Senior officer and governance
Clear roles and responsibilities, with a senior officer accountable for the frameworks, and enough resources to run them. We set out who owns each framework, how it's approved and reviewed, and how issues reach senior management.
Risk framework and registers
The Bank expects PSPs to identify their operational risks, protect against them, detect problems, and respond and recover, with periodic review and testing. We build your risk framework and the registers behind it: the risks in your payment activities, the controls that address them and who is responsible.
Incident response
When something goes wrong, your team needs to know what to do. The framework covers how incidents are identified, escalated, contained and recovered from, and how you notify the Bank without delay when an incident has a material impact on end users, other PSPs or certain clearing and settlement systems.
Third parties and agents
Many PSPs depend on processors, banks, cloud providers and others, and some act through agents or mandataries. The framework covers how you assess and manage the risks they bring. Foreign PSPs also identify the agents or mandataries acting for them in Canada.
Safeguarding end-user funds
If you hold end-user funds, you must safeguard them, either in a trust account, or in a segregated account protected by insurance or a guarantee. Your written safeguarding framework explains how end users get timely access to their funds and how funds would be paid out if your business became insolvent.
Cyber, IT and continuity
Protecting the integrity, confidentiality and availability of your systems and data, detecting cyber threats, and keeping payments running, or restoring them quickly, when systems or providers fail.
Annual report and change notices
PSPs file an annual report with the Bank no later than March 31 of the following year, covering their registration information, operational risk management, incident response and safeguarding. They also give the Bank notice at least five business days before a significant change or new activity. The framework sets out how you track, prepare and approve both.
Sources: Bank of Canada, Supervisory framework; Retail payments supervision. Checked 11 October 2026. General information, not legal advice.