Payments: A view from Canada

Canada is forging ahead of several international marketplaces with exponential growth in its eCommerce sector. The past year saw a marked shift in regulatory expectations for the Canadian payments industry, much of it signaling the direction in which eCommerce is headed.  In this article, we provide a brief outlook on key legal and regulatory developments in the Canadian payments industry, focusing on developments with respect to the evolving payments framework, the impact of the new anti-money laundering (AML) rules, and anticipated changes in the privacy and data protection regime.

Payments modernization

Canada is currently in the process of revolutionizing its payments infrastructure in the interest of ensuring quicker real-time settlements and more efficient payments processing. Its strategy for doing so has evolved over the years amid several iterations.  With the release of the Modernization Delivery Roadmap 2018 (the Roadmap) by Payments Canada (the organization that operates Canada’s payment clearing and settlement system), Canada has achieved some significant milestones, such as implementing a new credit risk model for the country’s retail payment system and significant enhancements to Automated Funds Transfer. Based on consultation with Canadian financial institutions members, stakeholders and regulators, the Roadmap reflects certain important developments with respect to the implementation of Canada’s new payments infrastructure:

• Appointment of a prime vendor for hosting and integrating Lynx. Lynx is a high-value payments system intended to replace the current Large Value Transfer System by 2022. It will be accessible only to regulated financial institutions for critical payments in real-time and having settlement finality. Lynx will be required to comply with applicable Bank of Canada risk management standards and will be designated as a Systemically Important Payment System. 
• The new real-time payments system (also known as Real-Time Rail, or RTR).  RTR is an payments system that will provide undisrupted payments that are final and irrevocable.  At launch the system will feature account number-based routing and ISO 20022 messaging to support data-rich payments. RTR is expected to launch this year in Canada.
• The current retail batch payments system. Formerly known as the Automated Clearing Settlement System, the revamped system will track the volume and value of payment items exchanged between participants and determine the balances due. The current rules and standards will likely be updated to detail how the exchange, clearing and settlement of all cleared payments must occur.

In our view, this year will see more significant efforts by Payments Canada to ensure delivery of the payments modernization agenda. Also, stakeholders in the payments industry, including new entrants, are expected to prepare for these developments and ensure their legacy systems are ready for an effective and smooth transition.

New Anti-Money Laundering (AML) rules

Canada’s payments industry is hugely impacted by its evolving financial regulatory landscape, particularly with the new AML rules that were recently introduced. Recently, the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations amended the definition of a money services business (MSB) by broadening its scope to include MSBs that are foreign-based but operate in Canada, as well as dealers in virtual currencies. As such, foreign entities with business involving the transfer of funds, foreign exchange dealing, issuance of redemption of negotiable instruments, or virtual currencies in Canada (including foreign digital currency exchanges) are now expected to register with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) by June 1, 2021. MSBs which deal in virtual currencies are expected to register with FINTRAC by June 1, 2020.

Similarly, certain entities that issue prepaid cards now have fresh AML obligations, such as record keeping, client identity requirements, and third party determination requirements.  The new AML rules  also introduce changes to beneficial ownership requirements, suspicious transactions reporting and screening protocols, which potentially impacts on payments industry participants in Canada. 

It is beyond the scope of this article to discuss these updates in detail.  Please see here for our detailed post on this.

Privacy and data protection

Canada recently launched its Digital Charter, as well as its National Digital and Data consultations, by publishing an accompanying paper entitled Strengthening Privacy for the Digital Age. The publication includes recommendations for amending the Personal Information Protection and Electronic Documents Act (PIPEDA), which is the over-arching federal statute that regulates private businesses, works and undertakings with respect to their collections, use and disclosure of personal information.

The Digital Charter articulates a principled approach to digital and data transformation, setting out ten principles to guide amendments to PIPEDA. Some of the proposed amendments include: (1) enhancing the control and transparency that individuals have over their personal information; (2) providing data mobility opportunities to support greater individual control over data and promotion of consumer choice; and (3) strengthening enforcement mechanisms, including enhanced penalties for non-compliance.

The proposed amendments to PIPEDA might well arrive this year. The Prime Minister’s Office recently released a mandate letter outlining a number of data protection initiatives, among which include increasing the power of the Office of Privacy Commissioner of Canada by adding the ability to award administrative monetary penalties, creating new offences, or providing additional oversight by the Federal Court of Canada. Other proposals in the mandate letter include establishing a new set of rights for individuals online and the right to be forgotten, creating new regulations for large digital companies to protect personal data and to create competition in the digital space.

If implemented, each of these amendments has the potential to effect a fundamental change in the way  payments industry participants in Canada collect, use, and disclose personal information. The amendments will move Canada closer to the rights-based data protection regime under the General Data Protection Regulation in the European Union (EU). This is particularly important because of the imminent sun-setting of PIPEDA’s adequacy decision by the EU, which allows for free data exchanges between the EU and Canada, with the exception of employee data and under certain conditions.