On May 15, 2017, the Financial Consumer Agency of Canada (FCAC) published Commissioner’s Decision #126 (Decision) regarding non-compliance with the Code of Conduct for the Credit and Debit Card Industry in Canada (Code of Conduct) by a payment card network operator (PCNO). The Decision is significant in that it is the first Commissioner’s Decision published regarding non-compliance with the Code of Conduct, and in particular regarding the obligation of a PCNO to ensure compliance by its participants.
The Decision stemmed from a Notice of Non-Compliance previously issued to the PCNO, which found that the PCNO had failed to ensure that monthly statements issued to merchants complied with Element 1 of the Code of Conduct. For a period of approximately three years, monthly statements issued to merchants by payment processors contained incorrect disclosure for certain transaction types.
The PCNO did not dispute that a breach of Element 1 of the Code of Conduct had occurred, but took the position that it was not responsible for the breach because it had taken reasonable measures and applied adequate controls to comply with the Code of Conduct — i.e., the PCNO should not be held responsible for incorrect disclosures made by payment processors.
The Commissioner considered the scope of a PCNO’s obligations under the Code of Conduct, which are to: (1) incorporate the Code of Conduct in its entirety into the PCNO’s contracts, governing rules and regulations; and (2) ensure compliance by its participants (i.e., issuers, acquirers, etc.).
Interestingly, the Commissioner also considered sections 6 and 7 of the Payment Card Networks Act (PCNA) as instructive in determining a PCNO’s obligations with respect to the Code of Conduct, even though these sections of the PCNA are not yet in force. The payments industry generally considers the PCNA and the regulation-making power thereunder to be the “axe” that the federal government will drop if PCNOs and their participants do not “voluntarily” comply with the Code of Conduct — i.e., at any time the government can pass regulations under the PCNA to make the voluntary requirements of the Code of Conduct mandatory through legislation. However, it seems that the Commissioner is using the PCNA to inform PCNO obligations, even before the axe has fallen.
The Commissioner does not reach any definite conclusions in the Decision that can be used by other PCNOs for precedent. After consideration of the PCNO’s compliance approach, the Commissioner held that the PCNO was “focused primarily on managing its risks relating to non-compliance by a third party” and appeared to be “lacking in its approach to preventative monitoring.” However, because this was the first case dealing with a PCNO’s obligation to ensure compliance with the Code of Conduct by its participants, the Commissioner felt that a certain degree of latitude was warranted and found that no further action was required.
The Commissioner cautioned that the Decision should not be considered a precedent for determining whether reasonable measures have been applied and that more will need to be done going forward. The result is that the Decision implies that PCNOs will be responsible for ensuring compliance by their participants with the Code of Conduct, and for taking reasonable preventative measures for doing so, but does not give PCNOs any concrete direction as to what will constitute reasonable measures. However, the Commissioner said she intends to issue guidance to assist the industry in this regard and will seek PCNO input in the process. There is no indication in the Decision as to the timing of such guidance.