Inclusivity and resiliency through modern payment legislation, regulation and policy

Read Payments Canada’s submission to the Department of Finance consultation on upholding the integrity of Canada’s financial sector.

In October 2023, the Department of Finance launched the Consultation on Upholding the Integrity of Canada’s Financial Sector. The consultation sought views on how legislation, regulations and policies should respond to emerging financial sector trends and changes that may impact Canadians, national security, competition and the safety and integrity of the financial system.

The inclusion of changes to the Canadian Payments Act (CP Act) in the Fall Economic Statement and the publication of the Retail Payments Activities Act (RPAA) regulations are two important steps the Government of Canada has taken recently to evolve Canada’s financial system. Payments Canada welcomes these changes, as well as the opportunity to provide further input on the benefits of consumer-driven banking, digital identification, and measures to prevent authorized push payment fraud. 

Read the full submission below.

Written Submission to Finance Canada’s Consultation on Upholding the Integrity of Canada’s Financial Sector

Payments Canada welcomes the opportunity to provide input to the Government of Canada’s consultation on Upholding the Integrity of Canada’s Financial Sector. In fulfilling its mandate as the owner and operator of Canada’s national payment clearing and settlement infrastructure, Payments Canada envisions a payment ecosystem that is inclusive and resilient to support a thriving economy. We recognize the importance of adapting legislative and policy frameworks to address the evolving challenges and opportunities in the financial sector.

Overview

The evolution of digital payment technologies presents both opportunities and challenges for upholding the integrity of Canada’s financial sector. Innovations such as real-time payments, digital wallets and consumer-driven banking have the potential to enhance the convenience and efficiency of financial transactions. However, it is crucial to ensure that these developments do not unduly impact Canadians or compromise privacy and security. 

The increasing digitization of financial services introduces new considerations for national security. As digital payment methods become more prevalent, it is essential to strike a balance between promoting innovation and safeguarding against potential threats. As new players enter the payment ecosystem and the industry evolves, regulatory frameworks should be flexible enough to accommodate innovation while preserving a level playing field for all participants.

Payments Canada’s views on the government’s consultation

A. Consumer Protection

Market conduct
Consumer protection is crucial to instill confidence in and enhance the quality and accessibility of financial services. Effective legislation is critical to addressing these concerns for Canadians.

On November 22, 2023, the government released final regulations under the Retail Payment Activities Act (RPAA), which will make payment services safer and more secure for Canadians and businesses. Notably, the regulations provide clarity on when payment service providers (PSPs) will be required to register with the Bank of Canada and establish risk management and end-user fund safeguarding frameworks. We understand that these are the first phase of requirements intended to protect the payment ecosystem and consumers. 

We encourage the government to work with the ecosystem to further define measures to manage market conduct risk in retail payment activities. Payments Canada is similarly committed to working with members, stakeholders and regulators to ensure that any risks associated with market conduct and payment system participation are effectively managed within Payments Canada's rules framework.

Authorized push payment (APP) fraud
APP fraud is a growing concern in real-time payments. APP fraud occurs when a payor is manipulated into paying an unintended recipient or paying the correct recipient but does so under fraudulent or false pretenses. This is particularly challenging for real-time payments because these transactions are often fast and irreversible, making recourse difficult.

Confirmation of Payee (CoP) is a security feature that verifies that the payee’s details match the corresponding information held by its financial institution, thereby reducing the risk of misdirected payments and fraud. CoP services are particularly important in the Canadian financial sector, especially considering the increasing number of APP fraud incidents globally. Research suggests that five per cent of Canadian consumers and six per cent of businesses reported experiencing APP fraud.¹

In considering global approaches to APP fraud, it’s apparent that countries like the UK and Australia are leading the way in implementing CoP services and developing recourse policies for fraud victims. These jurisdictions are increasingly taking more directed policy approaches to address the growing risk of APP fraud. Canada can learn from these examples and adopt a multifaceted approach to APP fraud, including developing CoP best practices and technology, and establishing recourse policies for fraud victims.

Enhancing consumer protection in the financial services sector requires a balanced approach between legislative updates, technological adoption, and proactive policy measures. CoP services should be a baseline element in Canada’s strategy to combat APP fraud, supported by clear government directives and a strong legislative framework to protect consumers and maintain confidence in the financial sector. 

Managing fraud is a shared responsibility, where consumers, financial institutions, service providers, and payment system rules align with government regulations and legislation to manage risks. Government guidance could provide effective incentives and expectations for the ecosystem to follow. The Government of Canada should examine its potential role in guiding the payment ecosystem to ensure fraud risks are managed effectively.

B. Framework Modernization

Digital identification (digital ID)
As technology continues to advance, so do the risks associated with unauthorized access, identity theft, and fraudulent activities. A comprehensive digital ID framework offers a solution to these challenges by providing a secure and reliable means of authenticating and authorizing digital transactions. Strengthening user authentication mechanisms contributes to a more secure and resilient payment infrastructure and aligns with Canada’s national security priorities.

The implementation of a national digital ID framework contributes to cybersecurity resilience by adding an additional layer of protection against evolving cyber threats. In an environment where the confidentiality and integrity of sensitive financial information are imperative, digital ID provides a robust mechanism to authenticate and authorize individuals engaging in digital transactions, contributing to the overall security and resilience of payment systems. It can serve as a safeguard to fortify the resilience of payment and financial infrastructure.

Digital ID can assist payment service providers in meeting regulatory requirements, particularly in relation to anti-money laundering (AML) and know your customer (KYC) obligations. It facilitates real-time monitoring of transactions and activities, enabling the prompt detection and response to suspicious or high-risk activities. By leveraging automated processes and data analytics, a digital ID enables analysis of a breadth of information to verify customer identities (not to mention the facilitation of CoP). Digital ID facilitates consumer-driven banking by allowing customers to use consumer-driven banking services without having to visit a branch to first verify their identity and supports the data portability and customer consent aspects of consumer-driven banking. The transparency and traceability inherent in digital ID can build trust between financial service providers and their customers.

In considering global approaches to digital ID, the European Union (EU) has been at the forefront of digital identity developments with the recent launch of the European Digital Identity Wallet. This wallet aims to provide EU citizens with a secure and user-centric solution for accessing public and private services across borders. The focus on digital ID in the United States has intensified with discussions around a nationwide digital ID system. The United Kingdom is exploring options such as biometric authentication and mobile-based IDs. Australia launched its national digital identity system, MyGovID. While each country’s specific approach may differ, there are common themes, including a focus on user-centric design, privacy protection and interoperability that Canada can learn from as national digital ID standards are developed.

Government leadership is necessary to ensure a coordinated and standardized approach to implementing a digital ID in order to avoid fragmentation and foster interoperability among different systems. Implementation of a digital ID should align with the objectives outlined in Bill C-27, the Digital Charter Implementation Act, which provides a comprehensive framework for addressing digital issues, emphasizing the need for a secure and trustworthy digital environment. Digital ID is a fundamental component in achieving these objectives, and its integration into the payment ecosystem is a natural progression towards a more secure and resilient financial ecosystem.

The implementation of a digital ID framework is not just a technological necessity but a strategic imperative for enhancing national security in the Canadian payment ecosystem. We encourage the government to continue to advance its work on digital credential in alignment with the Digital Charter Implementation Act. Payments Canada is committed to collaborating with its members, stakeholders and regulators to advance this critical aspect of the evolving digital landscape to ensure the continued security and integrity of Canada’s payment systems.

Consumer-driven banking
In the 2023 Fall Economic Statement, the government announced its intention to introduce its legislative framework for consumer-driven banking in Budget 2024. This will enable consumers to securely and confidently access their financial data and safely use services that can help them improve their financial outcomes.

As the government moves forward to codify key elements of the consumer-driven banking framework, an important element will be the establishment of a governance framework similar to Payments Canada, with public policy objectives, strong stakeholder and industry input and government oversight to be effective in serving the needs of Canadians.

As a public purpose organization, Payments Canada has a 40-year track record in ensuring the safety and soundness of Canada’s national payment systems. Payments Canada has accomplished this by developing common industry rules and standards and driving industry collaboration with regulators and market participants. We have learned a lot about the issues and challenges the government could leverage to develop a consumer-driven banking framework, and we would be happy to share our learnings.

Conclusion

Payments Canada supports the government’s commitment to addressing the challenges and opportunities presented by emerging trends in the financial sector. We encourage ongoing collaboration between industry stakeholders and policymakers to ensure that regulatory frameworks remain adaptive, safe, effective and accommodate innovation.

The safety and integrity of the Canadian financial system hinges on effective risk management, regulatory oversight, and the resilience of critical infrastructure (including payment infrastructure). As new payment methods and technologies emerge, it is essential to take a balanced approach to assess the potential risk impact, while at the same time, promoting fair competition that safeguards consumer interests and encourages the responsible adoption of new technologies.

¹ Payments Canada: Canadian businesses and consumers more aware of payment fraud – but must remain cautious about mitigating risks. December 21, 2021