Registration under the Retail Payment Activities Act
The Retail Payment Activities Act (the RPAA) regulates retail payment activities performed by payment service providers (PSPs) that employ or facilitate electronic funds transfers (EFTs). A key element of this supervisory framework recently came into effect: PSPs are required to register with the Bank of Canada (the Bank) as of November 15, 2024.
How does this impact your business? This commentary takes a broader look at questions to consider in determining if your business is subject to registration. For many of these businesses, their status as a PSP subject to the RPAA may not be obvious, and while the Bank has published a self-assessment tool, particular care should be taken by any business that initiates, facilitates or otherwise implements EFTs in retail transactions as a core part of their business.
We have previously considered registration requirements specifically relating to digital asset businesses in our Cassels Comment, “Cash, Card, or Crypto? How the RPAA May Impact Digital Assets Businesses” and will consider specific application to other finance businesses in subsequent articles.
Examining Supervisory Policy: Criteria for Registering Payment Service Providers
The Bank’s policy guidance provides that a business must register as a PSP under the RPAA if the following four statements are all true:
- You are a PSP, performing one of the payment functions identified in the RPAA as a service that is not incidental to any non-payment service or business activity.
- You perform retail payment activities.
- Your payment falls under the geographic scope of the RPAA, meaning that you have a place of business in Canada, or you both direct services at and perform services for individuals or entities in Canada.
- Your retail payment activities are not excluded from the RPAA. The performance of payment functions that are incidental to one or more of non-payment services or business activities are excluded from the RPAA.
Are You a PSP?
To qualify as a PSP, a business needs to perform at least one of the following payment functions:
- it provides or maintains an account that is held on or behalf of one or more end users;
- it holds funds on behalf of an end user;
- it initiates an EFT at the request of an end user;
- it authorizes an EFT or transmits, receives or facilitates instructions in relation to an EFT; and/or
- it provides clearing or settlement services.
For this analysis, “end user” means the persons at the beginning or the end of a retail payment transaction – the “payer” or the “payee.” For example, in a transaction where a person purchases movie tickets online, both the individual purchasing the tickets and the theatre selling the tickets would be “end users,” and the analysis of whether an entity qualifies as a PSP would be undertaken in respect to such entity’s relation to those end users, or their facilitation of the intermediating transaction steps.
Do You Perform Retail Payment Activities?
Once we have determined if an entity is a PSP, the second criteria is more straight forward. Under the RPAA a “retail payment activity” means any of the payment functions noted above that is performed in relation to an EFT that is made in a fiat currency or using a unit that “meets prescribed criteria.” If you have determined you are a PSP, and facilitate EFTs in a fiat currency, you meet this criteria. If, on the other hand, you are a PSP and facilitate EFTs in some value other than a fiat currency (including cryptos), further analysis is required to determine if your business satisfies this second criteria.
Is Your Business within the Geographic Scope of the RPAA?
Determining whether your business is within the RPAA’s geographic scope is driven primarily by two criteria. First, do you have a place of business in Canada? The Bank’s guidance provides that, in assessing this question, the Bank will look primarily at whether the entity has a physical location in Canada, is incorporated or formed in Canada, or has employees, agents or mandataries in Canada. Meeting any one of these criteria likely means that you have a place of business in Canada.
The second criteria is broader, and captures entities that, while not having a place of business in Canada, perform retail payment activities for end users in Canada and direct these activities to individuals or entities in Canada. The Bank’s published guidance suggests this will principally look at the provision of retail payment services for end users, at least one of whom is physically located in Canada.
The geographic component may be one of the trickier registration criteria to navigate. For example, the Bank’s published guidance also encourages foreign PSPs considering expanding into Canada to register under the RPAA (though notes that registration is not strictly required prior to commencing retail payment activities for end users in Canada). It is also unclear whether the “place of business in Canada” test is conducted on an enterprise level – for example, whether the Bank would consider a foreign PSP with a non-active Canadian subsidiary as having a “place of business in Canada.” We have sought clarification on this point, but the Bank has not provided a direct answer.
Is Your Business Otherwise Excluded From the RPAA?
The final registration criteria asks whether the business is otherwise exempt from the RPAA. While the RPPA provides a number of exemption categories (i.e., EFTs used to give effect to eligible financial contracts, EFTs made with a merchant instrument, internal transactions between affiliates, etc.) the most relevant exemption for most businesses will be where the retail payment functions are incidental to their primary business. For example, a captive finance business may meet all other criteria listed above, however as these companies’ primary business is to profit from interest and fees generated from the financing of purchases of a retail merchant’s goods, the supportive nature of their payment services may support an interpretation that the retail payment function is secondary and incidental in nature.
To identify whether a company is performing payment functions as an incidental service or business, the Bank offers the following further indicators:
- A payment function is likely not an incidental service or business activity if it directly generates revenues or provides a direct commercial advantage.
- If an end user can reasonably expect or understand to be receiving payment services when using or receiving the services you offer, this could indicate that the payment function is a distinct service and is not incidental to other non-payment services or business activities.
- Marketing or advertising the payment functions that you perform can indicate that you offer the payment functions as a separate service or business activity and therefore are not performed incidentally.
Further Analysis: Probing Complementary Case Scenarios
In addition to its supervisory policies and self-assessment tool, the Bank has published multiple hypothetical case studies illustrating circumstances where these criteria are or are not met. While these examples are not proscriptive, and do not substitute for legal advice, they can be helpful in making the baseline assessment of howl likely certain business activities are to fall in scope of the RPAA.
In one case scenario, a merchant decided to partner with a company to provide a financing solution that is offered directly to the merchant’s customers when purchases are made. The company’s revenues are solely generated from interest charged to the merchant’s customers on issued loans, rather than from fees charged to the merchant. As the company offers loans, it acquires information from the merchant’s customers in order to obtain a soft credit check. Customers will go on to repay their loans from the company in a series of scheduled payments.
In this example, the company’s function of providing or maintaining accounts on behalf of the merchant’s customers is incidental to the company’s lending services. The company is not in the business of facilitating payments between the merchants and their customers but makes money off the interest it is entitled to collect from the merchant’s customers. Revenues come directly from the company’s lending business. As such, the company is not a PSP under the RPAA and is not required to register with the Bank.
This scenario, supplemented by the self-assessment tool, may help an analogous business satisfy itself that the risk of it requiring registration under the RPAA is minimal. Business which are concerned that they may be subject to RPAA registration should review the Bank’s published guidance in particular for any analogous hypotheticals. In all circumstances, businesses uncertain as to whether they are in scope of RPAA registration should seek legal advice to assist in making a final determination.
If you have any outstanding questions about the RPAA and how it applies to your business, please do not hesitate to contact the authors of this article or any member of our Banking & Specialty Finance Group.