Financial technology firms that violate the Bank of Canada’s regime for regulating payments could face monetary penalties as high as $10 million, according to new guidelines released by the central bank.

The context: Starting in November, all technology companies that handle retail payments in Canada will have to register with the Bank of Canada. In 2021, the federal government introduced legislation that expanded the institution’s mandate to include the new regulatory regime under the Retail Payment Activities Act. Overseeing payments infrastructure is a lesser-known responsibility of the central bank, one that has become more complex with the growth of businesses providing technology-enabled services previously only offered by financial institutions.

Violating the RPAA doesn’t pay: According to the Bank of Canada’s newly released enforcement guidelines, fintechs could attract scrutiny for failing to register, failing to adequately safeguard user funds or failing to submit mandatory documents, among other violations. The Bank will calculate monetary penalties by considering harm, violation history, and intent or negligence. Other enforcement tools include warning letters, compliance orders and revocation of registration.

Tough but fair: In an email, Gabriel Ngo, director of enforcement for the central bank’s new regulatory regime for payment providers, said he aimed to make penalties meaningful, but not unnecessarily punitive. “Any enforcement action, including [fines], should be proportionate to the violation, and are not meant to punish,” he said. The bank’s goals are to deter bad behaviour and give payments firms an incentive to change it, he said.

A regulatory regime takes shape: This is the Bank of Canada’s latest set of guidelines laying out the structure of its new payments regulation. In February, the institution published preliminary requirements fintechs must follow for safeguarding user funds, mitigating risks and reporting incidents. Paul Badertscher, a spokesperson for the Bank of Canada, said in an email that the central bank will publish finalized guidelines on those topics later this year. Last December, the bank provided guidance on registration. 

The reaction: In an interview with The Logic, Craig Attiwill, founder and CEO of Victoria-based fintech Peloton (not to be confused with the interactive stationary bike company), said the fines are high but reasonable. They shouldn’t be an issue for firms that are taking compliance seriously, he said: “Governance is a good thing. It has to be done right.” Brigit Carroll, head of policy for the Americas at U.K.-based money transfer company Wise, said in an email that the bank is doing its job: “Penalties are part of the enforcement mechanism that the Bank of Canada has been mandated with.”

Alex Vronces, executive director of the industry group Fintechs Canada, said in an interview that the new regulatory regime for retail payments companies is shaping up to be substantial, but that the enforcement regime seems reasonable. “We welcome teeth from regulators. We think Canada would do better if enforcement got more aggressive,” he said.