CanadaRetail Payment Activities Act, Operational Risk Management and Incident Response Framework
Retail Payment Activities Act (S.C. 2021, c. 23, s. 177), ss. 2, 17 and 76
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a payment service provider that performs retail payment activities, being an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity (reached by declaring that you are a payment provider).
- Establish, implement and maintain, in accordance with the regulations, a risk management and incident response framework that meets the prescribed requirements, to identify and mitigate operational risks and respond to incidents (section 17(1)).
- Give the Bank of Canada all assistance reasonably required to assess the framework, and provide the documents, information and access to data the Bank specifies (section 17(3)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Canada, which may assess a payment service provider's risk management and incident response framework and issue a notice of violation under the Act's administrative monetary penalty scheme.
Settledness
- As of
- Open questions
- What requirements do the Retail Payment Activities Regulations prescribe for the framework, and do they reach cyber security as an operational risk?
What this law does
Section 17(1) of the Retail Payment Activities Act requires a payment service provider that performs retail payment activities to establish, implement and maintain a risk management and incident response framework that meets prescribed requirements, for the purposes of identifying and mitigating operational risks and responding to incidents.
Section 2 of the Act defines an operational risk as a risk that a deficiency in the payment service provider's information system or internal process, a human error, a management failure or a disruption caused by an external event will result in the reduction, deterioration or breakdown of retail payment activities. Section 17(2) of the Act allows the Bank of Canada or a person it designates to assess the framework and to provide the payment service provider with a list of corrective measures.
Section 2 of the Act defines a payment service provider as an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity. Sections 17 to 22 of the Act came into force on . Section 76(1) of the Act makes a contravention designated by regulation a violation that carries a penalty established in accordance with the regulations.
When LexLint raises it
When your app profile says your app is a payment provider.