Online payment services have exploded and the Bank of Canada is cracking down to protect consumers—but first it has to figure out who, exactly, it’s cracking down on.

Starting Nov. 1, non-bank businesses that make money from payment services will have to register with the central bank under a sweeping new regulatory regime designed to safeguard against company failures, hacks and other risks. The institution estimates the regime will capture about 3,000 companies.

But in a world where everyone from a hobbyist crocheter with an Etsy side hustle to a Big Tech giant has a business that involves online payments, determining who’s in scope and who’s not is a big, complicated job.

“There’s been a fair bit of confusion,” said Amber D. Scott, co-founder and chair of Outlier Solutions, a Toronto-based compliance consulting firm for financial services businesses. “Businesses may not necessarily be aware of this legislation.”

For decades, regulators around the world have been keeping an eye on the rise of non-bank companies offering payment services, a phenomenon catalyzed by the internet. As fintechs like PayPal made it easier and faster to send money around the world and enabled the rise of e-commerce, they also put a crucial function of the financial system—and stewardship of consumers’ money—outside the control of federally regulated institutions.

In 2021, the federal government introduced legislation expanding the Bank of Canada’s mandate to include oversight of companies processing payments in Canada, or handling payments on behalf of Canadian consumers. It joins Australia, the European Union, the United Kingdom and the United States in implementing or proposing similar oversight.

Brigitte Goulard, a fintech lawyer at the Toronto-headquartered firm Torys, said existing consumer legislation around fees and lending covers some of these companies’ activities, but central bank oversight of the companies themselves is new. Affected businesses must meet standards for safeguarding user funds, mitigating risks and reporting incidents—requirements designed to avoid disasters like the collapse of U.S. fintech Synapse in May, which locked more than 100,000 Americans out of accounts with US$265 million in deposits.

“If you had money in a wallet with a payment service provider, and the provider went down, that was it. Your money was gone,” Goulard said. “There was no security on that money.”

Whether a firm holds funds on behalf of a customer is one function the Bank of Canada will look at when determining who should register. So are transferring funds electronically upon request, and holding personal information for the purpose of future transactions. Internal transactions and transactions related to investment assets are excluded, as are “incidental activities”—payment functions that are necessary to support a non-payment business.

That exemption would appear to exclude the Etsy crocheter, but from there things get complicated. Credit cards are typically issued by banks, and banks are excluded, but what about a card that offers rewards tied to another payment platform? Cryptocurrency transactions are excluded, but what about exchanging bitcoin for dollars?

“It is complex and challenging,” said Nikil Chande, the Bank of Canada’s senior director of registration and enforcement for the regime. “That’s why we put so much time and effort and energy into spreading the word.” 

Chande pointed to the step-by-step guide the institution has published to help businesses understand whether they need to register. The central bank is hosting a webinar in October where business operators can ask questions, he noted, and has directly reached out to companies that might fall within the new rules to make sure they’re aware of the deadlines.

The Bank of Canada has also published examples in case-study form to help businesses determine whether they have to register. Based on that guidance, a coffee shop that issues a prepaid card for use at its own store would not need to. A company that provides basic accounting software doesn’t need to register, but if it adds functionality that lets clients issue invoices that include a “pay” button it powers, it does.

International firms that provide payment services for Canadians are affected, which would include some of Silicon Valley’s biggest companies. Chande said the Bank of Canada is aware that some Big Tech firms are offering payment services in Canada, and if those services fall under the regime, “then yes, we would absolutely expect them to register.”

Apple, Google and Samsung—which all have payment apps that are available in Canada—did not respond by deadline when asked if they plan to register. Nor did Shopify, whose payments business forms a significant part of its bottom line.

Scott said the Bank of Canada has done a commendable job communicating the nuances of the regime—“We have better guidance than we’ve ever had,” she said. But the system does subject businesses to an expensive and time-consuming application process, she noted. They must register over a two-week period, then wait 10 months for the bank to release its decisions about who qualifies. “If someone has not registered… there’s the potential for penalties,” Scott said. “That’s a pretty strict approach.” 

Chande said the Bank of Canada is “ready to pursue” businesses that don’t comply, but will “be reasonable” if a firm misses the deadline, but acts quickly once it learns of its obligations.

Montreal-based Shakepay, which operates a Bitcoin platform and offers some bank-like services, will be among the firms applying. General counsel Eric Richmond said the company believes its bill payment service and Visa card, which offers bitcoin rewards, fall under the scope of the new regime. (Visa Canada will also be registering, head of risk Maryam Saeed confirmed in an email. Rival Mastercard did not provide a response.)

Richmond said he welcomes the oversight. Registration offers fintechs a path to membership with Payments Canada, he noted, which is in turn a step toward eventual access to the long-delayed Real-Time Rail instant payment system. Opening up access to payment rails should put pressure on banks to offer innovative products to compete with fintechs, he said: “More choice is good for Canadians.”