The Global Fintech’s Guide to Understanding Payments Regulatory Bodies in Canada

Canada has mature and complex financial regulations. This guide covers the key concepts any global fintech needs to know when operating in the great white north.

This is part two of a three part blog series that goes in-depth on the Canadian market and how global fintechs can profitably expand into Canada. Read part one, the Canada Expansion Field Guide for Global Fintechs.

—

‍

Key takeaways:

1. Canada’s payment landscape is governed by three primary regulatory pillars:
   
   1. RPAA (Retail Payment Activities Act): Managed by the Bank of Canada; regulates Payment Service Providers (PSPs) regarding operational safety, fund safeguarding, and operational risk management.
   2. FINTRAC: Canada’s financial intelligence unit overseeing Money Services Businesses (MSBs) to prevent Money Laundering (AML) and Terrorist Financing (ATF).
   3. Payments Canada: Owns and operates the country's core clearing and settlement infrastructure.
2. Ongoing compliance requires active governance across multiple regulatory bodies. RPAA mandates 24-hour incident reporting, 5-day advance notice for operational changes, and annual risk reviews. FINTRAC requires bi-annual registration renewals and reporting on transactions over $10,000 CAD..
3. Global fintechs expanding into Canada can bypass long timelines and high costs using the Sponsor Bank model with local orchestration partners. Foreign fintechs can gain immediate access to Canadian banking rails by partnering with a regulated local payments orchestration partner (like Cybrid) that manages compliance and the sponsor bank relationship on their behalf.

—

‍

Canada has opportunity for global fintechs, but profitability is made or broken depending on regulatory posture and setup.

While the cost and time of building a compliance posture in-house can make sense for massive global behemoths, nimble global fintechs are using a different approach: regulated local partnerships.

A regulated local payments orchestration partner owns and manages all the regulatory and compliance tasks, rapidly increasing speed to market and getting live in Canada.

What doesn’t change, though, is the necessity of understanding the various regulatory bodies, what they stand for, and what compliance actually looks like—that’s what this blog is all about.

‍

RPAA: Retail Payment Activities Act

‍

The RPAA is Canada’s federal oversight for payment service providers (PSPs) operating in the country, administered by an organization within the Bank of Canada.

Registration with the RPAA is a legal requirement for any payments company operating in Canada, whether directly or sublicensed through a payments orchestration partner, and registration covers both consumer and business use cases. All registered businesses are named on the PSP registry to make it easy for third parties to validate claims.

‍

The RPAA’s mandate

‍

The RPAA has a triple-pronged mandate. First is the safety of PSP operations. Second is putting in processes to safeguard user funds should any PSP become insolvent. And third is to support the broader operational resilience of Canada’s national payments ecosystem.

‍

How to become RPAA compliant

‍

Initial compliance with the RPAA requires a few different steps.

• Fees: An initial fee of $2,500 CAD opens up an account with the RPAA.
• Informational needs: Disclose business information (such as ultimate beneficial owner and key personnel), what payment activities your business performs, expected transaction volumes, and any FINTRAC registrations (explained more below).
• Safeguarding: Systems set up to safeguard user funds, for instance via segregated accounts, for benefit of (FBO) accounts, or named virtual accounts. You will also have to provide any third party risks, insurances, or guarantees that apply to user funds.
• Risk management and documentation: A documented risk management plan, requiring significant documentation about how you treat risk, define and mitigate it, and how or when you might outsource risk to a third party.  

‍

Ongoing RPAA compliance

‍

Registered PSPs are required to file reports annually and review risk management frameworks annually as well. Further, you must report all incidents to the Bank of Canada within 24 hours of it happening and give five business days’ notice before any material operational changes.

Companies are also required to pay annual dues and undergo routine independent audits to confirm your registration and ongoing compliance activities are real and valid.

Further information can also be found on the Bank of Canada’s FAQ page.

‍

FINTRAC: Financial Transactions and Reports Analysis Centre of Canada

‍

FINTRAC is the national financial crimes and intelligence organization in Canada. It supervises over 20,000 reporting entities with a primary focus on anti-money laundering (AML) and anti-terrorist financing (ATF) compliance.

Registration with FINTRAC is commonly referred to as Money Services Business (MSB) registration, and is a legal requirement for any foreign entity operating in Canada or offering services to Canadians. Unlike the RPAA, FINTRAC registration is free.

‍

FINTRAC’s mandate

‍

The goal of FINTRAC is to detect, deter, and prevent money laundering and terrorist financing from flowing through the country. It works to protect the overall integrity of Canada’s financial system to ensure that good actors can continue to operate. However, it is not a prosecutor—any crimes or issues it detects are referred to law enforcement.

‍

How to become FINTRAC compliant

Registration with FINTRAC is a three-step process:

1. Pre-registration forms with company information.
2. Full application including company ownership, criminal record checks, compliance documentation, and transaction volume information.
3. Submission to FINTRAC’s official portal.

‍

From there, processing takes three months on average, but can take longer depending on if there are follow up questions from the agency.

‍

Further, companies registered with FINTRAC must also demonstrate a five-part compliance program:

1. Compliance officer in place.
2. Written policies and procedures.
3. Risk assessment including commitment to KYC and identity verification methods.
4. Ongoing staff training program.
5. Two-year effectiveness review cycle.

‍

Ongoing compliance with FINTRAC

Reporting is obligatory for all transactions over $10,000 CAD, whether physical or virtual. However, reports must be kept on all transactions and made available within a few business days to authorities upon request. Finally, registration must be renewed every two years, which requires an independent review of your effectiveness plans.

‍

Payments Canada

Payments Canada is a public-purpose, not-for-profit body created under the Canadian Payments Act that owns and operates Canada's core clearing and settlement systems.

‍

Payments Canada’s mandate

The organization’s legislated mandate is to run safe, sound and efficient clearing and settlement infrastructure, manage credit, liquidity, and settlement risk to Bank of Canada standards, keep systems continuously available, and support public-policy goals like competition and innovation.

‍

Accessing the Payments Canada network

Direct membership is often the ideal end goal for fintechs because it allows direct access to Canada’s payment rails. However, this can be costly (with reserve balances and other fees) and take months or even years.

Instead, most foreign organizations prefer to operate under the sponsor bank model. If a bank with an existing membership in Payments Canada is willing to sponsor your business, you are granted de-facto access to Canada’s banking rails without official Payments Canada membership.

‍

Initial compliance with Payments Canada

‍

Whether seeking direct membership or operating under the sponsor bank model, there are some common requirements.

First is that your organization—or your local partner—must be registered with the RPAA and the Bank of Canada. From there, direct settlement with Payments Canada requires multiple reserve accounts be set up with significant deposits and collateral to cover payment activity and hedge against potential returns or fraud.

‍

Ongoing compliance with Payments Canada

‍

Organizations must pay an annual fee to be a member of Payments Canada, which sits at approximately $50,000 CAD ($35,000 USD). This is paid by the member (or sponsored member). If you’re working with a regulated local partner in Canada, they pay the fee and it is often included in their prices rather than directly passed on, though different partners may have different approaches.

Further, organizations must maintain ISO 20022 certification to hold membership in Payments Canada, whether direct or sponsored.

‍

Bank-regulating organizations

‍

Two other bodies impact payments in Canada, but do not directly regulate payments companies. However, foreign fintechs should be aware of how these bodies regulate banks in Canada, since those regulations will shape what banks are able to support (or not) for global fintechs operating in the country.

‍

FCAC: Financial Consumer Agency of Canada

‍

FCAC is Canada’s financial consumer-protection regulator. It supervises federally regulated banks and authorizes foreign banks to operate in Canada. It also works with payment card network operators in the country.

The FCAC’s key mandate is to protect consumers, increase financial literacy, and offer complaint escalation pathways for consumers. It can issue monetary penalties up to $10 million with public naming of organizations that break its rules.

‍

OSFI: Office of the Superintendent of Financial Institutions

‍

Similar to FCAC, OSFI regulates banks and other financial institutions in the country. However, it is also the primary regulator of insurance companies, making it distinct from other bodies in the country.

The primary mandate is to ensure the soundness of federally regulated financial institutions and pension plans; it operates on a risk-based supervision basis. Its rules focus on capital requirements, risk management frameworks, and other governance systems that keep banks and insurance companies stable in the country.

‍

How to launch payments in Canada

‍

If you are planning to build everything in-house or do work that resembles deposit taking and custody of customer funds, you need to be very familiar with the rules, regulations, and complexities of each governing body.

This is where working with a payments orchestration partner can accelerate speed to market and drastically reduce costs.

Because partners like Cybrid maintain all regulatory and compliance obligations, your required setup is much more streamlined—dropping implementation time from years to weeks. Further, all costs and burdens associated with compliance are amortized across all customers, meaning your net cost drops from millions of dollars down to the cost of a contract.

Expanding in Canada can be profitable, but only if compliance and regulatory complexities don’t gobble up your margins. Book a call with Cybrid to discuss your expansion strategy and see how we can be your Canadian payments infrastructure partner.