RPAA One Year In: What PSPs Should Be Doing Next

Written with David Vijan

A year has passed since the Bank of Canada (BoC)’s operational framework for payment service providers (PSPs) came into force under the Retail Payment Activities Act (RPAA) and Retail Payment Activities Regulations (RPAR) – collectively referred to as Retail Payments Supervision (RPS). A year ago, the focus for many PSPs was documenting operational risk and creating incident response and safeguarding frameworks. The first year has made something else clear, RPS compliance is not a one-time implementation project. It is an ongoing operating discipline and there are still PSPs without the appropriate processes in place.

A reminder: if your business performs any of the five payment functions listed below, the RPAA applies to your business, and you should already be registered with the BoC and have an operational risk and incident response framework in place.

• The provision or maintenance of a payment account;
• The holding of end-user funds until withdrawn or transferred;
• The initiation of a payment at the request of an end-user;
• The authorization of an electronic funds transfer, transmission, reception, or facilitation of a payment message;
• The clearing or settlement of payment transactions.

Registered PSPs have now completed the first annual reporting cycle, and the Bank has begun publishing enforcement decisions and conducting supervisory activities. As PSPs enter year two, the priority shouldn’t be whether you have a framework but rather, whether you can demonstrate that the framework is implemented, tested and working.

PSPs remain responsible for maintaining an operational risk and incident response framework that addresses their payment activities, associated systems, data, information and business processes. PSPs that hold end-user funds must also maintain compliant safeguarding arrangements if they hold customer funds (which still seems to be a gap for many PSPs).

BoC has updated its FAQs, which reinforce that responsibility rests with each PSP in the payment chain. An organization is not relieved of its obligations because another party is registered, because it earns no revenue from the payment function, or because a related payment passes partly through an excluded or designated system. The scope needs to be assessed at the level of the payment functions actually performed.

What Should PSPs Plan For In Year Two?

Testing and Internal Review

First, for any PSPs (registered or on the application list) that do not yet have an operational risk and incident response framework in place, you should address this immediately.

For PSPs with frameworks in place, year two is about demonstrating that they remain current and effective. One of the most immediate year-two requirements is the annual internal review. Under section 8 of the Retail Payment Activities Regulations, PSPs must review their operational risk and incident response framework at least once each year and before making material changes to their operations or risk-management systems, policies, procedures, processes or controls.

The review must assess regulatory compliance, the framework’s effectiveness, and the adequacy of technology, human and financial resources. If your business is subject to a SOC 2 audit, this will help test your business continuity and disaster recovery plans. Some PSPs have opted for a gap analysis review of their framework with a third party in order to analyze areas for improvement. Regardless of how you conduct this review, it must get done on an annual basis.

Annual Reporting

PSPs that completed the first annual reporting cycle should already be planning for the next one. As the first report covered only a partial compliance period, the next report will provide a more complete picture of each PSP’s compliance.

The first reporting cycle highlighted the importance of collecting regulatory data throughout the year. Depending on the PSP’s business, annual reporting covers five main areas:

• Operational risk and incident management, including risk categories, reliability targets, resources and incident-response capabilities;
• Safeguarding of end-user funds, including the safeguarding method and any shortfalls identified during the year;
• Significant changes and incidents, including material changes to operations, technology, outsourcing or safeguarding arrangements;
• Ubiquity and interconnectedness metrics, including payment volumes, end users, funds held and services provided to other PSPs; and
• Financial information and record-keeping, including revenue, operating expenses and equity.

The practical lesson is straightforward: annual reporting should be treated as an output of the compliance framework, not a once-a-year data call. PSPs should assign responsibility for each reporting area, document their methodologies and scope decisions, and reconcile reported information against their operational systems and previous regulatory submissions.

Enforcement

In June 2026, BoC began publicly enforcing the RPS through the first notice of violation seen under the regime. These initial decisions involved PSPs performing retail payment activities without being registered. Although this is classified as a very serious violation and can attract a penalty of up to $10 million, the initial cases resulted in $0 penalties. In several cases, the Bank noted that the PSP had taken steps to comply and mitigate potential harm by submitting a registration application.

While these first few cases resulted in $0 penalties, these decisions should not be viewed as a grace period. They remain public for five years and may affect a PSP’s reputation and regulatory history, and could influence future enforcement even with other agencies (i.e. FINTRAC). This is clearly sending a message that BoC is ready to enforce.

BoC has also contacted many PSPs directly to request documentation and other information demonstrating compliance with their operational risk and safeguarding obligations. It has further demonstrated that it will act urgently where end-user funds may be at risk, temporarily stopping one PSP from performing retail payment activities because of safeguarding concerns.

Independent Reviews

While there is some time, PSPs should begin planning for the independent reviews that may be required by September 2028. PSPs that hold end-user funds must obtain an independent review of their safeguarding compliance at least once every three years. A three-year independent review of the operational risk and incident response framework is also required where the PSP has an internal or external auditor.

Ahead of the first formal independent review, PSPs are encouraged to conduct an internal gap analysis to confirm that their frameworks address all regulatory requirements, include expected methodologies, and to resolve any deficiencies before commencing an independent review. Such gap analysis should confirm the PSP’s methodology for identifying material incidents, particularly as BoC has indicated that it is receiving fewer incident reports than expected.

In preparation for an independent review, PSPs may want to source external auditors who can perform this service for them, budget accordingly, and ensure they secure their place to commence the review within the required timeframe.

This review must cover how the PSP identifies and manages risks, monitors its systems and payment activities, responds to incidents, oversees third parties, trains staff, and reviews and tests the framework. PSPs that hold end-user funds must also have an independent review of their safeguarding arrangements at least every three years, including how funds are protected, tracked and made available to end users, and how any shortfalls are identified and addressed.

In Summary

RPS has moved from implementation to supervision. For PSPs, the work now is to make the framework part of daily operations, and to be ready to demonstrate that it works and has been implemented effectively when the Bank asks. Ensure that any inquiries from BoC are responded to within the requested timeframe.

If you haven’t already finalized your framework, need advisory on internal testing/gap analysis, or want to start planning for your independent review, Outlier is here to help, so please get in touch.