The Bank of Canada is urging thousands of digital payment companies to get on board with a new regulatory regime that starts rolling out this week, warning that it could take a tough line with businesses that fail to sign up.
Starting Nov. 1, payment service providers (PSPs) will need to register with the central bank, which has been tasked with overseeing the largely unregulated sector. These companies – which include point-of-sale software providers, payment apps and other “fintech” firms – will have two weeks to register. The new regulatory regime comes into force next September.
“The integrity of the whole regime depends on PSPs actually registering with us,” Ron Morrow, the Bank of Canada’s executive director of payments, supervision and oversight, said in an interview.
“It’s entirely possible that you could see public enforcement action from the bank relatively early in the new year for those who don’t register. I would like to think we’re not going to have to take enforcement action. But again, it feels a little naive to think that everything is just going to go swimmingly. We’ll see.”
Digital payment companies in Canada have long operated in a grey zone, moving billions of dollars around the economy with a fraction of the oversight governing banks and other financial institutions. In 2021, the federal government directed the Bank of Canada to develop rules for the industry, focusing on two pillars: Companies will have to maintain risk-management plans and will have to handle money in a way that protects client funds and keeps them separate from their own operating funds.
The new regulatory regime is a turning point for Canada’s fintech industry and could act as a catalyst for both growth and consolidation. Some companies will be able to use the regulatory stamp of approval to win new business and access broader banking networks. Registered PSPs will be able to use Canada’s long-delayed Real-Time Rail payment system, which is still under development and scheduled to begin industry testing in 2026.
Others companies may have to team up or shut down in response to the increased regulatory burden.
“I think the PSPs who register with the Bank of Canada are going to see a lot more wind in their sails in terms of their acceptability and their ability to strike partnerships,” said Abhishek Sinha, head of the technology strategy practice for financial services at EY Canada.
“There could also be consolidation between smaller players, just to get some scale so that they can survive,” he said, adding that venture capital backers may force the issue.
The Bank of Canada has identified more than 3,000 companies it believes are PSPs. These range from large businesses such as PayPal and Moneris to startups with a handful of employees focused on niche parts of the payments ecosystem, such as cross-border remittances.
“Some are very prepared, others not so much,” said Alex Vronces, executive director of Fintechs Canada.
Large companies with legal teams and experience operating in other regulated markets shouldn’t have a problem adapting to the new rules, Mr. Vronces said. But for many smaller companies, “this is going to be very new, and this is something they’re probably not paying attention to. And so I think this is going to be a pretty big pill to swallow.”
Ryan Yates, the chief executive officer of Apaylo Finance Technology – a digital payments company with about 25 employees that processes around $1.5-billion in payments each month – said his team has been preparing for the new regime for several years and will be ready when the doors open in November.
The biggest challenge, he said, has been figuring out how to meet the safeguarding requirements, which mandate that companies manage client funds so they are recoverable in the event of a bankruptcy. The Canada Deposit Insurance Corp. and its provincial counterparts insure deposits for banks and credit unions, but not for fintech firms.
“It’s almost like the regulatory guidance has matured faster than the product is available to support us,” Mr. Yates said. “We’re getting creative to solve that.”
The new regime will be principles-based, with the Bank of Canada outlining goals without spelling out exactly what companies need to do to meet them. Moreover, supervisors will be taking a “risk-based” approach, in which bigger, more sophisticated companies will be held to a higher standard.
“If you’re three people who developed an app out of a garage in Markham. … They know the risks they face in their business. They’re taking actions to mitigate those risks. What they’re going to have to do, though, is actually write that down,” Mr. Morrow said.
The most important thing, he said, is that companies register with the Bank of Canada by Nov. 15. After that, there’s a nine-month period in which companies will be vetted by the Department of Finance for national security purposes and will be able to refine their plans with input from a team of roughly 110 supervisors at the central bank.
“We’re not aiming to be a ‘gotcha’ regulator,” Mr. Morrow said. “Not everyone will be fully compliant on Day 1. … What we’re expecting is that people take a look at what they have in place, identify any gaps and take steps to address those gaps. If they’re doing that, that will work well for us as a regulator.”
If companies don’t sign up, they could be hit with a $10-million fine, named and shamed, and eventually barred from operating in Canada, Mr. Morrow said.
“We will not hesitate to follow up with those who don’t register,” he said.
Editor’s note: (Oct. 30, 2024): An earlier version of the article said that the Real-Time Rail payment system is scheduled to launch in 2026. Industry testing is scheduled to begin in 2026. No formal launch date has been announced.