title: Canada — Operational Resilience & Critical Infra | World Payments Monitor canonical: https://payments.gi/jurisdictions/canada/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infra Confirmed confirmed 2026-06-27 Operational resilience for non-bank PSPs runs through the RPAA's operational-risk-management and incident-response obligations (in force September 8, 2025), supervised by the Bank of Canada. Systemic payment infrastructure (Lynx) is designated under the Payment Clearing and Settlement Act and held to CPMI-IOSCO Principles for Financial Market Infrastructures. There is no DORA-equivalent single op-res statute; resilience is split across RPAA (PSPs), PCSA/FMI oversight, and OSFI for banks. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/canada/) Standing sub-brief · as of 27 June 2026 155 words · last cycle 2026-08-31 #### Operational Resilience & Critical Infrastructure Canada lacks a single DORA-equivalent operational-resilience statute; resilience is split across multiple regimes. Lynx, Canada's high-value payment system, is designated as a systemically important payment system under the Payment Clearing and Settlement Act (PCSA), held to the CPMI-IOSCO Principles for Financial Market Infrastructures, with legal protection for payment finality and placement under the Bank's resolution regime. The broader resilience picture is fragmented across the RPAA (covering non-bank PSPs, whose operational-risk and incident-response obligations came into force September 8, 2025), PCSA/FMI oversight (Lynx, CDSX, CDCS), and OSFI (banks). This split is the analytical spine of the module: there is no unified op-res statute carrying obligations across bank and non-bank actors alike. #### Outlook The module is stable. The principal watch item is whether the proliferation of new regimes — RPAA, the new CDBA, the Stablecoin Act — drives any consolidation or harmonisation of operational-resilience expectations, or whether fragmentation persists as the default. Periodic update · new data 2026-09-08 #### Operational Resilience & Critical Infrastructure Operational-risk management and incident response are now formalized obligations for RPAA-registered payment service providers under the Bank of Canada's supervisory framework. Registered PSPs must manage operational risks and respond to incidents as an ongoing supervisory expectation, not a one-time registration condition. The Bank of Canada's retail-payments supervisory framework formalizes this as risk-based supervision, explicitly framed around reducing end-user risk while supporting a safe, innovative, and competitive payment system, signalling a proportionate rather than uniformly prescriptive supervisory posture across the registered nonbank population. The bank-versus-nonbank distinction is structurally relevant here: registered PSPs are, by definition, nonbank PI/EMI-category entities operating under the RPAA's dedicated operational-resilience expectations, a supervisory track distinct from the resilience requirements banks face under separate prudential frameworks. As the registered-PSP population grows following the registry's rolling updates, the operational-resilience framework's risk-based calibration will determine how uniformly incident-response expectations are applied across providers of varying scale. #### Outlook How the Bank of Canada's risk-based supervisory framework is applied in practice, particularly whether smaller registered PSPs face materially lighter operational-resilience expectations than larger ones, is the open question to watch as the framework matures beyond its first year of full operation. **Sources and findings (3)** 1. T1 [https://www.bankofcanada.ca/regulatory-oversight/retail-payments/supervisory-framework/](https://www.bankofcanada.ca/regulatory-oversight/retail-payments/supervisory-framework/) 2. T1 [https://www.bankofcanada.ca/2021/09/bank-canada-designates-lynx-systemically-important-payment-system/](https://www.bankofcanada.ca/2021/09/bank-canada-designates-lynx-systemically-important-payment-system/) retrieved 2026-06-27 3. T1 [https://bankofcanada.ca/core-functions/financial-system/oversight-designated-clearing-settlement-systems/services-provided](https://bankofcanada.ca/core-functions/financial-system/oversight-designated-clearing-settlement-systems/services-provided) retrieved 2026-06-27