Canada’s first year of retail payments supervision has brought intervention over safeguarding concerns, public enforcement for operating without registration, and a first annual reporting cycle. One of those enforcement cases involved a UK firm. For payment service providers with Canadian customers, attention is now turning to whether the arrangements put in place for the new regime actually work.
The Bank of Canada began supervising operational risk management and safeguarding under the Retail Payment Activities Act (RPAA) on 8 September 2025, after registration opened in November 2024. This September marked the first full year of supervision.
The public record gives an early view of the Bank’s approach: enforcement against firms operating without registration, intervention where customer funds were considered at risk, and further clarification of implementation questions. That is enough to identify priorities for boards and compliance teams, but too early to draw firm conclusions about compliance across the sector.
REGISTRATION: UK STATUS DOES NOT REMOVE CANADIAN OBLIGATIONS
As of late August, all nine published notices of violation concerned operating without registration, and each carried a zero-dollar administrative monetary penalty. Equals Money PLC, a UK-based PSP, is one of them. It asked the Bank to withdraw its notice and issue a warning instead. The Bank confirmed the notice and the zero-dollar penalty.
A zero-dollar penalty is not a clean outcome. Operating without registration is classed as a very serious violation, for which penalties of up to C$10 million are available. Published decisions remain on the Bank’s website for five years and are noted on the firm’s registry entry. Several decisions recognised that firms had applied for registration and mitigated potential harm, which suggests prompt corrective action influences the outcome. It is not a safe harbour, and the Bank has not said how it will approach future cases.
The Equals case also shows the regime’s international reach. Foreign firms can fall within scope when they perform retail payment activities for Canadian end users and direct those activities at Canadian individuals or entities, subject to statutory exclusions. Authorisation elsewhere does not replace Canadian registration. Firms may also have separate Canadian obligations outside the RPAA, such as FINTRAC registration, which should be assessed alongside it.
Perimeter assessments should be refreshed as payment functions, products and commercial relationships change.
SAFEGUARDING: AN EARLY TEST OF SUPERVISORY INTERVENTION
The most consequential public intervention concerned XTM. On 17 February 2026, the Bank issued a temporary order requiring XTM to stop retail payment activities, citing concerns that end-user funds had not been safeguarded. On 27 February, after XTM obtained creditor protection and the court appointed a monitor, the Bank issued a revised order allowing activities to resume under the monitor’s oversight and subject to conditions.
The case shows how quickly safeguarding concerns can affect a firm’s ability to operate. Management should be able to explain how customer entitlements are identified, how funds are protected and how they would be returned if the firm became insolvent.
The Bank has clarified that holding funds at a deposit-insured financial institution is not sufficient on its own. Deposit insurance protects against the failure of the account provider, not the insolvency of the PSP. It also expects a written legal opinion on the validity of express trust arrangements as part of its safeguarding assessments.
In our view, safeguarding deserves particular scrutiny in the second year. Legal documentation, account operation and customer records must all support the same arrangement. Gaps between them can undermine protection even where a firm has a designated account and a written policy.
TRUST ARRANGEMENTS AND THE TAX QUESTION
An important development concerns the potential tax consequences for PSPs that safeguard funds in trust while retaining interest income. In December 2025, the Bank reported Finance Canada’s intention to amend tax legislation to address them.
The Bank continues to expect valid trust arrangements and appropriate legal advice. It acknowledged that some PSPs may need more time, while seeking evidence of steps towards compliance within a reasonable period.
This issue links safeguarding with treasury practice and the economics of holding customer balances. Firms should know who is entitled to the interest, how their documentation deals with it, and whether retaining that income affects the validity of the arrangement. Legal and tax advice, from Canadian counsel, should inform implementation alongside operational design.
OPERATIONAL RISK: RECURRING REVIEW AND SUPPLIER OVERSIGHT
The regulations require an annual review of the operational risk and incident response framework, testing, and annual board approval where a board exists. Relevant third-party providers must be assessed at least annually and before specified contractual changes.
The Bank’s clarification that banks may be third-party service providers matters for PSPs that rely on them for accounts, settlement or operational support. A bank’s regulated status can inform the assessment, but responsibility for the arrangement stays with the PSP.
The first anniversary is a good point to ask what these recurring activities have delivered. Reviews should reflect changes in the business, testing should expose weaknesses, and supplier assessments should inform decisions. Management also needs a clear record of findings, ownership and remediation.
Independent safeguarding reviews are required at least every three years. The independent review requirement for operational risk applies where a PSP has an internal or external auditor.
REPORTING AND THE NEXT PHASE OF SUPERVISION
The first annual reporting cycle covered 2025, with a deadline of 31 March 2026. The Bank uses these submissions to support risk-based supervision and may request further information. Its June reminder reinforced ongoing notification and reporting obligations.
Firms should expect to have to substantiate their submissions. A useful second-year check would trace reported information back to records, review materiality decisions, and confirm that business changes reach the people responsible for regulatory notifications. The reminder does not itself indicate widespread reporting failures.
There is also a commercial opportunity. Registered PSPs can apply for Payments Canada membership and participation in the Real-Time Rail, subject to further requirements. Greater participation will require firms to consider the operational capabilities behind their ambitions.
THE UK COMPARISON: SHARED PRIORITIES, LOCAL OBLIGATIONS
International groups will recognise comparable UK priorities. The FCA’s strengthened safeguarding regime took effect on 7 May 2026. New operational incident reporting requirements, and material third-party arrangement reporting for authorised payment and e-money institutions, follow on 18 March 2027.
Group governance, testing and supplier oversight can serve both markets. Safeguarding legal arrangements, reporting triggers and assurance requirements still need local assessment.
QUESTIONS FOR THE BOARD.
- Have we assessed within the last twelve months whether any of our activities fall within the RPAA, including through group entities and commercial partners?
- Can we show that our safeguarding legal documentation, account operation and customer records describe the same arrangement, and do we hold the legal opinion the Bank expects?
- Who owns Canadian notification and reporting triggers, and how do business changes reach them?
- Where we rely on banks or other suppliers in Canada, what has the assessment told us and what has changed as a result?
Cosegic works with firms operating across borders to assess their implementation gaps and build proportionate assurance across their UK and Canadian operations. This article is for general information and is not legal advice.
