Enforcement process

Publication date: June 17, 2024

This supervisory policy outlines the Bank of Canada’s enforcement process and what individuals, entities and payment service providers should expect if the Bank takes enforcement action against them.

Introduction

The Bank of Canada promotes compliance with the Retail Payment Activities Act (RPAA) and the Retail Payment Activities Regulations (RPAR). If the Bank suspects an individual, entity or payment service provider (PSP) has violated the RPAA or RPAR, the Bank may take enforcement action against them and, in such cases, may choose a proportionate enforcement tool.

The types of violations the Bank may pursue include failure to:

• register
• submit mandatory reports and notices
• respond to information requests
• comply with requirements on operational risk and incident response
• comply with requirements on safeguarding end-user funds

Case selection process

The enforcement process starts when the Bank receives information about a potential violation of the RPAA or RPAR. This information may come from:

• inside the Bank (e.g., from staff in the Supervision Department)
• outside the Bank (e.g., from another regulatory body, an external partner or the general public)

When the Bank receives the information, it will determine whether to open and investigate the case. The Bank will determine if the referral relates to a violation of the RPAA or RPAR and will recommend one of the following actions: 

• initiate an investigation
• initiate an investigation and simultaneously disclose related information to a government authority or regulatory body
• refer the matter back to the source of the referral and close the case
• disclose the related information to a government authority or regulatory body and close the case
• close the case with no further action

Initiating an investigation

If the Bank’s recommendation following the case selection process is to initiate an investigation, the Bank will open a case and start an investigation. The purpose of an investigation is to gather information to determine whether the Bank:

• has reasonable grounds to believe that an individual, entity or PSP committed a violation, and if so
• should use a proportionate enforcement tool

What to expect during an investigation

At the beginning of an investigation, the individual, entity or PSP being investigated has the right to:

• select a preferred official language (English or French) for communicating with the Bank
• assign a representative to act on their behalf.

At any time during the investigation, the individual, entity or PSP can request special accommodations (e.g., if they have difficulty accessing the PSP Connect or need accommodations for an interview).

Issuing a notice of investigation

When the Bank initiates an investigation, the individual, entity or PSP being investigated will receive a notice of investigation to:

• inform the individual, entity or PSP that an investigation has been started
• set out the details of the potential violation(s)
• explain the general investigation process
• inform the individual, entity or PSP that they must preserve all records related to the potential violation(s)

The Bank will send a subsequent notice with additional information if the scope of the investigation needs to be broadened.

Collecting information

The Bank will collect information to determine whether it has reasonable grounds to believe that a person, entity, or PSP committed a violation. The Bank may use different methods to collect information.

Desk investigation

The Bank will start with a desk investigation, which involves reviewing information available from Bank staff. Once the Bank collects and reviews all information from internal sources, it will decide whether it needs to supplement the desk investigation with information from external sources (e.g., the individual, entity or PSP being investigated, other third parties or other domestic or foreign regulators).

Information request

The Bank may also collect information through written requests for information to individuals, entities and PSPs. Those receiving a request must respond within 15 days beginning on the day after the request is made. However, if the information request relates to an incident that is ongoing and could have a significant adverse impact on an individual or entity referred to in subsection 94(2) of the Act (i.e., an end user, a PSP, or a clearing house of a clearing and settlement system that is overseen by the Bank under the Payment Clearing and Settlement Act), the Bank will request a response within 24 hours. The Bank may follow up on information requests or send new information requests to relevant parties.

Interview

The Bank may also conduct interviews to collect information from the individual, entity or PSP being investigated or from other third parties. The interviews may be conducted in different formats, such as in-person, by video or by telephone. Before the interview, the Bank will typically send the person being interviewed:

• a notification outlining the topics to be discussed
• any information needed to prepare for the interview
• instructions on how to respond to the notification

Onsite investigation

If the Bank requires further information, it may conduct an onsite investigation. This involves visiting:

• the offices of the individual, entity or PSP being investigated
• any place the Bank has reasonable grounds to believe it could find records relevant to verifying compliance with the RPAA or RPAR

The Bank will generally inform the individual, entity or PSP before it comes onsite. If the Bank needs to conduct an onsite investigation at a dwelling-house (i.e., a building kept as a residence that is also used for the individual, entity, or PSP’s operations), it will obtain the consent of the occupant or a warrant for entry beforehand. It is important to note that all owners, persons in charge of the place and all persons present at the place have a duty to give all assistance that is reasonably required to enable Bank staff to carry out their onsite investigation and perform any appliable function listed in section 69 of the RPAA.  

Special audit

Finally, the Bank may collect information through a special audit of a PSP if it is of the opinion that one is required to verify compliance with the RPAA. The Bank may appoint an external individual or entity to conduct the audit when, for example, specialized skills or experience are needed to appropriately review an issue of compliance with the RPAA. A PSP that is subject to a special audit:

• has a duty to assist the auditor
• must provide any document or information and access to any data the auditor requests

When the audit is finalized, the PSP will provide the Bank with a copy of the audit report. The PSP will incur all expenses related to the special audit.

Determining staff findings and scheduling an exit interview

Once the Bank collects all information from an investigation, it will:

• review the information
• conduct an analysis
• determine the preliminary findings

The Bank will generally schedule an exit interview with the individual, entity or PSP being investigated to present the preliminary findings. The exit interview provides the individual, entity, or PSP an opportunity to share information or documentation before the Bank determines the final results of the investigation. After the exit interview, the Bank will issue a findings report to the individual, entity or PSP to outline the results of the investigation.

Concluding an investigation

If the results of the investigation show that the Bank has reasonable grounds to believe that the individual, entity or PSP has committed a violation, the Bank may choose a proportionate enforcement tool to address the violation and to encourage compliance with the RPAA and RPAR. Alternatively, if the Bank does not find reasonable grounds to believe that a violation was committed or chooses not to use an enforcement tool, it may communicate to the individual, entity or PSP that it does not intend to pursue enforcement action at that time.  

Confidentiality

The Bank must treat all information obtained under the RPAA and any information prepared from that information, including material obtained or prepared during an investigation, in a confidential manner, subject to certain limited exceptions outlined in the RPAA.

These exceptions include the Bank’s requirement to make public:

• the nature of certain violations
• the name of the PSP that committed the violations
• the amount of any penalty imposed

The Bank also has the discretion to make public the reasons for its decision to issue a notice of violation and any related decision, including the relevant facts, analysis and considerations that formed part of the decision.