Canada – Ontario

Licensing, Authorisation & Market Access

The Retail Payment Activities Act is Canada's live, federal registration regime for payment service providers, with statute text current as of entries between June 14 and August 6, 2026, and last amended March 26, 2026. No Ontario-specific carve-out or sub-national variance has been identified: PSPs operating in or through Ontario are registered, supervised, and reported on entirely under this federal architecture, and there is no separate provincial licensing track running alongside it. This is the foundational market-access fact for any payment service provider assessing Ontario as an operating jurisdiction: the relevant licensing question is a federal Bank of Canada registration question, not a provincial one. The absence of any confirmed Ontario-specific RPAA carve-out is itself a meaningful market-access data point: an operator considering Ontario alongside other Canadian provinces does not need to model a separate provincial registration track, application timeline, or capital requirement distinct from the federal RPAA process.

Within that federal framework, RPAA-registered PSPs have, since September 8, 2025, been required to have established risk-management and end-user-funds-safeguarding frameworks in place, and to submit an annual report to the Bank of Canada; the first such annual report was due March 31, 2026. This safeguarding obligation is the substantive core of what RPAA registration requires in practice: a PSP's registration is not a one-time authorisation event but an ongoing supervisory relationship built around documented risk management, fund segregation, and annual reporting to the regulator. The annual reporting obligation to the Bank of Canada, now in its second cycle following the March 31, 2026 deadline, should be read as an ongoing compliance cost rather than a one-off registration cost.

The distinction between bank and non-bank market participants is worth stating explicitly: the RPAA's registration and safeguarding requirements apply specifically to payment service providers in the non-bank PI/EMI category, distinct from the prudentially-regulated bank population that operates under separate banking-supervision frameworks. Both populations are, however, drawn into the same federal PSP registration architecture where the RPAA applies, and evidence available this cycle does not indicate any bank-specific carve-out from the RPAA's registration scope. For market entrants weighing whether to pursue RPAA registration as a standalone payment service provider versus partnering with an already-registered bank or PSP, the practical safeguarding requirement is the same regardless of route, since it attaches to RPAA registration itself rather than to the entity's broader corporate structure.

Dated item. Effective March 28, 2026, Ontario's Financial Services Regulatory Authority restricted use of the "Financial Planner" and "Financial Advisor" titles to individuals approved by an FSRA-recognized credentialing body, a sub-national, Ontario-specific title-protection development distinct from the RPAA's federal PSP registration regime discussed above.

Outlook

Watch for the first cycle of annual safeguarding reports now that the March 31, 2026 deadline has passed, which should give the Bank of Canada, and by extension the market, its first substantive read on how consistently RPAA-registered PSPs are meeting the risk-management and fund-safeguarding standard in practice. In practice, Ontario's payment-services market access question this cycle is less about whether registration is available, the RPAA framework has been settled and operative since September 2025, and more about whether a prospective entrant can sustain the ongoing safeguarding and annual-reporting obligations that come with it.

Conduct, Safeguarding & Financial Promotions

Dated development. On June 12, 2026, the Bank of Canada announced it will begin publishing Notices of Violation issued to Retail Payment Activities Act-registered payment service providers, including violation nature and any administrative monetary penalty, in a public Enforcement Decisions register retained for five years. This conduct-transparency measure sits on top of PSPs' existing RPAA safeguarding and risk-management obligations rather than replacing them, and materially increases the reputational exposure attached to a confirmed violation. The development is sourced to a T3 legal-analysis account of the Bank of Canada's policy decision rather than to a directly retrieved primary press release this cycle.

Outlook

Watch for the first published Notice of Violation under the new register as the practical test of how much detail the Bank of Canada discloses, and treat any future PSP compliance failure in Ontario as now carrying a five-year public disclosure consequence in addition to any monetary penalty.

Product Innovation & Market Development

Canada's open-banking framework entered an active implementation phase this cycle. The Consumer-Driven Banking Act, enacted through Division 9, Part 5 of Bill C-15, repealed the original Consumer-Driven Banking Act of June 2024 and replaced it with a comprehensive framework, moving supervisory oversight from the Financial Consumer Agency of Canada to the Bank of Canada. This is a structural governance change in its own right: it consolidates open-banking supervision within the same institution that already supervises Retail Payment Activities Act-registered payment service providers, rather than splitting oversight of adjacent payments and open-banking activity across two federal bodies. This transition also carries a rare-in-Canadian-context feature: the repeal-and-replace of an already-enacted statute, the original June 2024 Consumer-Driven Banking Act, within roughly two years of its own enactment, before its framework had reached full implementation.

Building on the restructured Act, proposed Consumer-Driven Banking Regulations were published in the Canada Gazette, Part I, on June 27, 2026. The proposed regulations set out accreditation requirements, security requirements including multi-factor authentication, consent requirements, record-keeping requirements, and breach-reporting requirements applicable to banks, payment service providers, and fintechs participating in the open-banking ecosystem. Screen-scraping, the practice of accessing account data through credential-sharing rather than a standardized data-sharing interface, is prohibited under the proposed framework. The prohibition on screen-scraping is also a competitive-dynamics signal: incumbents and accredited fintechs that build to the new standardized interface will have a compliant pathway to offer account-aggregation and data-driven services, while any existing screen-scraping-based service model faces a clear compliance deadline tied to the regulations' eventual finalization and coming into force. The public comment period on these proposed regulations runs through August 26, 2026, after which final regulations may be published.

For Ontario-based banks, payment service providers, and fintechs, this is a uniformly federal development: the Consumer-Driven Banking Act and its proposed regulations apply nationally, and no Ontario-specific variance or carve-out has been identified. For product and market-development teams at Ontario-based fintechs, the practical planning question this cycle is less about whether open banking will arrive, the legislative framework is now settled at the primary-legislation level, and more about exactly which accreditation pathway and security standard will apply once the regulations are finalized, since the proposed MFA, consent, and record-keeping requirements will shape both technical build requirements and go-to-market timing.

Outlook

The public comment period on the proposed Consumer-Driven Banking Regulations closes August 26, 2026. The accreditation, security, and screen-scraping provisions in the current draft are the ones most likely to be scrutinized by industry commenters and most likely to shape the final regulations; any material change between the proposed and final text on these points would be the clearest signal of how much of industry feedback the Bank of Canada incorporates. Market participants should also watch for the practical timeline between the regulations' finalization and the operational launch of accredited open-banking data-sharing.