this Act and is liable to pay a penalty for it, and if 30 days have elapsed after the day on which all proceedings in respect of the violation are ended and the penalty has not been paid, the Bank must refuse to register the applicant until the penalty is paid.
If the Bank refuses to register an applicant under subsection (1), the Bank must, as soon as feasible, notify the applicant of the refusal in writing. The notice must include the reason for the refusal.
The Bank must refuse to register an applicant if the Minister issues a directive to that effect under section 40. In that case, the Bank must, as soon as feasible, notify the applicant in writing of the refusal.
An applicant that has been notified under subsection 48(3) may, within the prescribed period, make a request to the Governor for a review of the refusal to register.
On completion of the review, the Governor must confirm the refusal or direct the Bank to register the applicant.
The Governor must, within the prescribed period, make a decision and must, as soon as feasible, notify the applicant in writing of the decision.
The Bank must, as soon as feasible, notify the Centre in writing of any refusal to register an applicant.
Revocation of Registration
The Bank may, for a prescribed reason or for any of the following reasons, issue to a registered payment service provider a notice of intent to revoke the payment service provider’s registration that sets out the reason for the intention to revoke:
the payment service provider has provided false or misleading information;
the Director of the Centre, under subsection 73.15(4) of that Act, has caused a notice of a decision or of an imposed penalty to be issued and served on the payment service provider in respect of a serious violation, a very serious violation or a compliance order violation under that Act;
the payment service provider is not registered in accordance with section 11.1 of that Act;
the payment service provider has ceased to perform retail payment activities;
an individual or entity that applied for registration under section 24 has acquired control of the payment service provider; and
the payment service provider has committed or has been deemed to have committed a violation under this Act.
A registered payment service provider that has been notified under section 52 may, within the prescribed period, make a request to the Governor for a review of the notice of intent.
On completion of the review, the Governor must, after giving the payment service provider an opportunity to make representations, direct the Bank to either withdraw the notice of intent or revoke the payment service provider’s registration.
The Governor must, within the prescribed period, make a decision and must, as soon as feasible, notify the payment service provider in writing of the decision.
If a registered payment service provider that has been notified under section 52 does not make a request to the Governor for a review of the notice of intent within the prescribed period, the Governor may direct the Bank to revoke the payment service provider’s registration.
The Bank must revoke the registration of a registered payment service provider if the payment service provider does not have a place of business in Canada, has committed a violation under this Act and is liable to pay a penalty for it, and the penalty has not been paid within 30 days after the day on which all proceedings in respected of the violation are ended.
The Bank must, as soon as feasible, notify the payment service provider in writing of the revocation under subsection (1).
The Bank must, as soon as feasible, notify the payment service provider in writing of the revocation under subsection (1).
The Bank must, as soon as feasible, notify the Centre in writing of any revocation of a payment service provider’s registration.
Appeal to Federal Court
The Federal Court may
dismiss the appeal;
set aside the decision and, as applicable, order the Bank to register the applicant or to reinstate the payment service provider’s registration; or
set aside the decision and refer the matter back to the Governor for re-determination.
Provision of Information
The payment service provider is not however required to notify the Bank if the information in question was included in a notice under section 60.
A registered payment service provider must notify the Bank of any change to prescribed information in relation to the payment service provider or the retail payment activities the payment service provider performs.
The notice must be given as soon as feasible after the payment service provider becomes aware of the change but before the change takes effect. However, if a different period is prescribed for the purposes of this subsection, the notice must be given within that period.
The Bank must, as soon as feasible, notify the Minister and any designated person or government authority of any notice given under subsection (1).
An individual or entity must not provide false or misleading information to the Bank, the Minister or a person or government authority designated under section 32.
Confidentiality of Information
Subject to subsection (4), the Bank may disclose information obtained under this Act to the Minister or to any government authority or regulatory body if it agrees to treat the information as confidential.
The Bank must not disclose information obtained from the Centre without the Centre’s consent.
Subject to subsection (2), information that is obtained under this Act by the Minister or by a person or government authority designated under section 32 as well as any information prepared from that information is confidential and the Minister or the designated person or government authority must treat it accordingly.
The Minister or the designated person or government authority may disclose information obtained under this Act to any government authority or regulatory body that agrees to treat the information as confidential.
Prescribed information in relation to the supervision of payment service providers must not be used as evidence in any civil proceedings and is privileged for that purpose.
An individual or entity must not by an order of any court, tribunal or other body be required in any civil proceedings to give oral testimony or to produce any document relating to any information referred to in subsection (1).
Despite subsection (1), the Minister, the Governor, the Bank or the Attorney General of Canada may, in accordance with the regulations, use information referred to in that subsection as evidence in any proceedings.
Despite subsection (1), a payment service provider may, in accordance with the regulations, use information referred to in that subsection as evidence in any proceedings in relation to the administration or enforcement of this Act, the Bankruptcy and Insolvency Act or the Companies’ Creditors Arrangement Act that are commenced by the payment service provider, the Minister, the Governor, the Bank or the Attorney General of Canada.
Despite subsections (1) and (2), a court, tribunal or other body may, by order, require the Minister, the Governor, the Bank or a payment service provider to give oral testimony or to produce any document relating to any information referred to in subsection (1) in any civil proceedings in relation to the administration or enforcement of this Act that are commenced by the Minister, the Governor, the Bank, the Attorney General of Canada or a payment service provider.
Administration and Enforcement
Bank’s Powers
The Bank may request, in writing, a payment service provider that performs retail payment activities to provide, within the prescribed period, the Bank with any information that the Bank considers necessary for a purpose related to verifying compliance with this Act or carrying out the Bank’s objects under this Act.
The payment service provider must comply with the request.
For the purpose of verifying compliance with this Act, the Bank may, if it has reasonable grounds to believe that an individual or entity is a payment service provider that performs retail payment activities, request in writing, the individual or entity to provide the Bank with any information that the Bank requires to determine whether the individual or entity is a payment service provider that performs retail payment activities.
The individual or entity must comply with the request within the prescribed period.
The Bank may direct that a special audit of a payment service provider that performs retail payment activities be conducted in accordance with any conditions that the Bank considers appropriate if, in the Bank’s opinion, the special audit is required for the purpose of verifying compliance with this Act and the Bank may appoint an individual or entity to conduct the special audit.
The payment service provider must give all assistance that is reasonably required to enable the appointed individual or entity to conduct the special audit and must provide any documents or information and access to any data that are specified by the individual or entity.
The payment service provider must provide the Bank with the results of the special audit.
The expenses incurred in respect of the special audit are payable by the payment service provider.
An authorized person may, from time to time, examine the records and inquire into the business and affairs of a payment service provider that performs retail payment activities for the purpose of verifying compliance with this Act and for that purpose may
enter any place, other than a dwelling-house, in which the authorized person has reasonable grounds to believe that there are records relevant to verifying compliance with this Act;
use any computer system in the place, or cause it to be used, to examine data contained in or available to it;
reproduce any record, or cause it to be reproduced from the data, in the form of a printout or other intelligible output and remove the printout or other output for examination or copying; or
use any copying equipment in the place or cause it to be used.
The owner or person in charge of the place and every person in the place must give all assistance that is reasonably required to enable the authorized person to perform their functions under this section and must provide any documents or information and access to any data that are specified by the authorized person.
If the place is a dwelling-house, an authorized person may enter it without the occupant’s consent only under the authority of a warrant issued under subsection (2).
On ex parte application, a justice of the peace may issue a warrant authorizing an authorized person to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice is satisfied by information on oath that
the dwelling-house is a place referred to in paragraph 69(1)(a);
entry to the dwelling-house is necessary for a purpose related to verifying compliance with this Act; and
entry was refused by the occupant or there are reasonable grounds to believe that entry will be refused by, or that consent to entry cannot be obtained from, the occupant.
The Bank may enter into a compliance agreement with a payment service provider that performs retail payment activities for the purpose of implementing any measure that is designed to further compliance with this Act by the payment service provider.
Minister’s Powers
An authorized person may request, in writing, an individual or entity to provide, within the prescribed period, the authorized person with any information that the authorized person considers necessary for a purpose related to verifying compliance with an undertaking provided in accordance with section 42 or a condition imposed under section 43.
The individual or entity must comply with the request.
enter any place, other than a dwelling-house, in which the authorized person has reasonable grounds to believe that there are records relevant to verifying compliance with the undertaking or condition;
use any computer system in the place, or cause it to be used, to examine data contained in or available to it;
reproduce any record, or cause it to be reproduced from the data, in the form of a printout or other intelligible output and remove the printout or other output for examination or copying; or
use any copying equipment in the place or cause it to be used.
The owner or person in charge of the place and every person in the place must give all assistance that is reasonably required to enable the authorized person to perform their functions under this section and must provide any documents or information and access to any data that are specified by the authorized person.
If the place is a dwelling-house, an authorized person may enter it without the occupant’s consent only under the authority of a warrant issued under subsection (2).
On ex parte application, a justice of the peace may issue a warrant authorizing an authorized person to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice is satisfied by information on oath that
the dwelling-house is a place referred to in paragraph 74(1)(a);
entry to the dwelling-house is necessary for a purpose related to verifying compliance with the undertaking or condition; and
entry was refused by the occupant or there are reasonable grounds to believe that entry will be refused by, or that consent to entry cannot be obtained from, the occupant.
Administrative Monetary Penalties
Notices of Violation and Compliance Agreements
If the Bank believes on reasonable grounds that a payment service provider has committed a violation, the Bank may
issue and cause to be served on the payment service provider a notice of violation; or
issue and cause to be served on the payment service provider a notice of violation with an offer to reduce by half the penalty set out in the notice if the payment service provider enters into a compliance agreement with the Bank in respect of the provision to which the violation relates.
If the Bank believes on reasonable grounds that an individual or entity other than a payment service provider has committed a violation, the Bank may issue and cause to be served on the individual or entity a notice of violation.
The purpose of the penalty is to promote compliance with this Act and not to punish.
A notice of violation must name the individual or entity believed to have committed a violation, identify the violation and set out
the penalty to be paid;
the right of the individual or entity, within 30 days after the day on which the notice is served or within any longer period that the Bank specifies, to pay the penalty or to make representations to the Governor with respect to the violation and the penalty, and the manner for doing so; and
the fact that, if the individual or entity does not pay the penalty or make representations in accordance with the notice, the individual or entity will be deemed to have committed the violation and is liable to pay the penalty.
The Bank may establish, in respect of each violation, a short-form description to be used in notices of violation.
If a notice of violation contains any error or omission, the Bank may issue and cause to be served a corrected notice of violation on the individual or entity at any time during the period referred to in paragraph (1)(b).
If the individual or entity pays the penalty set out in the notice of violation, the individual or entity is deemed to have committed the violation and proceedings in respect of it are ended.
If the individual or entity makes representations in accordance with the notice, the Governor must decide, on a balance of probabilities, whether the individual or entity committed the violation and, if so, may, subject to any regulations made under paragraph 101(1)(k) or (l), impose the penalty set out in the notice, a lesser penalty or no penalty.
An individual or entity that neither pays the penalty set out in the notice nor makes representations in accordance with the notice is deemed to have committed the violation and is liable to pay the penalty set out in the notice.
If the Bank offers to enter into a compliance agreement with a payment service provider under paragraph 76(2)(b), the agreement must
identify the provision that was contravened and provide that the payment service provider will comply with that provision within the period and be subject to the terms and conditions specified in the agreement; and
set out the amount that the payment service provider will have to pay as the reduced penalty for the violation if the compliance agreement is entered into.
If the payment service provider does not enter into the compliance agreement and does not pay the reduced penalty within 30 days after the day on which the payment service provider received the notice of violation, the payment service provider is deemed to have refused to enter into the agreement and is liable to pay the full penalty set out in the notice of violation.
The Bank may extend the period referred to in paragraph (1)(a) if it is satisfied that the payment service provider is unable to comply with it within that period for reasons beyond their control.
A payment service provider that enters into a compliance agreement referred to in a notice of violation issued under paragraph 76(2)(b) is deemed to have committed the violation in respect of which the agreement was entered into.
If the Bank considers that a compliance agreement with a payment service provider has been complied with, the Bank must serve a notice to that effect on the payment service provider and, on the service of the notice, no further proceedings may be taken against the payment service provider with respect to the violation.
If the Bank considers that a compliance agreement with a payment service provider has not been complied with, the Bank may issue and cause to be served a notice of default on the payment service provider to the effect that the payment service provider is liable to pay
the difference between the penalty set out in the notice of violation and any portion of the reduced penalty under the compliance agreement that was paid; and
an additional penalty specified in the regulations.
The notice of default must specify the date, which must be 30 days after the day on which the notice is served, on or before which an application for review may be filed and particulars of how the application may be filed.
On the service of a notice of default, the payment service provider served has no right of set-off or compensation against any amount that it spent under the compliance agreement.
A payment service provider served with a notice of default may, on or before the date specified in the notice or within any time that the Bank allows, file an application for review of the Bank’s decision made under that subsection with the Governor.
The Governor may confirm the Bank’s decision or decide that the payment service provider has complied with the compliance agreement.
A payment service provider that neither pays the amounts set out in the notice of default nor files an application for review in accordance with the notice is deemed to have not complied with the compliance agreement and must pay the amounts set out in the notice of default without delay.
The Bank must cause notice of the Governor’s decision to be issued and served on the payment service provider together with notice of the right of appeal under subsection 84(1).
If the Bank does not cause notice of a decision to be issued and served under subsection 78(4) within 90 days after the day on which representations under subsection 78(2) were made, the individual or entity may appeal the penalty set out in the notice of violation to the Federal Court within 30 days after the day on which the 90-day period expires.
If the Bank does not cause notice of a decision to be issued and served under subsection 83(4) within 90 days after the day on which the Governor received the application for review under subsection 83(1), the individual or entity that filed the application may appeal to the Federal Court the amounts set out in the notice of default referred to in subsection 82(1) within 30 days after the day on which the 90-day period expires.
Rules About Violations
For greater certainty, a violation is not an offence and, accordingly, section 126 of the Criminal Code does not apply in respect of a violation.
Due diligence is a defence in a proceeding in relation to a violation.
Every rule and principle of the common law that renders any circumstance a justification or excuse in relation to a charge for an offence applies in respect of a violation to the extent that it is consistent with this Act.
An individual or entity is liable for a violation that is committed by any of its employees, third-party service providers, or agents or mandataries acting in the course of their employment, their contract or the scope of their authority as agent or mandatary, whether or not the employee, third-party service provider or agent or mandatary that actually committed the violation is identified.
Recovery of Debts
The following amounts constitute a debt due to Her Majesty in right of Canada that may be recovered in the Federal Court or any other court of competent jurisdiction:
the amount of the penalty set out in a notice of violation, beginning on the day on which it is required to be paid in accordance with the notice, unless representations are made in accordance with the notice, a compliance agreement is entered into or the decision is appealed;
if representations are made, the amount of the penalty that is imposed by the Governor, beginning on the day specified by the Governor or, if no day is specified, beginning on the day on which the decision is made;
every amount set out in a compliance agreement, beginning on the day on which the compliance agreement is entered into or the day specified in the compliance agreement;
if a review is requested under subsection 83(1) and the Governor confirms the Bank’s decision, the amount of the penalty set out in the notice of default referred to in subsection 82(1), beginning on the day specified by the Governor or, if no day is specified, beginning on the day on which the Governor’s decision is made, unless the decision is appealed;
the amount of a penalty determined by the Federal Court under subsection 84(4), beginning on the day on which the period specified in the decision for the payment of that amount expires or the day specified in the decision; and
the amount of any costs and expenses referred to in subsection (3).
Proceedings to recover a debt referred to in subsection (1) may be commenced no later than the fifth anniversary of the day on which the debt becomes payable.
An individual or entity that is liable to pay the amount of any debt referred to in any of paragraphs (1)(a) to (f) is also liable for the amount of any costs and expenses incurred in attempting to recover that amount.
A debt referred to in subsection (1) that is paid or recovered is payable to and must be remitted to the Receiver General.
The unpaid amount of any debt referred to in subsection 88(1) may be certified by the Governor.
Registration in the Federal Court of a certificate has the same effect as a judgment of that Court for a debt of the amount specified in the certificate and all related registration costs.
General
No notice of violation is to be issued after the second anniversary of the day on which the Bank becomes aware of the acts or omissions that constitute the alleged violation.
A document purporting to have been issued by the Bank, certifying the day on which the acts or omissions that constitute the alleged violation became known to the Bank, is admissible in evidence without proof of the signature or official character of the person appearing to have signed the document and, in the absence of evidence to the contrary, is proof that the Bank became aware of the acts or omissions on that day.
In a proceeding in respect of a violation, a notice of violation purporting to be issued under subsection 76(2), a notice of decision purporting to be issued under subsection 78(4) or 83(4), a notice of default purporting to be issued under subsection 82(1) or a certificate purporting to be made under subsection 89(1) is admissible in evidence without proof of the signature or official character of the person appearing to have signed it.
As soon as feasible after a payment service provider is deemed under subsection 78(1) or (3) to have committed a violation or after a notice of decision stating that the payment service provider has committed a violation is served under subsection 78(4), the Bank must make public the nature of the violation, the name of the payment service provider and the amount of any penalty imposed.
In making public the nature of a violation, the Bank may include the reasons for its decision to issue the notice of violation and any related decision, including the relevant facts, analysis and considerations that formed part of the decision.
Compliance Orders
If the Governor is of the opinion that a payment service provider that performs retail payment activities is committing, or is about to commit, an act that could have a significant adverse impact on an individual or entity referred to in subsection (2), the Governor may, by order, direct the payment service provider to
cease or refrain from committing the act or pursuing the course of conduct; and
perform any acts that, in the Governor’s opinion, are necessary to remedy the situation.
The individuals and entities are any of the following:
an end user;
a payment service provider that performs retail payment activities, whether or not this Act applies to them; and
a clearing house of a clearing and settlement system, as those expressions are defined in section 2 of the Payment Clearing and Settlement Act, that is designated under subsection 4(1) of that Act.
If, in the Governor’s opinion, the length of time required for representations to be made might be prejudicial to the public interest, the Governor may make a temporary order that has the same effect as an order under subsection (1). The order ceases to have effect 30 days after the day on which it is made or after the expiration of a shorter period that is specified in the order.
A temporary order continues to have effect after the expiration of the 30-day or the shorter period if no representations are made to the Governor within that period or, if representations are made, the Governor notifies the payment service provider that the Governor is not satisfied that there are sufficient grounds for revoking the order.
If an individual or entity is contravening or has contravened a provision of this Act, the regulations or an order made under subsection 94(1) or (4), the Governor may, in addition to any other action that may be taken under this Act, apply to a superior court for an order requiring the individual or entity to cease the contravention or to comply with the provision.
The court may make the order and may make any other order the court thinks fit.
An appeal from an order made under subsection (2) lies in the same manner and to the same court as an appeal from any other order of the court.
National Security
The Minister may, by order, direct a payment service provider that performs retail payment activities to take or to refrain from taking any measures related to the performance of retail payment activities if the Minister is of the opinion that it is necessary to do so for reasons related to national security.
If, in the Minister’s opinion, the length of time required for representations to be made might be prejudicial to the public interest, the Minister may make a temporary order that has the same effect as an order made under subsection (1). The temporary order ceases to have effect 30 days after the day on which it is made or after the expiration of a shorter period that is specified in the order.
The temporary order continues to have effect after the expiration of the 30-day or the shorter period if no representations are made to the Minister within that period or, if representations are made, the Minister notifies the payment service provider that the Minister is not satisfied that there are sufficient grounds for revoking the order.
If an individual or entity is not complying with an undertaking provided in accordance with section 42, a condition imposed under section 43 or an order made under section 96, the Minister may, in addition to any other action that may be taken under this Act, apply to a superior court for an order requiring the individual or entity to comply with the undertaking, condition or order.
The court may make the order and may make any other order the court thinks fit.
An appeal from an order made under subsection (2) lies in the same manner and to the same court as an appeal from any other order of the court.
Assessment Fees
The Bank must, before September 30 in each year, ascertain the total amount of expenses incurred by it during the immediately preceding calendar year for or in connection with the administration of this Act and deduct from that amount any registration fees paid to it in that preceding calendar year.
The amount ascertained is final and conclusive for the purposes of this section.
As soon as feasible after ascertaining the amount, the Bank must, in the prescribed manner and to the prescribed extent, assess a portion of the total amount of expenses against each registered payment service provider.
The Bank may, during each calendar year, prepare an interim assessment against any registered payment service provider.
Every assessment and interim assessment is final and conclusive and binding on the registered payment service provider against which it is made.
Every assessment and interim assessment constitutes a debt due to the Bank, is immediately payable and may be recovered as a debt in any court of competent jurisdiction.
Interest may be charged on the unpaid amount of an assessment or interim assessment at a rate equal to 2% plus the rate in effect that is prescribed under the Income Tax Act for amounts payable by the Minister of National Revenue as refunds of overpayments of tax under that Act.
The payment service provider must comply with the request.
Regulations
The Governor in Council may, on the recommendation of the Minister, make regulations for the purposes of this Act, including regulations
respecting risk management and incident response frameworks;
respecting the holding of end-user funds by a payment service provider referred to in subsection 20(1) and the measures to be taken by the payment service provider to ensure that end-user funds or proceeds from any insurance or guarantee referred to in paragraph 20(1)(c) are payable to end users in the event of an insolvency or other specified event;
respecting the provision of information in relation to the holding of end-user funds with the Canada Deposit Insurance Corporation or a member institution as in section 2 of the Canada Deposit Insurance Corporation Act;
respecting the acquisition of control for the purposes of section 24;
respecting the circumstances in which information referred to in subsection 64(1) may be used as evidence;
prohibiting, limiting or restricting the disclosure by payment service providers of information referred to in subsection 64(1);
designating, as a violation that may be proceeded with under Part 5, the contravention of a specified provision of this Act or the regulations;
classifying each violation as a minor violation, a serious violation or a very serious violation, classifying a series of minor violations as a serious violation or a very serious violation or classifying a series of serious violations as a very serious violation;
designating, as a violation that may be proceeded with under Part 5, the non-compliance with an agreement entered into under section 71;
establishing a penalty or a range of penalties in respect of a violation up to a maximum of $10,000,000;
if a range of penalties is established by regulations made under paragraph (k), setting out the method of establishing the amount payable as the penalty for the violation, including the criteria to be taken into account;
specifying the additional penalty referred to in paragraph 82(1)(b);
respecting the service of documents under Part 5, including the manner and proof of service and the circumstances under which documents are deemed to be served;
respecting the keeping and retention of records; and
prescribing anything that by this Act is to be prescribed.
A registration fee is prescribed for the purposes of subsection 29(2) if a method for determining the amount of the registration fee is prescribed.
The Statutory Instruments Act does not apply in respect of
an order made under section 19;
a directive issued under section 40;
a notice issued under section 45;
a notice issued under section 52;
Transitional Provisions
A payment service provider that performs or plans to perform retail payment activities during the transition period must, within the prescribed period that begins on the day on which section 29 comes into force, apply to the Bank for registration in accordance with that section.
For greater certainty, a regulation that prescribes a period within which something is to be done or may be done under this Act in relation to an application for registration may distinguish between applications that are submitted during the transition period and applications that are submitted after the end of that period.
If subsection 53.6(1) of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, as enacted by section 181 of the Budget Implementation Act, 2021, No. 1, comes into force before or during the transition period, the 30-day period referred to in that subsection is, in relation to an application for registration that is submitted during the transition period, suspended until the end of the transition period.
During the transition period, the Bank must not disclose the outcome or likely outcome of an application to the applicant unless a directive in relation to the applicant is issued to the Bank under section 40.
Despite subsection 62(1), the Bank may publish the names of applicants that submit applications during the transition period as well as any prescribed information in relation to those applications.
Starting on the day on which section 23 comes into force, that section does not apply to a payment service provider who submits an application during the transition period until the earlier of
the day on which the Bank notifies the payment service provider under subsection 25(2) that it has been registered; and