Towards safer payments: Payments Canada's key points in response to Bank of Canada's consultation
Payments Canada has responded to the Bank of Canada’s public consultation on draft supervisory guidelines for the Retail Payment Activities Act (RPAA).
This consultation sought feedback from the payment ecosystems on the following aspects of the proposed guidelines: the standards and practices on operational risk and incident responses, incident notification, safeguarding end-used funds and notice of significant change or new activity.
One of the points raised in Payments Canada’s response is the need for clarification regarding the definition of a third-party service provider. Payments Canada also recommends that the guidelines encourage payment service providers (PSPs) to consider the risk management standards set by the systems they participate in when creating their frameworks, especially for PSPs interested in becoming members of Payments Canada. Additionally, with respect to significant changes that may impact membership at Payments Canada or eligibility of a PSP to participate in its systems, Payments Canada suggests close collaboration and open dialogue with the Bank of Canada.
Payments Canada looks forward to the publication of the supervisory guidelines. The guidelines are an important step toward ensuring PSPs understand and meet their obligations under the RPAA, a legislative framework that assigns the Bank of Canada the responsibility of supervising payment service providers in Canada. The combination of the RPAA, expected to come into force in November 2024, and the announced plan to change the Canadian Payments Act will enable Payments Canada to safely broaden participation on their systems, including the forthcoming Real-Time Rail.
Submissions to this consultation closed on May 21, 2024.
Read Payment Canada’s submission below.
Written comments to the Bank of Canada’s consultation on the draft supervisory guidelines for the Retail Payment Activities Act
Payments Canada welcomes the opportunity to comment on the Bank of Canada’s proposed supervisory guidelines for payment service providers (PSPs) subject to the Retail Payment Activities Act (RPAA).
Overview of Payments Canada
Payments Canada underpins the Canadian financial system and economy by owning and operating national clearing and settlement systems1, including associated systems, by-laws, rules and standards. In pursuing its legislative mandate, Payments Canada has a duty to promote the efficiency, safety and soundness of its clearing and settlement systems and take into account the interests of users. Payments Canada is accountable to the Minister of Finance in carrying out its mandate. In support of its objects and duty, Payments Canada strives to enable a Canadian payment ecosystem that is resilient, inclusive and enables fair competition and innovation.
To address the evolving needs of Canadians, Payments Canada is engaged in the modernization of Canada's payment clearing and settlement systems, as well as the associated regulations, rules and standards. A central objective of this modernization effort is to establish transparent and risk-based criteria for participation in Payments Canada's systems to ensure fair and open access.
Comments on Draft Supervisory Guidelines
As the Federal government announced its intention to expand entitled membership in the Canadian Payments Act to, amongst others, PSPs as defined under the RPAA, Payments Canada is reviewing its legal framework to determine whether changes are required to support expanded membership. Members of Payments Canada must comply with the requirements of the Canadian Payments Act and the associated regulations, by-laws and rules. The regulatory framework established by the RPAA will help promote public confidence in PSPs and the issuance of supervisory guidelines will assist PSPs with meeting the requirements of the RPAA and its regulations.
Operational risk and incident reporting: responsibilities surrounding third-parties
Payments Canada is supportive of the efforts made in the Bank’s supervisory guidelines to clarify and emphasize the importance of PSPs in managing their relationships with third-party service providers as defined in the RPAA. However, Payments Canada encourages the Bank to further consider and clarify its expectations of PSPs relative to certain third parties that would not be captured by the definition of a third-party service provider.
Payments Canada’s clearing and settlement systems have been designated by the Bank of Canada as systemically important (Lynx) and as a prominent payment system (ACSS), which brings them under the oversight of the Bank of Canada under the Payment Clearing and Settlement Act (PCSA).
Payments Canada does not have written contracts with its members, but rather, members' (and participants’) obligations are established in Payments Canada’s regulations, by-laws, rules and standards. As Payments Canada will not have written contracts with PSPs, it would not be considered a third-party service provider as defined under the RPAA. The term third party, referenced in the RPAA Regulations and defined in the draft supervisory guidelines, appears to cast a wider net to include “financial market infrastructures (also known as clearing and settlement systems)2” (even without written contracts). This would appear to capture Payments Canada’s clearing and settlement systems. It may prove challenging, depending on the circumstance, for a PSP to manage its “third party” where that third party is a financial market infrastructure with an established legal framework. The Bank may wish to consider whether it is appropriate for PSPs to be required to oversee third parties that are already subject to regulatory oversight.
Considering system requirements in operational risk frameworks
Payments Canada appreciates that the standards for risk management set out in the RPAA and the supervisory guidelines allow for a risk-based, proportional approach. While acknowledging the value of this proportional approach to risk management for PSPs, Payments Canada recommends that the guidelines on “Operational Risk and Incident Reporting” encourage PSPs to also consider the risk management standards set by the systems they participate in, or plan to participate in, when creating their frameworks. This is particularly relevant for PSPs who are interested in becoming members of Payments Canada to participate in Payments Canada’s systems as system participants will be required to meet certain operational, security and technical requirements notwithstanding what they may have included in their operational risk management framework as required by the RPAA.
Notice of significant change or new activity: impacts on registration
Payments Canada supports the guideline on notice of significant change or new activity. The notification process is key in enabling the Bank of Canada to assess potential impacts on operational risk management and the safeguarding of end-user funds and whether those applicable frameworks remain appropriate.
Payments Canada recommends that the Bank of Canada take into consideration the impact that a significant change or new activity may have on a PSP’s registration status, particularly if that PSP is a member of Payments Canada. Given the interconnection of membership at Payments Canada and the RPAA, Payments Canada suggests close collaboration and open dialogue between itself and the Bank of Canada, including with respect to significant changes that may impact membership or participation eligibility at Payments Canada.
Conclusion
Healthy competition in payments is a catalyst for innovation that will lead to improved payment products, services and experiences for Canadians and Canadian businesses and will support Canada’s competitiveness globally. The proposed supervisory guidelines are an important step toward ensuring PSPs are able to understand and meet the obligations set under the RPAA.
Payments Canada looks forward to the publication of the final supervisory guidelines as well as any further guidance issued by the Bank of Canada.
1 Regulatory oversight of designated clearing and settlement systems
2 “third party: Parties that a payment service provider (PSP) has a contract with, as well as those that it does not, depending on the PSP’s business arrangements and organizational structure. Examples include: third-party service providers; agents and mandataries; affiliated entities; other PSPs; financial market infrastructures (also known as clearing and settlement systems)” Operational Risk and Incidence Response, Appendix A: Glossary.
