CanadaRetail Payment Activities Act, Notification of Incidents
Retail Payment Activities Act (S.C. 2021, c. 23, s. 177), ss. 2, 18, 19 and 76
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a payment service provider that performs retail payment activities, being an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity (reached by declaring that you are a payment provider).
- Without delay after you become aware of an incident that has a material impact on an end user, on another payment service provider that performs retail payment activities, or on a clearing house of a designated clearing and settlement system, notify that individual or entity and the Bank of Canada of the incident (section 18(1)).
- Give the notice in the prescribed form and manner and include the prescribed information (section 18(2)).
- Provide any follow-up notice the Bank of Canada orders you to give, to the individuals or entities, by the time, and in the form and with the information the order specifies (section 19).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Canada, which may assess a payment service provider's risk management and incident response framework and issue a notice of violation under the Act's administrative monetary penalty scheme.
Settledness
- As of
- Open questions
- What form, manner and information do the Retail Payment Activities Regulations prescribe for the incident notice?
What this law does
Section 18(1) of the Retail Payment Activities Act requires a payment service provider that performs retail payment activities, if it becomes aware of an incident that has a material impact on an end user, another payment service provider or a clearing house of a designated clearing and settlement system, to notify that individual or entity and the Bank of Canada of the incident without delay.
Section 2 of the Act defines an incident as an event or series of related events that is unplanned by a payment service provider and that results in or could reasonably be expected to result in the reduction, deterioration or breakdown of any retail payment activity that it performs. Section 18(2) of the Act requires the notice to be given in the prescribed form and manner and to contain the prescribed information.
Section 19(1) of the Act allows the Bank of Canada to direct, by order, a payment service provider that has given a notice to provide any follow-up notice that the Bank considers relevant. Sections 17 to 22 of the Act came into force on . Section 76(1) of the Act makes a contravention designated by regulation a violation that carries a penalty established in accordance with the regulations.
When LexLint raises it
When your app profile says your app is a payment provider.