Is a payment provider, in Canada

Retail Payment Activities Act (S.C. 2021, c. 23, s. 177), ss. 2, 17 and 76 · Read the law's page

• This binds a payment service provider that performs retail payment activities, being an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity, and that has a place of business in Canada or, having none, performs retail payment activities for an end user in Canada while directing them at individuals or entities in Canada (sections 4 and 5). Among the providers it does not apply to are a bank, an authorized foreign bank in respect of its business in Canada, a credit union or caisse populaire, an insurer, certain trust and loan companies, the Canadian Payments Association and the Bank of Canada (section 9), and it does not apply to the retail payment activities that sections 6 to 8 exclude (reached by declaring that you are a payment provider).
• Establish, implement and maintain, in accordance with the regulations, a risk management and incident response framework that meets the prescribed requirements, to identify and mitigate operational risks and respond to incidents (section 17(1)).
• Give the Bank of Canada all assistance reasonably required to assess the framework, and provide the documents, information and access to data the Bank specifies (section 17(3)).

Retail Payment Activities Act (S.C. 2021, c. 23, s. 177), ss. 2, 18, 19 and 76 · Read the law's page

• This binds a payment service provider that performs retail payment activities, being an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity, and that has a place of business in Canada or, having none, performs retail payment activities for an end user in Canada while directing them at individuals or entities in Canada (sections 4 and 5). Among the providers it does not apply to are a bank, an authorized foreign bank in respect of its business in Canada, a credit union or caisse populaire, an insurer, certain trust and loan companies, the Canadian Payments Association and the Bank of Canada (section 9), and it does not apply to the retail payment activities that sections 6 to 8 exclude (reached by declaring that you are a payment provider).
• Without delay after you become aware of an incident that has a material impact on an end user, on another payment service provider that performs retail payment activities, or on a clearing house of a designated clearing and settlement system, notify that individual or entity and the Bank of Canada of the incident (section 18(1)).
• Give the notice in the prescribed form and manner and include the prescribed information (section 18(2)).
• Provide any follow-up notice the Bank of Canada orders you to give, to the individuals or entities, by the time, and in the form and with the information the order specifies (section 19).

Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 17, 18 and 136 · Read the law's page

• This does not bind anyone yet: the Act is not in force, and it binds a designated operator, being a person, partnership or unincorporated organization that belongs to a class of operators the Governor in Council adds to Schedule 2 in respect of a vital service or vital system named in Schedule 1 (telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within federal authority, banking systems, and clearing and settlement systems), reached by declaring that you operate an essential service, provide telecommunications services or provide financial services.
• Report a cyber security incident in respect of any of your critical cyber systems to the Communications Security Establishment, in accordance with the regulations, within the period the regulations prescribe, which may not exceed 72 hours (section 17).
• Immediately after reporting, notify the appropriate regulator that the report was made, in the form and manner the regulations prescribe, and give it a copy of the report (section 18).
• Keep records of every cyber security incident you reported under section 17 (section 30).

Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 7-9, 12, 15 and 137 · Read the law's page

• This does not bind anyone yet: the Act is not in force, and it binds a designated operator, being a person, partnership or unincorporated organization that belongs to a class of operators the Governor in Council adds to Schedule 2 in respect of a vital service or vital system named in Schedule 1 (telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within federal authority, banking systems, and clearing and settlement systems), reached by declaring that you operate an essential service, provide telecommunications services or provide financial services.
• Within 90 days after you become a member of a class of operators set out in Schedule 2, establish a cyber security program in respect of your critical cyber systems, with steps to identify and manage organizational cyber security risks, protect those systems from being compromised, detect cyber security incidents and minimize their impact (section 9(1)).
• Notify the appropriate regulator in writing, immediately after the program is established, that it has been established, and provide the program to the regulator within 90 days after you become a member of the class (sections 9(2) and 10).
• Implement the program by taking the steps it includes, and maintain the program (section 12).
• Review the program each year, or on the dates the regulations prescribe, and notify the appropriate regulator whether changes were made (section 13).
• Mitigate any cyber security risk in your supply chain or your use of third-party products and services as soon as it has been identified (section 15).