Retail Payment Activities Regulations — 19
Contents 19 (1) For the purpose of paragraph 21(a) of the Act, the prescribed information consists of (a) a description of any changes made to the payment service provider’s risk management and incident response framework during the reporting year and the payment service provider’s plans for the framework’s maintenance and implementation; (b) a description of the objectives referred to in paragraph 5 (1)(a) and the targets and indicators referred to in paragraph 5 (1)(b); (c) a description of the means by which the payment service provider carried out any assessments referred to in paragraph 5 (3)(a) during the reporting year; (d) a description of the manner in which the payment service provider carried out any assessments referred to in paragraph 5 (4)(c) during the reporting year, including the criteria used; (e) a description of the human and financial resources for implementing and maintaining the risk management and incident response framework that were available to the payment service provider during the reporting year; (f) a description of roles and responsibilities allocated by the payment service provider in respect of the implementation and maintenance of their risk management and incident response framework during the reporting year; (g) a description of the payment service provider’s operational risks in respect of the reporting year, their potential causes and the manner in which they were identified; (h) a description of the manner in which the payment service provider classified any assets and business processes for the purpose of paragraph 5 (1)(e) during the reporting year; (i) a description of the systems, policies, procedures, processes, controls and other means referred to in paragraphs 5 (1)(g) and (h) and subsection 5 (5) that the payment service provider had in place during the reporting year; (j) a description of the plans referred to in paragraphs 5 (1)(i) and (j) and the manner in which those plans were maintained and implemented during the reporting year; (k) a description of the means by which the payment service provider obtained the approvals required under subsection 5 (6) during the reporting year; (l) a description of the means by which the payment service provider ensured the availability of its risk management and incident response framework and of the precautions that it took to prevent the unauthorized deletion, destruction or amendment of the framework, as required by section 6 , during the reporting year; (m) a description of the information and training that the payment service provider ensured was provided under section 7 during the reporting year; (n) a description of all reviews under section 8 , testing under section 9 and independent reviews under section 10 that the payment service provider carried out or ensured were carried out during the reporting year, as well as a description of the payment service provider’s testing methodology referred to in subsection 9 (1); and (o) a description of any incidents that the payment service provider experienced during the reporting year. Accounts, insurance and guarantees (2) For the purpose of paragraph 21(b) of the Act, the prescribed information consists of (a) information on any entity that has provided the payment service provider with an account referred to in subsection 20(1) of the Act, including the entity’s name and the name of the regulator responsible for supervising the entity with respect to its adherence to the standards referred to in section 13 of these Regulations; (b) the name of any other payment service provider through which the payment service provider has obtained the use of an account referred to in subsection 20(1) of the Act; (c) information on any entity that has provided the payment service provider with the insurance or guarantee referred to in paragraph 20(1)(c) of the Act, including the entity’s name and the name of the regulator responsible for supervising the entity with respect to its adherence to the standar