CA v13.3.0

Canada (CA) · Module Detail

Canada: Operational Resilience & Critical Infra

← Full Canada overview Build report with Canada Request deeper dive

#

Operational resilience for non-bank PSPs runs through the RPAA's operational-risk-management and incident-response obligations (in force September 8, 2025), supervised by the Bank of Canada. Systemic payment infrastructure (Lynx) is designated under the Payment Clearing and Settlement Act and held to CPMI-IOSCO Principles for Financial Market Infrastructures. There is no DORA-equivalent single op-res statute; resilience is split across RPAA (PSPs), PCSA/FMI oversight, and OSFI for banks.

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →

Standing sub-brief · as of 27 June 2026155 words · last cycle 2026-08-31

Operational Resilience & Critical Infrastructure

Canada lacks a single DORA-equivalent operational-resilience statute; resilience is split across multiple regimes. Lynx, Canada's high-value payment system, is designated as a systemically important payment system under the Payment Clearing and Settlement Act (PCSA), held to the CPMI-IOSCO Principles for Financial Market Infrastructures, with legal protection for payment finality and placement under the Bank's resolution regime. The broader resilience picture is fragmented across the RPAA (covering non-bank PSPs, whose operational-risk and incident-response obligations came into force September 8, 2025), PCSA/FMI oversight (Lynx, CDSX, CDCS), and OSFI (banks). This split is the analytical spine of the module: there is no unified op-res statute carrying obligations across bank and non-bank actors alike.

Periodic update · new data 2026-09-08

Operational Resilience & Critical Infrastructure

Operational-risk management and incident response are now formalized obligations for RPAA-registered payment service providers under the Bank of Canada's supervisory framework. Registered PSPs must manage operational risks and respond to incidents as an ongoing supervisory expectation, not a one-time registration condition. The Bank of Canada's retail-payments supervisory framework formalizes this as risk-based supervision, explicitly framed around reducing end-user risk while supporting a safe, innovative, and competitive payment system, signalling a proportionate rather than uniformly prescriptive supervisory posture across the registered nonbank population.

The bank-versus-nonbank distinction is structurally relevant here: registered PSPs are, by definition, nonbank PI/EMI-category entities operating under the RPAA's dedicated operational-resilience expectations, a supervisory track distinct from the resilience requirements banks face under separate prudential frameworks. As the registered-PSP population grows following the registry's rolling updates, the operational-resilience framework's risk-based calibration will determine how uniformly incident-response expectations are applied across providers of varying scale.

Outlook

How the Bank of Canada's risk-based supervisory framework is applied in practice, particularly whether smaller registered PSPs face materially lighter operational-resilience expectations than larger ones, is the open question to watch as the framework matures beyond its first year of full operation.

Sources and findings (3)
  1. T1https://www.bankofcanada.ca/regulatory-oversight/retail-payments/supervisory-framework/
  2. T1https://www.bankofcanada.ca/2021/09/bank-canada-designates-lynx-systemically-important-payment-system/retrieved
  3. T1https://bankofcanada.ca/core-functions/financial-system/oversight-designated-clearing-settlement-systems/services-providedretrieved