Canada – Ontario

Licensing, Authorisation & Market Access

The Bank of Canada published its first Retail Payment Activities Act enforcement decisions in August 2026. Every decision published to date concerns a breach of section 23 of the Act, the provision requiring registration before operating as a payment service provider, and every decision resulted in a zero-dollar administrative monetary penalty. This is a confirmed, uniform federal development that applies to all payment service providers operating in Ontario, as the Retail Payment Activities Act is a federal licensing regime with no provincial variant or carve-out. The zero-dollar penalty outcome across the full set of published decisions is itself the notable feature: rather than imposing a monetary sanction for unregistered operation, the Bank appears, on this initial evidence, to be using its enforcement powers principally to bring non-compliant providers into the registration regime rather than to punish past non-compliance.

For payment service providers operating in or into Ontario, the practical implication is that the registration requirement under section 23 is now being actively enforced in substance, even though the financial consequence of a first violation has so far been nil. This should not be read as evidence that the requirement itself is lightly enforced; being named in a published Bank of Canada enforcement decision carries reputational and operational consequences independent of the monetary penalty amount, and establishes a public compliance history against which future violations would likely be assessed more severely.

Outlook

Whether the Bank's zero-dollar calibration persists as more enforcement decisions are published is the central question for payment service providers assessing their registration timelines. A reasonable expectation is that this initial calibration reflects a grace period tied to the regime's early implementation phase, and that providers who remain unregistered as the regime matures should expect a harder enforcement posture, potentially including non-zero penalties, in subsequent decisions. Providers operating in Ontario without current Bank of Canada registration should treat the publication of these decisions as a clear signal that the registration requirement is being actively monitored and enforced, not merely a formality.

Licensing, Authorisation & Market Access

Ontario payment service providers operate under the federal Retail Payment Activities Act's registration regime, administered by the Bank of Canada with no provincial variance. The registration provisions began on November 1, 2024, opening a 15-day registration window that ran through November 15, 2024, for PSPs required to register with the Bank of Canada at that time. This registration requirement is the market-access gate for any entity conducting retail payment activities reaching Ontario, distinct from and additional to any provincial licensing that might apply to specific payment products.

The reporting obligation that flows from registration is now established and running: the first annual report to the Bank of Canada under section 18 of the Retail Payment Activities Regulations (SOR/2023-229) was due no later than March 31, 2026, covering PSP activity across calendar year 2025. This confirms the annual reporting cadence that registered PSPs must now follow going forward, and it represents the completion of the first full compliance cycle under the RPAA's reporting requirements.

Outlook

With the registration window long closed and the first annual reporting cycle complete, the market-access architecture for Ontario PSPs is now in steady-state operation. The item to watch is whether the Bank of Canada's supervisory practice, informed by the first round of annual reports, leads to any adjustments in registration or reporting requirements in future cycles.

Licensing, Authorisation & Market Access

Ontario's payment-services market access rests entirely on the federal Retail Payment Activities Act (RPAA); there is no separate Ontario-specific PSP licensing regime, and payment service providers operating in or into the province register directly with the Bank of Canada under the RPAA on the same terms as any other Canadian jurisdiction. The Bank of Canada's public PSP registry launched in October 2025, following the initial registration window that had opened November 1, 2024, and remains the operative access mechanism.

The material development this cycle is a scope expansion: Bill C-15, with Royal Assent March 26, 2026, amended the RPAA to bring encrypted and tokenized payment-instrument transmission within the statute's definition of 'payment function.' This directly enlarges the population of entities that must register as PSPs, capturing providers whose activity involves transmitting encrypted or tokenized payment instruments — a category that would otherwise have sat at the margin of, or arguably outside, the pre-amendment registration perimeter. The practical effect is to close what had been read as a potential gap through which tokenized or stablecoin-adjacent payment infrastructure providers might have avoided PSP registration obligations.

Both the underlying RPAA registration requirement and this cycle's scope amendment apply on a bank/non-bank-neutral basis in the sense that they are triggered by the payment function performed rather than the institutional type of the provider, though the RPAA's registration model has historically been most consequential for non-bank payment institutions and e-money issuers (nonbank_pi_emi), since federally-regulated banks are subject to separate prudential oversight. The amendment therefore has its most direct bite on non-bank entities engaged in tokenized or encrypted payment-instrument transmission that had not previously been captured.

Outlook

Watch for Bank of Canada implementing guidance on how the encrypted/tokenized-transmission criterion will be applied in practice, particularly at the boundary between traditional payment-instrument transmission and crypto-adjacent or stablecoin-adjacent activity. The population of newly-captured registrants under this amendment is not yet quantified in available sourcing, and clarifying guidance would materially affect compliance planning for platforms operating near this boundary.

Licensing, Authorisation & Market Access

The Bank of Canada's supervisory regime for payment service providers under the Retail Payment Activities Act (RPAA) has moved decisively into an active-enforcement phase this cycle. The RPAA establishes the legal framework for the Bank of Canada to supervise payment service providers, including setting out its supervisory responsibilities and powers, and came into force in stages beginning June 29, 2021, with registration requirements and Bank of Canada enforcement powers having come into force November 1, 2024. This is a Confirmed, T1-sourced finding drawn from the Bank of Canada's own published milestones page.

On June 12, 2026, the Bank of Canada announced that it will begin publishing Notices of Violation issued to payment service providers subject to the RPAA, in the Enforcement Decisions section of its website, where they will remain accessible for five years. This is a Confirmed finding as characterised by the sourcing, though it rests on a single T3 legal-commentary source without independent T1 corroboration this cycle. The practical effect is that PSP enforcement outcomes, previously handled without public visibility, will now be publicly disclosed and linked to the PSP's public registry entry, a substantial increase in transparency and reputational stakes for any PSP found in breach.

Alongside the enforcement-transparency development, PSPs face a concrete, already-binding reporting obligation: PSPs must submit an annual report to the Bank of Canada on risk management, incident response, insurance and guarantees, and end-user fund holdings, with the first annual report due no later than March 31, 2026 under the Retail Payment Activities Regulations. Non-compliance penalties range up to $10 million and extend to registration revocation, meaning the reporting obligation carries substantive enforcement exposure from its very first cycle, rather than functioning as a purely administrative formality. The bank-PSP versus non-bank payment-institution/EMI distinction is material here: these registration, reporting, and enforcement-transparency obligations apply to the non-bank PSP population that the RPAA was specifically designed to bring under supervision, distinct from banks' existing prudential oversight.

Outlook

The transition from a registration-and-registry-building phase toward public enforcement transparency, via the NOV publication announcement, is the clearest signal that the RPAA regime has matured past its establishment period. PSPs should expect enforcement outcomes to become a matter of public record going forward, and the March 2026 annual-reporting deadline establishes a recurring compliance rhythm with real penalty exposure that will likely intensify scrutiny in subsequent cycles.

Licensing, Authorisation & Market Access

The Retail Payment Activities Act is Canada's live, federal registration regime for payment service providers, with statute text current as of entries between June 14 and August 6, 2026, and last amended March 26, 2026. No Ontario-specific carve-out or sub-national variance has been identified: PSPs operating in or through Ontario are registered, supervised, and reported on entirely under this federal architecture, and there is no separate provincial licensing track running alongside it. This is the foundational market-access fact for any payment service provider assessing Ontario as an operating jurisdiction: the relevant licensing question is a federal Bank of Canada registration question, not a provincial one. The absence of any confirmed Ontario-specific RPAA carve-out is itself a meaningful market-access data point: an operator considering Ontario alongside other Canadian provinces does not need to model a separate provincial registration track, application timeline, or capital requirement distinct from the federal RPAA process.

Within that federal framework, RPAA-registered PSPs have, since September 8, 2025, been required to have established risk-management and end-user-funds-safeguarding frameworks in place, and to submit an annual report to the Bank of Canada; the first such annual report was due March 31, 2026. This safeguarding obligation is the substantive core of what RPAA registration requires in practice: a PSP's registration is not a one-time authorisation event but an ongoing supervisory relationship built around documented risk management, fund segregation, and annual reporting to the regulator. The annual reporting obligation to the Bank of Canada, now in its second cycle following the March 31, 2026 deadline, should be read as an ongoing compliance cost rather than a one-off registration cost.

The distinction between bank and non-bank market participants is worth stating explicitly: the RPAA's registration and safeguarding requirements apply specifically to payment service providers in the non-bank PI/EMI category, distinct from the prudentially-regulated bank population that operates under separate banking-supervision frameworks. Both populations are, however, drawn into the same federal PSP registration architecture where the RPAA applies, and evidence available this cycle does not indicate any bank-specific carve-out from the RPAA's registration scope. For market entrants weighing whether to pursue RPAA registration as a standalone payment service provider versus partnering with an already-registered bank or PSP, the practical safeguarding requirement is the same regardless of route, since it attaches to RPAA registration itself rather than to the entity's broader corporate structure.

Dated item. Effective March 28, 2026, Ontario's Financial Services Regulatory Authority restricted use of the "Financial Planner" and "Financial Advisor" titles to individuals approved by an FSRA-recognized credentialing body, a sub-national, Ontario-specific title-protection development distinct from the RPAA's federal PSP registration regime discussed above.

Outlook

Watch for the first cycle of annual safeguarding reports now that the March 31, 2026 deadline has passed, which should give the Bank of Canada, and by extension the market, its first substantive read on how consistently RPAA-registered PSPs are meeting the risk-management and fund-safeguarding standard in practice. In practice, Ontario's payment-services market access question this cycle is less about whether registration is available, the RPAA framework has been settled and operative since September 2025, and more about whether a prospective entrant can sustain the ongoing safeguarding and annual-reporting obligations that come with it.

Licensing, Authorisation & Market Access

Canada federal payments framework is undergoing its most significant restructuring since the Retail Payments Activities Act came into force. Bill C-15 received Royal Assent on March 26, 2026, repealing the original Consumer-Driven Banking Act, enacted as Part 1 in June 2024, and enacting a rebuilt Consumer-Driven Banking Act. The rebuilt Act shifts oversight of open banking from the Financial Consumer Agency of Canada to the Bank of Canada, consolidating open-banking supervision with the Bank of Canada existing role as supervisor of registered payment service providers under the Retail Payments Activities Act. This is a market-access development in the fullest sense: it determines which institution sets and enforces the accreditation criteria that govern who may participate in the open-banking ecosystem, bank and non-bank alike.

The practical detail of that market-access regime is now being defined through implementing regulations. Finance Canada published draft Consumer-Driven Banking Regulations in Canada Gazette Part I on June 27, 2026, opening a 60-day comment period. The draft regulations span six areas: accreditation, security, screening, authentication and consent, reporting, and technical standards. Together these define the operational bar that both bank participants and non-bank payment service providers or electronic money-style entrants will need to clear to be accredited under the rebuilt framework. The draft regulations quoted text describes the aim as introducing a secure framework overseen by the Bank of Canada, positioning the central bank as both prudential supervisor and open-banking market-access gatekeeper.

For market participants operating in or toward Ontario specifically, this federal restructuring is the entirety of the relevant regulatory picture: Ontario carries no independent provincial payments-licensing lever, so its payments-regulatory exposure runs entirely through federal Retail Payments Activities Act, Consumer-Driven Banking Act, and, prospectively, Stablecoin Act developments. The consolidation of open-banking oversight into the Bank of Canada therefore has a more direct and immediate effect on Ontario-facing institutions than it would in a jurisdiction with a parallel provincial licensing regime capable of absorbing or offsetting federal change.

The distinction between bank and non-bank participants is explicit in how this framework is being built: the draft regulations accreditation criteria apply across both categories, meaning both federally regulated banks and non-bank payment service providers registered under the Retail Payments Activities Act face the same forthcoming accreditation bar for open-banking market access, rather than a bifurcated standard. This is a notable design choice, since it avoids creating a structural incumbency advantage for banks already holding federal charters, at least on paper, pending the finalized detail of the accreditation criteria themselves.

Outlook

The 60-day comment period on the draft Consumer-Driven Banking Regulations closes August 26, 2026. That closure is the concrete near-term event to track, since it directly precedes finalization of the accreditation, security, and technical-standards criteria needed to bring the rebuilt Consumer-Driven Banking Act into force. Until finalization, prospective accredited participants, including non-bank entrants, are operating against draft rather than settled criteria, and the exact commencement timeline for the rebuilt Act beyond this consultation stage has not been confirmed this cycle.

Conduct, Safeguarding & Financial Promotions

Dated development. On June 12, 2026, the Bank of Canada announced it will begin publishing Notices of Violation issued to Retail Payment Activities Act-registered payment service providers, including violation nature and any administrative monetary penalty, in a public Enforcement Decisions register retained for five years. This conduct-transparency measure sits on top of PSPs' existing RPAA safeguarding and risk-management obligations rather than replacing them, and materially increases the reputational exposure attached to a confirmed violation. The development is sourced to a T3 legal-analysis account of the Bank of Canada's policy decision rather than to a directly retrieved primary press release this cycle.

Outlook

Watch for the first published Notice of Violation under the new register as the practical test of how much detail the Bank of Canada discloses, and treat any future PSP compliance failure in Ontario as now carrying a five-year public disclosure consequence in addition to any monetary penalty.

Operational Resilience & Critical Infrastructure

Operational-risk and incident-response framework requirements for Ontario PSPs took effect on September 8, 2025, alongside the safeguarding requirements under the Retail Payment Activities Act. This means registered PSPs have, since that date, been required to maintain operational-risk management and incident-response frameworks as a condition of their continued registration with the Bank of Canada, functioning as Canada's federal analogue to operational-resilience regimes seen in other jurisdictions.

This requirement arrived simultaneously with the safeguarding framework rather than on a separate timeline, meaning Ontario PSPs faced a single compliance deadline covering both fund-safeguarding and operational-resilience obligations at once on September 8, 2025. No provincial variance applies; this is a federal requirement administered uniformly by the Bank of Canada.

Outlook

With the operational-risk and incident-response framework requirements now over a year in force, the item to watch is whether the Bank of Canada's supervisory practice surfaces any incident-response events or operational-resilience findings in future cycles now that PSPs have had a full compliance cycle to establish these frameworks.

Legal & Litigation

Bill C-15 received Royal Assent on March 26, 2026, delivering two connected legislative changes relevant to Canada's payments legal landscape. First, it amended the RPAA's definition of payment function to capture encrypted and tokenized payment-instrument transmission, as detailed under Licensing, Authorisation & Market Access above. Second, and separately, the broader 2025 Budget Act expanded the Bank of Canada's statutory mandate to include stablecoin issuer supervision and oversight responsibilities connected to the Consumer-Driven Banking Act framework. Together, these represent a single coordinated legislative moment reshaping the institutional and definitional architecture of Canadian payments law, rather than two unrelated developments.

The Bank of Canada mandate-expansion finding currently rests on a single Tier-4 secondary source (a law-firm client alert), and has not yet been independently corroborated against primary statutory or Bank of Canada text; it is accordingly held at Probable confidence. Substantively, this mandate expansion is a legal-institutional development — it establishes where supervisory authority sits — rather than an already-operative conduct rule; the associated stablecoin supervisory framework itself is tracked separately and is not detailed here as it falls outside this module's remit.

No litigation activity relevant to Ontario or federal payments regulation was identified this cycle. The RPAA amendment itself is already in force per the horizon tracker, having taken effect with Royal Assent, while the Bank of Canada's expanded stablecoin-supervision mandate remains at an earlier stage of institutional and regulatory build-out.

Outlook

The key legal question going forward is how courts or the Bank of Canada itself will interpret the boundary of the amended 'payment function' definition in edge cases involving tokenized instruments that are not stablecoins in the strict sense. Watch also for whether the Bank of Canada publishes formal guidance clarifying the scope of its newly expanded mandate under the 2025 Budget Act, which would reduce the current reliance on secondary legal commentary for understanding the practical reach of that expansion.

Product Innovation & Market Development

Bill C-15, enacted as part of the Budget 2025 Implementation Act and granted Royal Assent on 26 March 2026, completes Canada's legislative framework for consumer-driven banking, more commonly known as open banking. The framework allows consumers and businesses to securely share their financial data with third-party providers within a regulated system, a foundational building block for a broader open-banking product ecosystem in Canada. This applies uniformly in Ontario as federal legislation, with no province-specific variant.

The same legislative package imposes new duties directly on banks that are material to product development and consumer-facing design. Banks will be required to maintain policies to detect and prevent consumer-targeting fraud, to report fraud data to the Financial Consumer Agency of Canada, and to allow customers to disable specific account features and adjust their own maximum transaction limits. Cheque-deposit funds-access rules are also being accelerated under the same package, shortening the time before deposited cheque funds become available to customers. Together, these measures represent a bundle of consumer-facing product requirements that banks operating in Ontario will need to build into their retail banking platforms, rather than a single discrete feature launch.

Outlook

The open-banking framework's completion at the legislative level is a necessary but not sufficient step; the practical rollout of data-sharing infrastructure, accreditation processes for third-party providers, and consumer-facing implementation of the new fraud-prevention and transaction-limit controls has not yet been evidenced this cycle and will be the substantive test of this framework's effect on Canada's payments product landscape. Banks operating in Ontario should expect a buildout period in which these legislative requirements are translated into operational product features, with the fraud-reporting and account-control duties likely requiring earlier implementation than the full open-banking data-sharing ecosystem.

Product Innovation & Market Development

Canada's open-banking framework entered an active implementation phase this cycle. The Consumer-Driven Banking Act, enacted through Division 9, Part 5 of Bill C-15, repealed the original Consumer-Driven Banking Act of June 2024 and replaced it with a comprehensive framework, moving supervisory oversight from the Financial Consumer Agency of Canada to the Bank of Canada. This is a structural governance change in its own right: it consolidates open-banking supervision within the same institution that already supervises Retail Payment Activities Act-registered payment service providers, rather than splitting oversight of adjacent payments and open-banking activity across two federal bodies. This transition also carries a rare-in-Canadian-context feature: the repeal-and-replace of an already-enacted statute, the original June 2024 Consumer-Driven Banking Act, within roughly two years of its own enactment, before its framework had reached full implementation.

Building on the restructured Act, proposed Consumer-Driven Banking Regulations were published in the Canada Gazette, Part I, on June 27, 2026. The proposed regulations set out accreditation requirements, security requirements including multi-factor authentication, consent requirements, record-keeping requirements, and breach-reporting requirements applicable to banks, payment service providers, and fintechs participating in the open-banking ecosystem. Screen-scraping, the practice of accessing account data through credential-sharing rather than a standardized data-sharing interface, is prohibited under the proposed framework. The prohibition on screen-scraping is also a competitive-dynamics signal: incumbents and accredited fintechs that build to the new standardized interface will have a compliant pathway to offer account-aggregation and data-driven services, while any existing screen-scraping-based service model faces a clear compliance deadline tied to the regulations' eventual finalization and coming into force. The public comment period on these proposed regulations runs through August 26, 2026, after which final regulations may be published.

For Ontario-based banks, payment service providers, and fintechs, this is a uniformly federal development: the Consumer-Driven Banking Act and its proposed regulations apply nationally, and no Ontario-specific variance or carve-out has been identified. For product and market-development teams at Ontario-based fintechs, the practical planning question this cycle is less about whether open banking will arrive, the legislative framework is now settled at the primary-legislation level, and more about exactly which accreditation pathway and security standard will apply once the regulations are finalized, since the proposed MFA, consent, and record-keeping requirements will shape both technical build requirements and go-to-market timing.

Outlook

The public comment period on the proposed Consumer-Driven Banking Regulations closes August 26, 2026. The accreditation, security, and screen-scraping provisions in the current draft are the ones most likely to be scrutinized by industry commenters and most likely to shape the final regulations; any material change between the proposed and final text on these points would be the clearest signal of how much of industry feedback the Bank of Canada incorporates. Market participants should also watch for the practical timeline between the regulations' finalization and the operational launch of accredited open-banking data-sharing.

Correspondent Banking, Settlement & Access

The design of settlement access for Canada's forthcoming Real-Time Rail establishes a clear asymmetry between bank and non-bank participants. Banks will be required to receive Real-Time Rail payments once the system goes live, but building out customer-facing sending services remains optional in the early stages of the rollout. Non-bank payment service providers and fintechs seeking direct access to the Real-Time Rail, rather than accessing it indirectly through a sponsoring bank, must pre-fund their accounts through Lynx, Canada's large-value payment system, and maintain sufficient settlement liquidity on an ongoing basis. This pre-funding condition is a material and distinct constraint for non-bank participants relative to banks, which do not face the same liquidity pre-positioning requirement given their existing access to central-bank settlement accounts.

This settlement-access architecture sits alongside, and will eventually interact with, Canada's existing Interac e-Transfer infrastructure. Interac e-Transfer's clearing-and-settlement infrastructure is targeted to begin migrating onto Real-Time Rail rails in Q1 2027, with further migration phases continuing into Q2 2027 and full transaction volumes for initial-phase participants targeted for Q3 2027. This migration timeline means the correspondent and settlement-access landscape for Canadian payments will continue evolving materially through 2027, well beyond the Real-Time Rail's initial Q4 2026 go-live.

The practical consequence for non-bank payment service providers in Ontario considering direct Real-Time Rail participation is that direct access carries a liquidity-management cost, the pre-funding and ongoing liquidity-maintenance obligation through Lynx, that must be weighed against the settlement-finality and operational-control benefits of bypassing a sponsor-bank relationship. Providers that continue to rely on sponsor-bank access will avoid this liquidity cost but remain dependent on their sponsor bank's own risk appetite and operational capacity, a de-risking exposure that has historically affected smaller payment service providers' access to Canadian settlement infrastructure.

Outlook

The phased migration of Interac e-Transfer onto Real-Time Rail rails through 2027 will be the key structural development to track in this domain over the coming year, as it will determine the pace at which Canada's existing peer-to-peer payments volume moves onto the new settlement infrastructure. For non-bank payment service providers, the decision between direct Real-Time Rail access with its associated Lynx pre-funding requirement, and continued indirect access through a sponsoring bank, will likely become a more pressing commercial decision as the Real-Time Rail's participant base and transaction volumes grow following the Q4 2026 go-live.