How to complete an annual report: A step-by-step guide

How to complete an annual report: A step-by-step guide | February 2026 | Page 2 Contents
Introduction................................................................................ 3
Using PSP Connect for annual reporting ................................... 3
Disclaimer ................................................................................... 3
Notes........................................................................................... 3
Preliminary Questions................................................................ 4
Part 1: Registration Info Change Reporting Details................... 5
Section 1: Operational Risk and Incident Management ........... 6
Section 2: End-User Funds Safeguarding.................................16
Section 3: Significant Change and Incident Reporting ............32
Section 4: Ubiquity and Interconnectedness ..........................36
Section 5: Financial Information ..............................................46
Section 6: Record-keeping .......................................................50

How to complete an annual report: A step-by-step guide | February 2026 | Page 3 Introduction This guide explains the questions you will need to answer in PSP Connect and helps identify the documents and information needed to complete and submit an annual report to the Bank of Canada. You are required to submit your completed annual report form to the Bank by March 31 each year. In accordance with the Retail Payment Activities Act (RPAA) and the Retail Payment Activities Regulations (RPAR), payment service providers (PSPs) must submit an annual report to the Bank. Annual report requirements for PSPs are described in section 21 of the RPAA and sections 18 and 19 of the RPAR. For more information about the Bank’s supervisory expectations regarding the annual report requirements under the RPAA, please refer to the annual reporting guideline. Using PSP Connect for annual reporting You must have an account in PSP Connect to fill out and submit an annual report to the Bank. You will be notified by the Bank when the annual report is ready to be completed. You can access the Annual Reporting page on PSP Connect by going to the main menu and selecting “Reporting” and then “Annual Reporting.” We recommend that you complete the annual report on a laptop or desktop computer rather than a mobile device, and that you use Google Chrome, Microsoft Edge or Mozilla Firefox to submit your notification. Disclaimer This is not a legal document. The explanations and definitions included here are not legal definitions. If the language in this document differs from the relevant legislation or regulations, the legal text in the legislation and regulations prevails. For legal information, see the RPAA. Notes o Gathering and preparing materials relating to the annual report in advance of filling out the form may help speed up the process. o You can save your progress by clicking “Save and Continue” on each page, if you prefer to complete it later. o Once you submit your report, the Bank will send you a confirmation of receipt through PSP Connect.

How to complete an annual report: A step-by-step guide | February 2026 | Page 4 Preliminary questions Are you completing this part in relation to retail payment activities performed by the PSP during (current reporting year)? If you responded Yes, you will be able to continue filling out the form in respect of the current reporting year. If you responded No, you will be redirected to select the annual reporting form for the appropriate calendar year. This could be required in circumstances where you are submitting a late filing.

How to complete an annual report: A step-by-step guide | February 2026 | Page 5
Part 1: Changes in registration information
When you select annual report, you will initially be redirected to a registration information change request form. Please review and confirm that all registration information displayed is accurate before completing the annual report. If a change is required to any of the displayed registration information, please select the relevant sections that require updating. Once you have updated the information, click “Save and continue.” You will then be required to verify the remaining information within the
section where the information was updated. After completing all the relevant updates, please
select “Additional Information.” You will then be taken to a page where you can view a [change detail list/list of changes]. After verifying the information, please select “Save and submit” and proceed to the next part of the annual report form. If there have not been any changes, please select “Abandon” and proceed to the next part of the Annual Report Form.

How to complete an annual report: A step-by-step guide | February 2026 | Page 6
Section 1: Operational Risk and Incident Management
Use this section to provide information about operational risk and incident management under the RPAA. For more detail on what is expected in this area, refer to the supervisory guideline on operational risk and incident response. Please note that the questions presented in this section are dynamic—they will adjust based on how you respond to earlier questions in the form. Question 1.1: Was the PSP’s risk management and incident response framework approved during the last year? Select a response from the options:

The risk management and incident response framework was approved by the senior
officer (referred to in subparagraph 5(1)(d)(ii) of the RPAR) and the board of directors, if any, within the reporting year and approved by the senior officer when each material change, if any, was made to the framework.
The risk management and incident response framework was approved by the senior
officer and the board of directors, if any, within the reporting year, but not approved by the senior officer when each material change was made to the framework.
The risk management and incident response framework was not approved by the
senior officer and/or the board of directors, if any, within the reporting year.
The PSP has not established a framework.
The PSP does not have a senior officer.
As defined in section 1 of the RPAR, a senior officer of an entity means:
a) a member of the entity’s board of directors who is also one of its full-time employees b) the entity’s chief executive officer, chief operating officer, president, chief risk officer, secretary, treasurer, controller, chief financial officer, chief accountant, chief auditor or chief actuary, or any person who performs functions similar to those normally performed by someone occupying one of those positions, or c) any other officer who reports directly to the entity’s board of directors, chief executive officer or chief operating officer For more information on who can be the senior officer and their responsibilities, refer to the frequently asked questions about retail payments supervision. Question 1.2: Which of the following categories did the PSP identify as an operational risk to its retail payment activities during the reporting year? Select all that apply. Select from the list to indicate the categories of operational risks you identified. Multiple items may be selected if applicable:
Business continuity and resilience
Cyber security
Fraud
Information and data management
Information technology
Human resources

How to complete an annual report: A step-by-step guide | February 2026 | Page 7

Process design and implementation
Product design and implementation
Change management
Physical security of persons and assets
Third parties
Other category
None
o If you selected Other category, use the open-text field to specify the category. o If you selected None, use the open-text field to explain why you did not identify operational risks related to your retail payment activities. For more information on categories of operational risks, refer to section 5 of the operational risk and incident response guideline. Question 1.3: Did the PSP’s risk management and incident response framework classify its assets (including systems, data and information) and business processes related to its retail payment activities by their sensitivity and their criticality to the performance of those activities during the reporting year? Select a response from the options:
Assets and business processes were classified by sensitivity and criticality.
Assets and business processes were classified by sensitivity only.
Assets and business processes were classified by criticality only.
Assets and business processes were not classified for sensitivity or criticality.
Assets and business processes have not been identified.
Note: If you classified only assets or only business processes and not both, please select “Assets and business processes were not classified for sensitivity or criticality.” Question 1.4: Were human and financial resources available to the PSP to implement and maintain its risk management and incident response framework during the reporting year? Select a response from the options:
The required human and financial resources were available.
The required human resources were available but not the financial resources.
The required financial resources were available but not the human resources.
Neither the required human nor financial resources were available.
Question 1.5: Did the PSP’s risk management and incident response framework allocate roles and responsibilities in relation to the implementation and maintenance of its framework during the reporting year? Select one. Select a response from the options:
a. All roles and responsibilities were allocated during the reporting year. b. Some roles and responsibilities were allocated during the reporting year.
c. The PSP did not allocate roles and responsibilities during the reporting year.

How to complete an annual report: A step-by-step guide | February 2026 | Page 8
Section 5(1)(d) of the RPAR requires that a PSP’s written risk management and incident
response framework must allocate specific roles and responsibilities for implementing and maintaining the framework. This includes assigning responsibility for overseeing the exercise of these roles, both in the normal course of business and when detecting, responding to and recovering from incidents. Question 1.6: Did the PSP’s risk management and incident response framework allocate specific roles and responsibilities to a senior officer to oversee the PSP’s compliance, as required by regulation, during the reporting year? Select a response from the options:

Yes
No because the PSP is an individual
No
Operational reliability objectives and targets Question 1.7: Did the PSP’s risk management and incident response framework set out the following? a. Objectives ensuring that the PSP can perform retail payment activities without reduction, deterioration or breakdown, including by ensuring the availability of the systems, data and information involved in the performance of those activities and by preserving the integrity and confidentiality of those activities, systems, data and information b. Clearly defined and measurable reliability targets to measure the availability of the systems, data and information
c. Indicators for assessing whether the PSP met each of the objectives set out in
paragraph 5(1)(a) of the RPAR during the reporting year Select one option within each cell of the table:
Availability Objective(s) were set out
OR
No objective(s) were set out
Reliability target(s) and indicator(s) were set out OR No reliability target(s) and/or indicator(s) were set out Integrity Objective(s) were set out OR No objective(s) were set out Indicator(s) were set out OR No indicator(s) were set out Confidentiality Objective(s) were set out OR No objective(s) were set out Indicator(s) were set out OR No indicator(s) were set out

How to complete an annual report: A step-by-step guide | February 2026 | Page 9 Protective and detective measures to mitigate operational risk Question 1.8: Specifically in relation to mitigating risks related to cyber security, information technology or other technology, which of the following systems, policies, procedures, processes, controls and other means (referred to in paragraph 5(1)(g) of the RPAR) did the PSP’s risk management and incident response framework have in place during the reporting year to ensure the continuous monitoring of its retail payment activities and the systems, data and information involved in the performance of those activities? Select all that apply. Multiple items may be selected if applicable:

Key indicators and internal thresholds
Logging and monitoring
Network defences
Malware detection
Intrusion detection and prevention
Vulnerability detection
Security monitoring
Physical security (e.g., access logs)
Threat intelligence
Other capabilities
None
Note: This question is about the measures you use to continuously monitor retail payment activities and the supporting systems, data and information. The options listed (e.g., logging and monitoring, intrusion detection and threat intelligence) are examples of common monitoring and defensive tools or practices. Select all that were applicable during the reporting year. For more information on what is expected in this area, refer to section 7 of the operational risk and incident response guideline. Question 1.9: Specifically in relation to mitigating technology risk, which of the following systems, policies, procedures, processes, controls and other means did the PSP’s risk management and incident response framework have in place during the reporting year for the purposes of mitigating its operational risks and protecting its assets and business processes? Select all that apply. Multiple items may be selected if applicable:
Access management, including management of physical access
Vulnerability management, remediation and patching
Security software
Securely configured devices
Network security defences
Secure cloud and outsourced information technology services
Secure information system media
Secure system development life cycle
Other capabilities

How to complete an annual report: A step-by-step guide | February 2026 | Page 10

None
Note: This question is about the measures you use to protect assets and business processes from technology-related risks. The options listed (e.g., access management, patching, securely configured devices and secure system development) are examples of widely recognized practices for technology risk management. Select all that were applicable during the reporting year. For more information on what is expected in this area, refer to section 6 of the operational risk and incident response guideline. Plans and arrangements for incident response and recovery Question 1.10: Did the PSP’s risk management and incident response framework set out a plan or plans that addresses how the PSP will respond to and recover from incidents during the reporting year, including incidents that occur at or are detected by agents, mandataries or third-party service providers? Select a response from the options:
Incident response plan(s) is(are) set out, including incidents that occurred or are
detected internally or externally.
Incident response plan(s) is(are) set out but include(s) only incidents that occurred or
are detected internally.
Incident response plan(s) is(are) set out but include(s) only incidents that occurred or
are detected externally.
No incident response plan is set out.
Question 1.11: Which of the following aspects were included in the incident response plan(s) set out in the PSP’s risk management and incident response framework? Select all that apply. Multiple items may be selected if applicable:
a. Policies and procedures for implementing the plan b. Escalation procedures
c. Incident response procedures of any third-party service provider supporting the PSP’s
retail payment activity d. Measures to be taken to contain the impact of an incident e. The investigation of the incident’s root cause f. The verification of the incident’s impact g. Measures to be taken to prevent the incident from creating further damage h. Time frames for implementing measures to be taken
i. Reporting procedures, including frequency and level of detail
j. The identification of transaction status k. Record retention requirements
l. Other aspect(s)
This question will not be displayed if you selected No incident response plan is set out in response to question 1.10 (Did the PSP’s risk management and incident response framework set out a plan or plans that addresses how the PSP will respond to and recover from incidents

How to complete an annual report: A step-by-step guide | February 2026 | Page 11 during the reporting year, including incidents that occur at or are detected by agents, mandataries or third-party service providers?). User of third-party service providers Question 1.12: Did the PSP receive services from a third-party service provider to support its retail payment activities during the reporting year? Select a response from the options:

Yes
No
Question 1.13: Did the PSP’s risk management and incident response framework clearly allocate responsibilities between the PSP and the third-party service provider during the reporting year? Select a response from the options:
Yes, through a contractual agreement
Yes, but through means other than a contractual agreement
No
This question will not be displayed if you selected No to question 1.12 (Did the PSP receive services from a third-party service provider to support its retail payment activities during the reporting year?). Question 1.14: During the reporting year, did the PSP’s risk management and incident response framework address the means by which the PSP will conduct any assessment referred to in paragraph 5(3)(a) of the RPAR of each of its third-party service providers? Select one. Select a response from the options:
The framework addressed the means by which the PSP was to assess each of its thirdparty service providers during the reporting year.
The framework did not address the means by which the PSP was to assess each of its
third-party service providers during the reporting year.
This question will not be displayed if you selected No to question 1.12 (Did the PSP receive services from a third-party service provider to support its retail payment activities during the reporting year?). Question 1.15: Did the PSP conduct an assessment referred to in paragraph 5(3)(a) of the RPAR on each of its third-party service providers during the reporting year? Select one. Select a response from the options:
Assessment(s) were conducted on all third-party service providers during the
reporting year.

How to complete an annual report: A step-by-step guide | February 2026 | Page 12

Assessment(s) were conducted on some third-party service providers during the
reporting year on a basis determined by the PSP (for example, the materiality of that third party to the PSP’s payment function).
No assessment(s) were conducted on any of the third-party service providers during
the reporting year.
This question will not be displayed if you selected No to question 1.12 (Did the PSP receive services from a third-party service provider to support its retail payment activities during the reporting year?). Question 1.16: Did the PSP enter into a new agreement, extend or substantially amend an existing agreement, or renew an agreement with a third-party service provider during the reporting year? Select a response from the options:
Yes
No
This question will not be displayed if you selected No to question 1.12: (Did the PSP receive services from a third-party service provider to support its retail payment activities during the reporting year?). Question 1.17: When did the PSP conduct an assessment referred to in paragraph 5(3)(a) of the RPAR on each of those third-party service providers? Select one. Select a response from the options:
a. The PSP’s assessments of the relevant third-party service providers were conducted prior to entering into, extending or substantially amending or renewing an agreement during the reporting year. b. The PSP’s assessments of the relevant third-party service providers were conducted after entering into, extending or substantially amending or renewing an agreement during the reporting year.
c. No assessment was conducted on any of the relevant third-party service providers
prior to or after entering into, substantially amending or renewing an agreement during the reporting year. This question will not be displayed if you selected No to questions 1.12 (Did the PSP receive services from a third-party service provider to support its retail payment activities during the reporting year?) or 1.16 (Did the PSP enter into a new agreement, extend or substantially amend an existing agreement, or renew an agreement with a third-party service provider during the reporting year?). Question 1.18: Which of the following aspects were included in the PSP’s assessment of its third-party service providers during the reporting year? Select all that apply. a. The ability of a third-party service provider to protect the PSP’s and its end users’ data and information. b. The ability of a third-party service provider to protect the connections to and from the PSP’s systems

How to complete an annual report: A step-by-step guide | February 2026 | Page 13
c. The third-party service provider’s performance
d. How the PSP is informed of any changes to services performed by the third-party service provider e. The third-party service provider’s risk management practices f. How the PSP is informed of any changes to the third-party service provider’s risk management practices g. How the PSP is informed of breaches identified by the third-party service provider h. How the PSP is informed of incidents caused by the third-party service provider
i. The appropriateness of the third-party service provider’s incident response plan(s)
j. The appropriateness of the third-party service provider’s roles and responsibilities dedicated to supporting the PSP’s retail payment activities k. Other aspect(s) This question will not be displayed if you selected No to questions 1.12 (Did the PSP receive services from a third-party service provider to support its retail payment activities during the reporting year?) or 1.16 (Did the PSP enter into a new agreement, extend or substantially amend an existing agreement, or renew an agreement with a third-party service provider during the reporting year?). Use of agents and mandataries Question 1.19: Did the PSP use an agent or mandatary to perform any retail payment activity on its behalf during the reporting year? Select a response from the options:

Yes
No
Question 1.20: Did the PSP’s risk management and incident response framework clearly specify the allocation of roles and responsibilities between the PSP and its agents and mandataries during the reporting year? Select a response from the options:
Yes
No
This question will not be displayed if you selected No to question 1.19 (Did the PSP use an agent or mandatary to perform any retail payment activity on its behalf during the reporting year?). Question 1.21: Did the PSP’s risk management and incident response framework establish operational risk management criteria that any agent or mandatary must satisfy prior to performing any retail payment activity on the PSP’s behalf? Select one.
Criteria were established for all agents and mandataries prior to those agents and
mandataries performing any retail payment activity on the PSP’s behalf during the reporting year.

How to complete an annual report: A step-by-step guide | February 2026 | Page 14

Criteria were established for all agents and mandataries after those agents and
mandataries performed any retail payment activity on the PSP’s behalf during the reporting year.
Criteria were established for more than half of the agents and mandataries prior to
those agents and mandataries performing any retail payment activity on the PSP’s behalf during the reporting year.
Criteria were established for more than half of the agents and mandataries after
those agents and mandataries performed any retail payment activity on the PSP’s behalf during the reporting year.
No criteria were established for any agents or mandataries during the reporting year.
This question will not be displayed if you selected No to question 1.19 (Did the PSP use an agent or mandatary to perform any retail payment activity on its behalf during the reporting year?). Question 1.22: Did the PSP conduct an assessment of the extent to which its agents and mandataries satisfied the operational risk management criteria and their operational risk management practices during the reporting year? Select one.
All agents and mandataries were assessed during the reporting year.
More than half of the agents and mandataries were assessed during the reporting
year.
Less than half of the agents and mandataries were assessed during the reporting
year.
None of the agents and mandataries were assessed during the reporting year.
This question will not be displayed if you selected No to question 1.19 (Did the PSP use an agent or mandatary to perform any retail payment activity on its behalf during the reporting year?). Human and financial resources Question 1.23: Provide a breakdown (using a best estimate if necessary) of the PSP’s employees at the end of the reporting year. Number How many employees were dedicated to retail payment activities? Of those employees dedicated to retail payment activities, how many were dedicated to operational risk management and incident response? How many employees did the PSP employ? Use the open-text field to provide the number of employees (i.e., full-time equivalents) in numerical format. For example, if you had 50 employees, this will be reported as 50. If you do not have exact figures, provide your best reasonable estimate.

How to complete an annual report: A step-by-step guide | February 2026 | Page 15 Question 1.24: Provide a breakdown (using a best estimate if necessary) of the allocation of financial resources at the PSP for the past full fiscal year (rounded to one decimal place):
%
What percentage of the annual financial budget did the PSP dedicate to retail payment activities? Of the annual financial budget dedicated to retail payment activities, what percentage did the PSP dedicate to operational risk management and incident response? Use the open-text field to provide the percentage in numerical format. For example: 50% should be reported as 50.0; 85.5% should be reported as 85.5. Independent review Question 1.25: Did the PSP carry out an independent review of its risk management and incident response framework referred to in section 10 of the RPAR? Select one. Select a response from the options:
a. The PSP does not have an internal or external auditor and is therefore not subject to
section 10 of the RPAR.
b. The PSP has been in operation for less than three years and has not yet carried out an independent review.
c. An independent review was carried out during the reporting year.
d. An independent review was carried out within the last three reporting years. e. An independent review was carried out more than three reporting years ago. f. No independent review has been carried out and the PSP has been in operation for three or more years. Note: An independent review of the framework must be conducted at least once every three years. If the PSP has been registered for less than three years (regardless of how long it has been in operation) and has not yet conducted an independent review, select The PSP has been in operation for less than three years and has not yet carried out an independent review.

How to complete an annual report: A step-by-step guide | February 2026 | Page 16
Section 2: End-User Funds Safeguarding
Use this section to provide information about safeguarding end-user funds under the RPAA. The supervisory guideline on safeguarding end-user funds has more detail on what the Bank expects in this area. The questions presented in this section are dynamic—they will adjust based on how you respond to earlier questions in the form. . You should review the holding funds section of the criteria for registering payment service providers to help determine if you are performing the holding funds payment function. For examples of how the interpretation of holding of funds can be applied to specific scenarios, refer to the holding funds case scenarios. If you answer No to question 2.1, you will only be prompted to answer question 2.1(b) within the section on safeguarding end-user funds in the annual report and, once completed, you will proceed directly to question 3.1. If you answer Yes to question 2.1, you will be prompted to answer question 2.1(a), as well as questions 2.2 to 2.23(a). Questions 2.1 to 2.23(a) are dynamic and will be displayed depending on your responses. Note: You should consult the Registry of PSPs to confirm if your status of holding end-user funds is accurate. If the registry is incorrect or has changed, please notify the Bank by submitting a “Registration Information Change Report” through PSP Connect. Application of the requirements for safeguarding end-user funds Question 2.1: Does the PSP perform payment function (b) as defined in the RPAA (the holding of funds on behalf of an end user until they are withdrawn by the end user or transferred to another individual or entity)? Select a response from the options:

Yes, the PSP holds fund.
No, the PSP does not hold funds.
Question 2.1(a): Did the PSP begin performing the payment function of holding funds on behalf of an end-user during the reporting period subject to this annual report? Select a response from the options:
Yes, the PSP began performing the payment function of holding funds.
No, the PSP did not begin performing the payment function of holding funds.
This question will not be displayed if you selected No, the PSP does not hold funds to question 2.1 (Does the PSP perform payment function (b) as defined in the RPAA (Holding funds on behalf of an end user until the they are withdrawn or transferred to another individual)?).

How to complete an annual report: A step-by-step guide | February 2026 | Page 17 Question 2.1(b): Did the PSP cease performing the payment function of holding fund on behalf of an end-user during the reporting period subject to this annual report? Select a response from the options:

Yes, the PSP ceased performing the payment function of holding funds.
No, the PSP did not cease performing the payment function of holding funds.
This question will not be displayed if you selected Yes, the PSP holds funds to question 2.1 (Does the PSP perform payment function (b) as defined in the RPAA (Holding funds on behalf of an end user until the they are withdrawn or transferred to another individual)?). Additional questions about safeguarding end-user funds Questions 2.2 to 2.23(a) in the subsections listed below will not be displayed if you selected No, the PSP does not hold funds to question 2.1 (Does the PSP perform payment function (b) as defined in the RPAA (Holding funds on behalf of an end user until the they are withdrawn or transferred to another individual)?).
Means of safeguarding end-user funds
Account provider
In trust in a trust account method
Insurance or guarantee method
Framework for safeguarding funds
Evaluation of insolvency protection
Independent review
Indirect arrangements
Exception under subsection 20(2) of the RPAA
Means of safeguarding end-user funds
Question 2.2: What means does the PSP use to safeguard end-user funds? Select all that apply. Multiple items may be selected if applicable:
Holding end-user funds in trust in a trust account that is not used for any other
purpose [paragraph 20(1)(a) of the RPAA].
Holding end-user funds in an account that is not used for any other purpose and
hold insurance or a guarantee in respect of the funds that is in an amount equal to or greater than the amount held in the account [paragraph 20(1)(c) of the RPAA].
None of the above.
Question 2.3: Did the means of safeguarding funds change during the reporting period subject to this annual report? Select a response from the options:
Yes
No

How to complete an annual report: A step-by-step guide | February 2026 | Page 18 Question 2.3(a): Select the applicable detail on the change in the means of safeguarding. Multiple items may be selected if applicable:

Stopped holding funds in trust in a trust account
Stopped using insurance or guarantee
Added a new insurance or guarantee
Started holding some or all end-user funds in trust in a trust account
This question will not be displayed if you selected No to question 2.3 (Did the means of safeguarding funds change during the reporting period subject to this annual report?). Question 2.4: Does the PSP place all end-user funds into the safeguarding account on receipt? Safeguarding account is defined as an account that is not used for any other purpose than safeguarding enduser funds, as referred to in subsection 20(1) of the Retail Payment Activities Act. Select a response from the options:
Yes, all end-user funds
Yes, some end-user funds
No
A safeguarding account is defined as an account that is not used for any other purpose than safeguarding end-user funds, as referred to in subsection 20(1) of the RPAA. Question 2.4(a): Are there any processing constraints (that cannot be avoided despite the PSP's best efforts) that hinder the PSP from placing end-user funds in a safeguarding account on receipt? Select a response from the options:
Yes
No
This question will not be displayed if you selected Yes, all end-user funds to question 2.4 (Does the PSP place all end-user funds into a safeguarding account on receipt?). Question 2.4(b): When the PSP faces processing constraints, does it place the funds in a safeguarding account at the latest, on the business day following the day of receipt? Select a response from the options:
Yes, all end-user funds
Yes, some end-user funds
No
This question will not be displayed if you selected No to question 2.4(a) (Are there any processing constraints (that cannot be avoided despite the PSP's best efforts) that hinder the PSP from placing end-user funds in a safeguarding account on receipt?).

How to complete an annual report: A step-by-step guide | February 2026 | Page 19 Account provider Question 2.5: Are the PSP’s safeguarding account(s) provided by a Canadian financial institution? Select a response from the options:

Yes
No
Question 2.5(a): Which financial institution(s) regulated in Canada does the PSP use as an account provider(s)? Select all that apply. Select multiple items, if applicable, from the list of financial institutions provided. This question will not be displayed if you selected No to question 2.5 (Are the PSP’s safeguarding account(s) provided by a Canadian financial institution?). Question 2.6: Are the PSP’s safeguarding account(s) provided by a foreign financial institution(s) that are prudentially regulated outside of Canada? Select a response from the options:
Yes
No
Question 2.6(a): Provide the details as follows:
Financial institution Country or jurisdiction Regulator In the open-text field, provide the name of the financial institution. In the open-text field, provide the country in which the financial institution account is provided. Provide the name of the prudential regulator of the financial institution. You must add a row for each financial institution. This question will not be displayed if you selected No to question 2.6 (Are the PSP’s safeguarding account(s) provided by a foreign financial institution(s) that are prudentially regulated outside of Canada?). In trust in a trust account method Question 2.7: Does the PSP hold the end-user funds in a trust account that is not used for any other purpose per paragraph 20(1)(a) of the RPAA? Select a response from the options:
Yes
No
Unsure

How to complete an annual report: A step-by-step guide | February 2026 | Page 20 Question 2.7(a): Does the PSP have a trust arrangement that forms a valid express trust established under Canadian law? Select a response from the options:

Yes
No
Unsure
This question will not be displayed if you selected No to question 2.7 (Does the PSP hold the end-user funds in a trust account that is not used for any other purpose per paragraph 20(1)(a) of the RPAA?). Question 2.7(b): Where is the trust arrangement established? Select all that apply. Multiple items may be selected if applicable:
Canada, outside Quebec
Canada, in Quebec
Other, please specify
If you selected Other, please describe in the open-text field where the trust arrangement is established. This question will not be displayed if you selected No to question 2.7 (Does the PSP hold the end-user funds in a trust account that is not used for any other purpose per paragraph 20(1)(a) of the RPAA?). Question 2.7(c): Is there a legal agreement between the PSP and the account provider(s), stating that the funds are held in trust for (or, in the context of a simple administration under Quebec law, for the benefit of) end users? Select a response from the options:
Yes
No
This question will not be displayed if you selected No to question 2.7 (Does the PSP hold the end-user funds in a trust account that is not used for any other purpose per paragraph 20(1)(a) of the RPAA?). Question 2.7(d): Who is the trustee of the trust? (Or, in the context of a simple administration under Quebec laws, the simple administrator) Select all that apply. Multiple items may be selected if applicable:
The PSP
The account provider
Other, please specify (open-text field)
If you selected Other, please describe who is acting as the trustee or the simple administrator in the open-text field.

How to complete an annual report: A step-by-step guide | February 2026 | Page 21 This question will not be displayed if you selected No to question 2.7 (Does the PSP hold the end-user funds in a trust account that is not used for any other purpose per paragraph 20(1)(a) of the RPAA?) Insurance or guarantee method Question 2.8: Does the PSP hold end-user funds in an account that is not used for any other purpose and hold insurance or a guarantee in respect of the funds that is in an amount equal to or greater than the amount held in the account? Select a response from the options:

Yes
No
Unsure
Question 2.8(a): For each insurance or guarantee contract obtained, indicate the insurance or guarantee provider (referred to in section 14 of the RPAR) and the name of the prudential regulator responsible for supervising that insurance or guarantee provider, as follows:
Add a separate entry for each insurance or guarantee contract. o For the “Regulator”, enter the name of the prudential regulator of the insurance or guarantee provider in the open-text field. o For the “Name of provider” and “Country or jurisdiction,” enter this information in the open-text field. This question will not be displayed if you selected No to question 2.8 (Does the PSP hold end-user funds in an account that is not used for any other purpose and hold insurance or a guarantee in respect of the funds that is in an amount equal to or greater than the amount held in the account?). Question 2.8 (b): Is the insurance or guarantee provider affiliated with the PSP within the meaning of section 3 of the RPAA? Select a response from the options:
Yes
No
Unsure
As defined in section 3 of the RPAA, affiliated entity means:
a) one entity is affiliated with another entity if one of them is the subsidiary of the other or both are subsidiaries of the same entity or each of them is controlled by the same individual or entity; b) two entities are deemed to be affiliated with each other if they are affiliated with the same entity at the same time; and c) an individual is affiliated with an entity if the individual controls the entity. For more information on affiliated entities, refer to the case scenarios about affiliated entities.

How to complete an annual report: A step-by-step guide | February 2026 | Page 22 This question will not be displayed if you selected No to question 2.8 (Does the PSP hold end-user funds in an account that is not used for any other purpose and hold insurance or guarantee in respect of the funds that is in an amount equal to or greater than the amount held in the account?). Question 2.8(c): What is the value of the policy coverage, or the amount covered under each of the PSP’s insurance or guarantee contracts? Provide details as follows:
Insurance or guarantee provider
Reference number of the insurance or guarantee contract Policy amount (Canadian dollars) Policy expiry date (if applicable) This contains prepopulated information based on the response from the question, “For each insurance or guarantee contract obtained, indicate the insurance or guarantee provider (referred to in
section 14 of the RPAR)
and the name of the prudential regulator responsible for supervising that insurance or guarantee provider.” In the open-text field, provide the reference number of the insurance or guarantee contract. In the open-text field, provide your response in numerical format. For example, $10 million should be reported as 10,000,000. Provide the date in YYYY-MM format. To input previous months and years in the calendar field, select the displayed month and click on the arrows to adjust the time frame. This question will not be displayed if you selected No to question 2.8 (Does the PSP hold end-user funds in an account that is not used for any other purpose and hold insurance or guarantee in respect of the funds that is in an amount equal to or greater than the amount held in the account?). Note: The policy number of the insurance or guarantee contract can be used as the reference number. Framework for safeguarding funds Question 2.9: Does the PSP have a documented safeguarding-of-funds framework that includes the following? Select all that apply. Multiple items may be selected if applicable:

The PSP’s liquidity approach

How to complete an annual report: A step-by-step guide | February 2026 | Page 23

The PSP’s use of secure and liquid assets to hold end-user funds and how it manages
these assets
The requirement to keep a ledger
Legal and operational risks that could hinder the PSP’s ability to meet framework
objectives
Procedures for returning end-user funds in the event of a PSP’s insolvency
None of the above
The PSP does not have a framework.
Question 2.10: When was the safeguarding-of-funds framework last reviewed? Provide the date in YYYY-MM-DD format. To input previous months and years in the calendar field, select the displayed month and click on the arrows to adjust the time frame. This question will not be displayed if you selected The PSP does not have a framework to question 2.9 (Does the PSP have a documented safeguarding-of-funds framework that includes the following?). Question 2.11: Has the PSP made any of the following changes that could reasonably be expected to have a material impact on the manner in which end-user funds are safeguarded? (refer to paragraph 15(6)(c) of the RPAR ) Select all that apply. Multiple items may be selected if applicable:
A change in the entities that provide safeguarding accounts in which end-user funds
are held
The opening or closure of a safeguarding account in which end-user funds are
held
A change to the terms of the account agreement for any safeguarding account
A change in the PSP’s insurance or guarantee provider(s)
A change to in the terms of the insurance policy or guarantee
None
This question will not be displayed if you selected The PSP does not have a framework to question 2.9 (Does the PSP have a documented safeguarding-of-funds framework that includes the following?). Question 2.11(a): Was a review conducted following the change? Select a response from the options:
Yes
No
If there were multiple changes and a review was only conducted for some of the changes, select No. This question will not be displayed if you selected The PSP does not have a framework to question 2.9 (Does the PSP have a documented safeguarding-of-funds framework that includes the following?) or if you selected None to question 2.11 (Has the PSP made any of

How to complete an annual report: A step-by-step guide | February 2026 | Page 24 the following changes that could reasonably be expected to have a material impact on the manner in which end-user funds are safeguarded?). Question 2.12: Does the PSP's safeguarding-of-funds framework identify a senior officer who is responsible for overseeing the PSP's practices for safeguarding end-user funds and for ensuring the PSP's compliance with the requirements for safeguarding end-user funds? Select a response from the options:

Yes
No, because the PSP is an individual
No
This question will not be displayed if you selected The PSP does not have a framework to question 2.9 (Does the PSP have a documented safeguarding-of-funds framework that includes the following?). As defined in section 1 of the RPAR, a senior officer of an entity means:
a) a member of the entity’s board of directors who is also one of its full-time employees b) the entity’s chief executive officer, chief operating officer, president, chief risk officer, secretary, treasurer, controller, chief financial officer, chief accountant, chief auditor or chief actuary, or any person who performs functions similar to those normally performed by someone occupying one of those positions, or c) any other officer who reports directly to the entity’s board of directors, chief executive officer or chief operating officer For more information on who can be the senior officer and their responsibilities, refer to the frequently asked questions about retail payments supervision. Question 2.13: Was the PSP’s safeguarding-of-funds framework approved during the reporting year? Multiple items may be selected if applicable:
The framework was approved by the senior officer, if any, during the reporting year
The framework was approved by the senior officer when each material change, if any,
was made to the framework
The framework was approved the board of directors, if any, during the reporting year
The PSP has not established a framework.
The PSP does not have a senior officer.
This question will not be displayed if you selected The PSP does not have a framework to question 2.9 (Does the PSP have a documented safeguarding-of-funds framework that includes the following?). Question 2.14: Does the PSP keep a ledger that serves as an accurate record of:
the amount of funds held on behalf of each end user by the PSP
the name and contact information of each end user
Select a response from the options:

How to complete an annual report: A step-by-step guide | February 2026 | Page 25

Yes
No
If you do not keep an accurate record of all the requirements, select No as the response option. Question 2.14(a): Is the amount of funds held on behalf of each end user updated in the ledger by the end of each day? Select a response from the options:
Yes
No
This question will not be displayed if you selected No to question 2.14 (Does the PSP keep a ledger that serves as an accurate record of:
the amount of funds held on behalf of each end users by the PSP
the name and contact information of each end user)
Question 2.15: Which of the following statements describe the liquidity approach that the PSP has implemented to ensure that end users have reliable access to their funds held by the PSP? Select all that apply. Multiple items may be selected if applicable:
Holding some or all end-user funds in the form of cash or cash equivalents
Holding some end-user funds in the form of secure and liquid assets (other than cash
or cash equivalents)
Using liquidity arrangements provided by one or more third parties
Implementing a policy for converting assets to cash
None of the above
Question 2.15(a): Select all that apply regarding the secure and liquid assets held. Add a separate entry for each secure and liquid asset. Type of security or other asset at December 31 of the reporting year Approximate book value at December 31 of the reporting year (Can$)

How to complete an annual report: A step-by-step guide | February 2026 | Page 26 From the drop-down menu provided, select one of the following for each row:

Guaranteed investment
certificates
Government-issued securities with a risk rating of at
least A-
Corporate-issued securities
with a rating of at least
AA-
Promissory notes with a
rating of at least A-
Funds composed of assets
mentioned previously
Other
Please provide your response in number format.
For example, if the book value is $50,000, this should be reported as 50,000. If you selected Other, enter in the open-text field the type of security or other asset that is not found in the drop-down menu. This question will not be displayed if you selected a response other than Holding some enduser funds in the form of secure and liquid assets to question 2.15 (Which of the following statements describe the liquidity approach that the PSP has implemented to ensure that end users have reliable access to their funds held by the PSP?). Question 2.15(b): Has the PSP assessed whether holding its end-user funds in secure and liquid assets compromises the validity of its trust arrangement with its end users? Select a response from the options:
Yes
No
N/A
Please select N/A if you use the insurance or guarantee method of safeguarding for funds held in the form of secure and liquid assets (other than cash or cash equivalents). This question will not be displayed if you selected a response other than Holding some enduser funds in the form of secure and liquid assets to question 2.15 (Which of the following statements describe the liquidity approach that the PSP has implemented to ensure that end users have reliable access to their funds held by the PSP?). Question 2.16: Select all components that are included in the PSP’s documentation of the procedures for returning of funds to end users. Multiple items may be selected if applicable:
a. The means by which the PSP will ensure that an insolvency administrator, trustee or any other person appointed to carry out the insolvency proceeding, or the insurance or guarantee provider, is able to:
i. access all relevant records or documentation in relation to end-user funds

How to complete an annual report: A step-by-step guide | February 2026 | Page 27
ii. contact end users as soon as feasible
iii. identify any errors or deficiencies in the PSP’s ledger of end-user funds
iv. address any shortfall in the funds to be returned to each end user
b. Procedures to be followed to return funds to end users in the event of the PSP’s insolvency
c. The role of any agents and mandataries or third-party service providers in facilitating
the execution of the tasks described above d. None of the above Question 2.17: Does the PSP’s safeguarding of funds framework include an analysis of legal and operational risks that could hinder the PSP’s ability to meet the objectives of the framework? [Subsection 15(1) of the RPAR] Select a response from the options:

Yes
No
Evaluation of insolvency protection
Question 2.18: Does the PSP take measures to identify any instance, as soon as feasible after it occurs, in which a shortfall exists in the amount of end-user funds safeguarded as required by subsection 16(1) of the RPAR? Select a response from the options:
Yes
No
Question 2.19: Report in this table instances in which shortfalls have been identified during the reporting year. Note: A shortfall is an instance where the sum of the amount of end-user funds held in trust in a trust account and, if applicable, covered by the insurance or guarantee in accordance with end-user fund safeguarding requirements is less than the amount of end-user funds held or would not have been payable to end users in the event of the PSP’s insolvency. For clarity, a shortfall includes instances when a PSP faces processing constraints that cannot be avoided despite the PSP’s best efforts, and when the PSP cannot feasibly place end-user funds in a safeguarding account on receipt (as described in paragraph 2.7 of the safeguarding end-user funds guideline). In these cases, the nature of the processing constraint should be explained as the root cause. If these instances of shortfalls are not remediated at the end of the business day following the day of receipt, you should provide details of any measures taken to prevent similar instances from recurring. There is no materiality threshold for shortfall reporting. Therefore, you are expected to report any instance of a shortfall that was identified during the reporting year. If you have a persistent issue leading to shortfalls with the same root cause over several days, the PSP may report the shortfall in one entry (i.e., row) of the annual report form. The PSP should provide the start date of the instance, the date resolved and report the shortfall amount as the maximum daily shortfall that occurred during that period.

How to complete an annual report: A step-by-step guide | February 2026 | Page 28 Shortfalls should be reported in the following table format. The table will allow for up to 50 rows of data to be reported:
Column number Column title Description

Date of Instance Provide the date in YYYY-MM-DD format.
Date resolved Provide the date in YYYY-MM-DD format.
Root cause Select from the drop-down list options provided:

Processing constraint—delay in placing
funds in a safeguarding account: PSPs internal processes
Processing constraint—delay in placing
funds in a safeguarding account: Banking partner constraints
Processing constraint—delay in placing
funds in a safeguarding account:
Payment system availability
Processing constraint—delay in placing
funds in a safeguarding account): Other
Insurance/Guarantee: Insufficient
coverage
Insurance/Guarantee: contract expiry or
cancelation
Insurance/Guarantee: inadequate
contract conditions
Trust: Invalid trust arrangement
Market value: decline in value of assets
used to hold funds
Operational: Process failure
Operational: System/IT failure
Operational: Ledger error
Operational: Erroneous removal of funds
from account
Operational: Data integrity
Operational: Third-party outage
Operational: Cyber security
Other

Shortfall amount
(Can$)
Provide this information in number format. For example, if the shortfall amount is $10,000, it should be reported as 10,000.
Description of root
cause
Provide this information in the open-text field.
For example:
The cause of the shortfall is due to processing constraints with placing funds in a safeguarding account. This was due to a lapse in the PSPs

How to complete an annual report: A step-by-step guide | February 2026 | Page 29 internal systems that were not operating overnight as intended.
6. Measures taken to
prevent recurrence
Provide this information in the open-text field.
For example:
Measures taken to prevent recurrence include regularly testing the PSPs systems and having alerts to detect any issues immediately. If you select Other in the “Root cause” row, provide information about the root cause in the open-text field. Independent review Question 2.20: When was the last independent review conducted of the PSP’s compliance with the requirements to safeguard end-user funds? Select Select Date to provide the date in YYYY-MM-DD format. To input previous months and years in the calendar field, select the displayed month and click on the arrows to adjust the time frame. If the PSP has never conducted an independent review of its compliance with the requirements relating to safeguarding end-user funds, select No independent review has been conducted as the response option. Subsection 17(1) of the RPAR requires PSPs to ensure that an independent review of its compliance with end-user funds safeguarding requirements is conducted at least every three years. Indirect arrangements Question 2.21: Does the PSP rely on an unaffiliated PSP (to act as an intermediary) to obtain access to a safeguarding account? Please see
section 6 of the Safeguarding End-User Funds guideline.
Select a response from the options:

Yes
No
Question 2.21(a): Please provide the name of any unaffiliated (intermediary) PSP(s) through which the PSP has obtained access to a safeguarding account. Select all that apply. Multiple items may be selected if applicable. Select from the drop-down list of registered PSPs and applicant PSPs. If the name does not appear in the drop-down list, select Other and enter the name of the unaffiliated (intermediary) PSP in the open-text field.

How to complete an annual report: A step-by-step guide | February 2026 | Page 30 This question will not be displayed if you selected No to question 2.21 (Does the PSP rely on an unaffiliated PSP (to act as an intermediary) to obtain access to a safeguarding account?). Question 2.22: Does the PSP act as an intermediary to provide an unaffiliated PSP(s) with access to an account at a financial institution for the purposes of safeguarding the unaffiliated PSP’s end-user funds? Select a response from the options:

Yes
No
Question 2.22(a): Please provide the name(s) of any unaffiliated PSP(s) to which the PSP has provided access to a safeguarding account. Select all that apply. Multiple items may be selected if applicable. Select from the drop-down list of registered PSPs and applicant PSPs. If the name does not appear in the drop-down list, select Other and enter the name of the unaffiliated PSP in the open-text field. This question will not be displayed if you selected No to question 2.22 (Does the PSP act as an intermediary to provide an unaffiliated PSP(s) with access to an account at a financial institution for the purposes of safeguarding the unaffiliated PSP’s end-user funds?). Exception under subsection 20(2) of the RPAA Question 2.23: Is the PSP a member of a provincial deposit insurance program as described in subsection 20(2) of the RPAA? Please note that a PSP is not considered a member of a provincial deposit insurance program just because the PSP's account provider is a member of a provincial deposit insurance program. The program must provide insurance in the event of a PSP's insolvency. Select a response from the options:
Yes
No
Note: The exception under subsection 20(2) of the Act does not apply to a PSP that holds end-user funds in an account at an entity that is a member of a provincial deposit insurance program, even if those end-user funds are recognized as insured deposits. This is because the entity providing the account is a member of the deposit insurance program rather than the PSP. The exception under subsection 20(2) of the Act is intended to prevent unnecessary duplicative protection of funds when funds are already protected by provincial legislation in the event of insolvency of a PSP that is a member of a provincial deposit insurance program. Question 2.23(a): Select the administrator of the relevant provincial deposit insurance program. Select a response from the options:
Alberta Superintendent of Financial Institutions

How to complete an annual report: A step-by-step guide | February 2026 | Page 31

Autorité des marchés financiers du Québec
British Columbia Financial Services Authority
Credit Union Deposit Guarantee Corporation of Alberta
Credit Union Deposit Guarantee Corporation of Manitoba
Credit Union Deposit Guarantee Corporation of Newfoundland and Labrador
Credit Union Deposit Guarantee Corporation of Saskatchewan
Credit Union Deposit Insurance Corporation of British Columbia
Credit Union Deposit Insurance Corporation of New Brunswick
Credit Union Deposit Insurance Corporation of Nova Scotia
Credit Union Deposit Insurance Corporation of Prince Edward Island
Deposit Insurance Reserve Fund of Ontario
Financial and Consumer Affairs Authority of Saskatchewan
Financial Services Regulatory Authority of Ontario
New Brunswick Financial and Consumer Services Commission
This question will not be displayed if you selected No to question 2.23 (Is the PSP a member of a provincial deposit insurance program as described in subsection 20(2) of the RPAA?).

How to complete an annual report: A step-by-step guide | February 2026 | Page 32
Section 3: Significant Change and Incident Reporting
Use this section to provide information about significant changes and incident reporting under the RPAA. For more information on significant changes, refer to the notice of significant change or new activity guidance. For more information on incident reporting, refer to the incident notification guidance. Question 3.1: Identify all significant changes, referred to in subsection 22(1) of the RPAA, that the PSP made during the reporting year. Select all that apply. Review the list of significant change categories presented in the drop-down menu and select all applicable changes that occurred during the reporting year. For each selected change, specify the month and year when the change took effect. o If no significant changes were made, select None. o If you selected Other, enter the nature of the change in the open-text box. o Provide the date of change in YYYY-MM-DD format. To input previous months and years in the calendar field, select the displayed month and click on the arrows to adjust the time frame. o If the same nature of change took effect on different dates, you should record each occurrence as a separate change. For example, if you began outsourcing an activity related to the provision of a retail payment activity on January 1, 2025, and again on June 30, 2025, you would enter two separate changes (i.e., one for each date, for a total of two changes) Nature of change (drop-down list) Date of change (Select month and year) Certain changes related to the safeguarding of end-user funds Started to outsource an activity related to the provision of a retail payment activity Ceased to outsource an activity related to the provision of a retail payment activity Entered into, amended or terminated an agreement with a thirdparty service provider for the provision of services related to retail payment activities that had a material impact on operational risk or the manner in which end-user funds are safeguarded Started to use any agents or mandataries for the provision of retail payment activities Ceased to use all agents or mandataries for the provision of retail payment activities Changed a technology or adopted a new technology for the provision of retail payment activities that had a materially impact

How to complete an annual report: A step-by-step guide | February 2026 | Page 33 on operational risk or the manner in which end-user funds are safeguarded Moved or expanded operations of a retail payment activity to a new geographic location Expanded retail payment activities to a new market segment or offered a new product Changed degree of participation in a payments system Participated in a new payments system Changed the organizational structure or the level of staffing in a way that had a material impact on operational risk or the manner in which end-user funds are safeguarded Other (Please describe) None Question 3.2: Identify any retail payment activities that the PSP began or ceased to perform during the reporting year. For each activity listed, select from the drop-down menu to indicate:
o Whether you began performing the activity during the reporting year o Whether you ceased performing the activity during the reporting year For each field, choose one of the following:
o Yes, if you began or ceased the activity this year. o No, if you did not begin or cease the activity. o Not applicable – if the activity is not relevant to you. If there were no changes (i.e., you continued performing the same activities as last year without additions or removals), select No for both "Began to perform?" and "Ceased to perform?" for each applicable activity. Retail payment activity Began to perform? (drop-down list) Ceased to perform? (drop-down list) Providing or maintaining a payment account:
(Provision or maintenance of an account that, in relation to an electronic funds transfer, is held on behalf of one or more end users) Yes/No/Not Applicable Yes/No/Not Applicable Holding end-user funds: (Holding of funds on behalf of an end user until they are withdrawn by the end user or transferred to another individual or entity) Yes/No/Not Applicable Yes/No/Not Applicable Initiating payments: (Initiation of an electronic funds transfer at the request of an end user) Yes/No/Not Applicable Yes/No/Not Applicable

How to complete an annual report: A step-by-step guide | February 2026 | Page 34 Authorization or Transmission, Reception, or Facilitation: (Authorization of an electronic funds transfer or the transmission, reception or facilitation of an instruction in relation to an electronic funds transfer) Yes/No/Not Applicable Yes/No/Not Applicable Clearing or settlement: (Provision of clearing or settlement services) Yes/No/Not Applicable Yes/No/Not Applicable Question 3.3: Identify all incidents that the PSP experienced during the reporting year, including those that did not need to be reported in line with section 18 of the RPAA. Select all that apply. Review the list of incident types in the drop-down list and select all that apply to you during the reporting year. This includes all incidents, regardless of whether they had a material impact on an end user, another PSP or a clearing house of a clearing and settlement system. o For each selected incident type, enter the number of incidents that occurred. Use numeric values only. For example, if there were five incidents, report 5 under “Number of incidents.” o For “an insolvency proceeding event referred to in subsection 14(3) of the RPAR,” select Yes or No, as applicable. o If you selected Other, enter a brief description and indicate the number of such incidents in the open-text field. Nature of incident (drop-down list) Number of incidents End-user funds were lost (Open-text, number format) The provider of the account used to hold end-user funds either ceased operations or was in some form of financial distress, and enduser funds held in that account were not accessible by end users in
part or in full
(Open-text, number format)
Technology/ system failure (Open-text, number format) Loss of data centre (Open-text, number format) Loss / failure of third party (including infrastructure hosting service) (Open-text, number format) Cyber attack (Open-text, number format) An insolvency proceeding event referred to in subsection 14(3) of the RPAR Yes/No Confidential information related to retail payment activities was accessed or disclosed without authorization (Open-text, number format)

How to complete an annual report: A step-by-step guide | February 2026 | Page 35 Compromise to the PSP’s ledger and transaction records (Open-text, number format) Transaction processing errors (Open-text, number format) Improper calculation at clearing or settlement by internal system(s) (Open-text, number format) Unauthorized changes to or deletion of other data or information (Open-text, number format) Other (Please describe) (Open-text, number)

How to complete an annual report: A step-by-step guide | February 2026 | Page 36
Section 4: Ubiquity and Interconnectedness
Use this section to provide information about metrics that must be reported under section 21 of the RPAA and section 19 of the RPAR. For more information on how to report the required quantitative metrics, refer to the supervisory policy on annual reporting of retail payment activity metrics. Question 4.1: Which of the PCSA-designated systems does the PSP directly participate in? Select all that apply. Review the list of PCSA-designated systems provided and select all systems in which your organization was a direct participant during the reporting year. Select None if you do not directly participate in any of the listed systems.

Automated Clearing Settlement System (ACSS)
Canadian Derivatives Clearing Service (CDCS)
CDSX
The Continuous Linked Settlement (CLS) Bank
Global Clearing Management System (GCMS) and Single Message System (SMS)
Interac e-Transfer
Inter-Member Network (IMN)
Lynx
SwapClear
VisaNet
None
Question 4.2: Does the PSP have a place of business in Canada?
No
Yes
If you selected Yes, you will be presented with the “PSP with a place of business in Canada” set of questions (4.3 to 4.9). If you selected No, you will be presented with the “PSP without a place of business in Canada” set of questions (4.10 to 4.16). PSP with a place of business in Canada The reported values in this section for all end users should be greater than or equal to the value for end users in Canada given that the values for all end users should also include those for end users in Canada. Question 4.3: Provide the maximum value, expressed in Canadian dollars, of end-user funds that the PSP held for all end users and for end users in Canada at any time during the reporting year. Report the following two separate figures:
o the maximum value of end-user funds held at any time during the reporting year for all end users (including for end users Canada) o the maximum value of end-user funds held at any time during the reporting year for end users in Canada only

How to complete an annual report: A step-by-step guide | February 2026 | Page 37 All inputs must be entered as a numerical value. For more information on how to report on this metric, refer to the supervisor policy on the annual reporting of retail payment activity metrics. This question applies to PSPs that perform payment function (b) as defined in the RPAA (holding funds on behalf of an end user until they are withdrawn or transferred to another individual or entity). If you answered No to question 2.1 (Does the PSP perform payment function (b) as defined in the RPAA (Holding funds on behalf of an end user until they are withdrawn or transferred to another individual or entity)?), enter zeroes in the table below. Maximum Jan–Dec For all end users Total in Can$ For end users in Canada Total in Can$ Question 4.4: For each month of the reporting year, provide the average value of end-user funds that the PSP held at the end of each day for all end users and for end users in Canada, expressed in Canadian dollars and broken down by currency and expressed in that currency. For each month from January to December, provide:
o the average value of end-user funds held, expressed in Canadian dollars o the average value of end-user funds held in each original currency (e.g., CAD, USD, EUR), expressed in that original currency Provide the above values separately for:
o all end users (including end users in Canada) o end users located in Canada only All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. This question applies to PSPs that perform payment function (b) as defined in the RPAA (holding funds on behalf of an end user until they are withdrawn or transferred to another individual or entity). If you answered No to question 2.1 (Does the PSP perform payment function (b) as defined in the RPAA (Holding funds on behalf of an end user until they are withdrawn or transferred to another individual or entity)?), enter zeroes in the table below and explain in the open-text field that you do not perform payment function (b). If the sum of the 12 months reported for the end-user funds held metric is zero, enter the reason for this in the open-text field. For example, due to restructuring your business, you did not hold end-user funds during the reporting period but have started to do so now.

How to complete an annual report: A step-by-step guide | February 2026 | Page 38 Jan  Feb  Mar  Apr  May  Jun  Jul  Aug  Sep  Oct  Nov  Dec For all end users Average value of end-user funds (expressed in Can$) Currency A (expressed in that currency) Currency B (expressed in that currency) [etc.] For end users in Canada Average value of end-user funds (expressed in Can$) Currency A (in original currency) Currency B (in original currency) [etc.] Question 4.5: For each month in the reporting year, provide the number of electronic funds transfers (EFTs), for all currencies combined and broken down by currency, in relation to a retail payment activity the PSP performed for all end users and for end users in Canada. For each month from January to December, report:
o the total number of EFTs conducted in all currencies combined o the number of EFTs by each individual currency used (e.g., CAD, USD, EUR) Complete the above for both:
o all end users (including end users in Canada) o end users located in Canada only All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. If the sum of the values reported for the 12 months is equal to zero, enter the reason for this in the open-text field. For example, you did not conduct any EFTs during the reporting period.

How to complete an annual report: A step-by-step guide | February 2026 | Page 39 Jan  Feb  Mar  Apr  May  Jun  Jul  Aug  Sep  Oct  Nov  Dec For all end users Total number of EFTs Currency A Currency B [etc] For end users in Canada Total number of EFTs

Currency A
Currency B
[etc]
Question 4.6: For each month in the reporting year, provide the total value of all electronic funds transfers (EFTs), expressed in Canadian dollars and broken down by currency and expressed in that currency, in relation to a retail payment activity the PSP performed for all end users and for end users in Canada. For each month from January to December, provide:
o the total value of all EFTs, expressed in Canadian dollars o the value of EFTs by each original transaction currency (e.g., CAD, USD, EUR), expressed in the original currency, as applicable Provide the above values separately for:
o all end users (including end users in Canada) o end users located in Canada only All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. If the sum of the values reported for the 12 months is equal to zero, enter the reason for this in the open-text field. For example, you did not conduct any EFTs during the reporting period. Jan  Feb  Mar  Apr  May  Jun  Jul  Aug  Sep  Oct  Nov  Dec For all end users Total value of EFTs (expressed in Can$)

How to complete an annual report: A step-by-step guide | February 2026 | Page 40 Currency A (expressed in that currency) Currency B (expressed in that currency) For end users in Canada Total value of EFTs (expressed in Can$) Currency A (expressed in that currency) Currency B (expressed in that currency) Question 4.7: Provide the number of all end users and end users in Canada for which the PSP performed a retail payment activity during the reporting year. Report the following two figures:
o Total number of all end users (including those located both outside and inside Canada) for whom you carried out a retail payment activity at any point during the reporting year o Total number of end users located in Canada for whom you carried out a retail payment activity at any point during the reporting year All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. Number of end users All end users End users in Canada Question 4.8: Provide the number of other payment service providers for which the PSP performed a retail payment activity during the reporting year and the number of those payment service providers with a place of business in Canada. Report the following two figures:
o Total number of other PSPs (including those with a place of business located both outside and inside Canada) for whom you carried out a retail payment activity at any point during the reporting year

How to complete an annual report: A step-by-step guide | February 2026 | Page 41 o Total number of other PSPs that had a place of business in Canada for whom you carried out a retail payment activity at any point during the reporting year All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. Number of PSPs All PSPs PSPs with a place of business in Canada Question 4.9: Provide an estimate of the total value of electronic funds transfers (EFTs), broken down by payment method, in relation to a retail payment activity that the PSP performed, expressed as a share of the total over the reporting period for all end users and for end users in Canada. Provide an estimated percentage for the value of EFTs attributable to each of the payment methods for all end users and for end users in Canada only. For each group, the total must add up to 100%. All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. % Jan–Dec For all end users  100%

Card issuance
Card acceptance
Direct credit or direct debit
E-money or digital wallet
International remittance
Other
For end users in Canada  100%
Card issuance
Card acceptance
Direct credit or direct debit
E-money or digital wallet
International remittance
Other

How to complete an annual report: A step-by-step guide | February 2026 | Page 42 PSP without a place of business in Canada Question 4.10: Provide the maximum value, expressed in Canadian dollars, of end-user funds that the PSP held for end users in Canada at any time during the reporting year. Report the maximum value of end-user funds held at any time during the reporting year for end users in Canada only. All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. This question applies to PSPs that perform payment function (b) as defined in the RPAA (holding funds on behalf of an end user until they are withdrawn or transferred to another individual or entity). If you answered No to question 2.1 (Does the PSP perform payment function (b) as defined in the RPAA (Holding funds on behalf of an end user until they are withdrawn or transferred to another individual or entity)?), enter zeroes in the table below. Enter the value in the field provided. Maximum Jan– Dec End users in Canada Total (in Can$) Question 4.11: For each month of the reporting year, provide the average value of the end-user funds that the PSP held at the end of each day for end users in Canada, expressed in Canadian dollars and broken down by currency and expressed in that currency. For each month from January to December, provide:
o the average value of end-user funds held, expressed in Canadian dollars, for end users located in Canada only o the average value of end-user funds held in each original currency (e.g., CAD, USD, EUR), expressed in that original currency, for end users located in Canada only All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. This question applies to PSPs that perform payment function (b) as defined in the RPAA (holding funds on behalf of an end user until they are withdrawn or transferred to another individual or entity). If you answered No to question 2.1 (Does the PSP perform payment function (b) as defined in the RPAA (Holding funds on behalf of an end user until they are

How to complete an annual report: A step-by-step guide | February 2026 | Page 43 withdrawn or transferred to another individual or entity)?), enter zeroes in the table below and explain in the open-text field that you do not perform payment function (b). If the sum of the 12 months reported for the end-user funds held metric is zero, enter the reason for this in the open-text field. For example, due to restructuring your business, you did not hold end-user funds during the reporting period but have started to do so now. Jan   Feb   Mar   Apr   May   Jun   Jul   Aug   Sep   Oct   Nov   Dec For end users in Canada Average value of end-user funds (expressed in Can$) Currency A (in original currency) Currency B (in original currency) Question 4.12: For each month in the reporting year, provide the number of electronic funds transfers (EFTs), for all currencies combined and broken down by currency, in relation to a retail payment activity the PSP performed for end users in Canada. For each month from January to December, report:
o the total number of EFTs conducted in all currencies combined for end users in Canada only o the number of EFTs by each individual currency used (e.g., CAD, USD, EUR) for end users in Canada only All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. If the sum of the values reported for the 12 months is zero, enter the reason for this in the open-text field. For example, you did not conduct any EFTs during the reporting period. Jan   Feb   Mar   Apr   May   Jun   Jul   Aug   Sep   Oct   Nov   Dec For end users in Canada Total number of EFTs Currency A Currency B

How to complete an annual report: A step-by-step guide | February 2026 | Page 44 Question 4.13: For each month in the reporting year, provide the total value of all electronic funds transfers (EFTs), expressed in Canadian dollars and broken down by currency and expressed in that currency, in relation to a retail payment activity the PSP performed for end users in Canada. For each month from January to December, report:
o the total value of all EFTs, expressed in Canadian dollars, for end users in Canada only o the value of EFTs by each original transaction currency (e.g., CAD, USD, EUR), expressed in that original currency, for end users in Canada only All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. If the sum of the values reported for the 12 months is zero, enter the reason for this in the open-text field. For example, you did not conduct any EFTs during the reporting period. Jan  Feb  Mar  Apr  May  Jun  Jul  Aug  Sep  Oct  Nov  Dec For end users in Canada Total value of EFTs (expressed in Can$) Currency A (in original currency) Currency B (in original currency) Question 4.14: Provide the number of end users in Canada for which the PSP performed a retail payment activity during the reporting year. Report the total number of end users located in Canada for whom you carried out one or more retail payment activities at any point during the reporting period. All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. Number of end users End users in Canada

How to complete an annual report: A step-by-step guide | February 2026 | Page 45 Question 4.15: Provide the number of other payment service providers with a place of business in Canada for which the PSP performed a retail payment activity during the reporting year. Report the total number of other PSPs that had a place of business in Canada for whom you carried out a retail payment activity at any point during the reporting year. All inputs must be entered as a numerical value. For more information on how to report this metric, refer to the supervisory policy on the annual reporting of retail payment activity metrics. Jan–Dec PSPs with a place of business in Canada Question 4.16: Provide an estimate of the total value of electronic funds transfers (EFTs), broken down by payment method, in relation to a retail payment activity that the PSP performed, expressed as a share of the total over the reporting period for end users in Canada. The breakdown should reflect the value of EFTs associated with each category of payment method. All percentages must sum to 100%. You must include values only for end users in Canada. % Jan–Dec For end users in Canada   100%

Card issuance
Card acceptance
Direct credit or direct debit
E-money or digital wallet
International remittance
Other

How to complete an annual report: A step-by-step guide | February 2026 | Page 46
Section 5: Financial Information
Use this section to provide financial information required under the RPAA. Question 5.1: Provide the following financial metrics:
Financial metrics Explanation of terms
Year ended (most recent financial information):
You are expected to report to the
Bank your financial metrics as at your financial year-end date for the next reporting period. For example, if your financial year-end is June 30, you will report financial metrics at June 30, 2026, in the annual report for the 2026 reporting period, to be submitted by March 31, 2027. Provide in YYYY-MM-DD format the date on which the year ended for your most recent financial information . You may fill in the field directly using the prescribed format or use the calendar button to select the date. To input previous months and years in the calendar field, select the displayed month and click on the arrows to adjust the time frame. Reporting currency Report your financial metrics with respect to revenues, profits or loss, etc., in Canadian dollars (Can$). If you prepare your financial statements in an alternative currency, you should calculate and report the Can$ equivalent (at your reporting date for its financial statements). To convert to Can$, you should:

use the Bank’s exchange
rates, or
if the alternative currency
is not in the Bank’s exchange rate list, use exchange rate data from a source used during your normal course of business From the drop-down list, select the reporting currency in which you will be reporting your financial metrics. Revenue Total revenue Report the income arising in the course of your ordinary activities. You must provide your total revenues for all activities, including retail payment activities and non-retail payment activities. Use the open-text field to provide the value in numerical format, rounded to two decimal places. For example, $10,000.25 must be reported as 10000.25.

How to complete an annual report: A step-by-step guide | February 2026 | Page 47 Revenue from retail payment activities Report the revenue that is directly attributable to your retail payment activities, as defined in
section 2 of the RPAA. This should
include all fees and other revenue associated with the performance of a payment function (e.g., account fees, transactions fees, authorization fees, commissions from payment networks and revenue attributable to the provision of clearing and settlement services). If you do not have a place of business in Canada, you should include only revenue attributable to retail payment activities that are performed for end users in Canada. A best estimate will suffice if you have difficulty calculating a precise revenue
figure.
Operating expenses Report the total operating and administration expenses incurred through normal business operations. Profit or loss before tax Report the total revenue less all expenses other than tax for the period. Where you report a loss before tax, the loss amount should be denoted by a negative
figure.
Total assets Include both current and noncurrent assets of the PSP. Total liabilities Include both current and noncurrent liabilities of the PSP. Total equity Report the difference between your total assets and total liabilities. Where you report a negative equity position, the negative equity amount should be denoted by a negative figure. Unless otherwise stated, financial metrics should cover your entire business, including all retail payment activities and non-retail payment activities.

How to complete an annual report: A step-by-step guide | February 2026 | Page 48 The legal entity registered with the Bank is the one reporting all the information in the annual report form, including financial metrics. For example, if you have affiliated entities that are not subject to the RPAA or are registered separately as PSPs in accordance with the RPAA, you should report financial metrics with respect to yourself and not include metrics for affiliates. For more detail on what is expected in this area, refer to the annual reporting guideline. Question 5.2: Are the PSP’s financial statements audited annually? Select a response from the options:

Yes
No
You may report unaudited financial metrics in the annual report form if either of the following applies:
o You prepare audited financial statements for other purposes, but the audit for the reporting year (as required under the RPAA) has not yet been completed at the time you submit the annual report form. For instance, your financial year-end date is December 31, 2025, but the financial statements will not be audited until April 2026 (which is after the deadline to submit an annual report). In these circumstances, you may provide unaudited financial metrics if they are more up-to-date than the audited metrics (e.g., you may provide unaudited financial metrics for the reporting year ending on December 31, 2025 instead of the audited financial metrics for the reporting year-end on December 31, 2024). o You do not prepare audited financial statements for any other purpose. Question 5.3: Were the amounts provided in the PSP’s financial metrics covered in the most recent audit of the PSP’s financial statements? Select a response from the options:
Yes
No
This question will not be displayed if you selected No to question 5.2 (Are the PSP’s financial statements audited annually?). Question 5.4 Does the PSP prepare financial statements as part of any ongoing reporting obligations? Select a response from the options:
Yes
No
Question 5.5: The PSP’s most recent set of financial statements is for which year? Provide the date in YYYY-MM-DD format. You may fill in the field directly using the prescribed format or use the calendar button to select the date. To input previous months and years in the calendar field, select the displayed month and click on the arrows to adjust the time frame.

How to complete an annual report: A step-by-step guide | February 2026 | Page 49 This question will not be displayed if you selected No to question 5.4 (Does the PSP prepare financial statements as part of any ongoing reporting obligations?). Question 5.6: What accounting standards apply to the PSP’s financial reporting? Select a response from the options:

Generally Accepted Accounting Principles (GAAP)
International Financial Reporting Standards (IFRS)
Other
If you selected Other, describe the accounting standard in the open-text field. This question will not be displayed if you selected No to question 5.4 (Does the PSP prepare financial statements as part of any ongoing reporting obligations?).

How to complete an annual report: A step-by-step guide | February 2026 | Page 50
Section 6: Record-keeping
Use this section to provide information about metrics related to record keeping required under the RPAA. For more information on record keeping refer to the guidance on record keeping. Question 6.1: Has the PSP appropriately documented and retained all relevant records to demonstrate compliance with the PSP’s obligations underthe RPAA? Select a response from the options:

Yes
Partially
No