RPAA Registration in 2026: Bank of Canada Guide for Payment Service Providers
How Canada's Retail Payment Activities Act works in 2026: who counts as a payment service provider, Bank of Canada registration and national security review, operational risk and incident response, safeguarding of end-user funds, annual and incident reporting, how RPAA sits next to FINTRAC MSB registration, and what registered PSPs can now do with Payments Canada and the Real-Time Rail.
What the RPAA is and who it covers
The Retail Payment Activities Act (RPAA) is the federal law that brought non-bank payment companies in Canada under supervision by the Bank of Canada. It received Royal Assent on 29 June 2021, the Retail Payment Activities Regulations were published in November 2023, and the Bank's supervision started on 8 September 2025. Since that date, a payment service provider (PSP) in scope must be registered with the Bank before it performs any retail payment activity.
A PSP is a person or entity that performs a payment function as a service or business activity that is not incidental to another business. A retail payment activity is a payment function performed in relation to an electronic funds transfer in Canadian dollars, a foreign currency, or a unit that meets prescribed criteria. The Act lists five payment functions:
Accounts
Providing or maintaining an account held on behalf of one or more end users, such as an e-wallet or stored-value account.
Holding funds
Holding funds on behalf of an end user until they are withdrawn or transferred. This is the function that triggers the safeguarding rules.
Initiation
Initiating an electronic funds transfer at the request of an end user, for example a remittance or bill payment app.
Authorization and transmission
Authorizing a transfer, or transmitting, receiving or facilitating a payment instruction. Gateways and many acquirers sit here.
Clearing and settlement
Providing clearing or settlement services for payment transactions.
Exclusions
The Act does not apply to banks, authorized foreign banks, credit unions and caisses populaires, insurance and trust companies, provincially regulated deposit takers, Payments Canada or the Bank of Canada itself. It also excludes certain activities: closed-loop instruments that can only be used with the issuing merchant or its group, eligible financial contracts and prescribed securities transactions, cash withdrawals at ATMs, systems designated under the Payment Clearing and Settlement Act, and transfers between affiliated entities where no other PSP is involved. An agent or mandatary acting within its authority for a registered PSP, and named on that PSP's list, does not register separately, but the PSP stays liable for what the agent does.
Territorial scope
The RPAA applies to every PSP with a place of business in Canada. It also applies to a PSP with no Canadian place of business if it performs retail payment activities for an end user in Canada and directs those activities at individuals or entities in Canada. A foreign PSP that markets to Canadians, onboards Canadian customers or prices in CAD should assume it is in scope. Foreign PSPs must name an agent or mandatary in Canada who can receive notices from the Bank.
Building a business on this licence?
See what the platform covers for it: the regulator's IT questions, rails, providers and the technical part of your application.
- Core banking for Canadian MSBs
- Crypto banking for Canadian MSBs dealing in virtual currency
- E-wallets for Canadian PSPs
- Money transfer platform for Canadian MSBs
RPAA vs FINTRAC MSB registration: two regimes, often both
The RPAA does not replace FINTRAC. The two regimes look at different risks, and a remittance company, e-wallet or payment app that moves money for clients will usually need both registrations. FINTRAC checks that you can stop money laundering and terrorist financing. The Bank of Canada checks that your service keeps running and that client money is still there if you fail.
| Dimension | RPAA (Bank of Canada) | MSB (FINTRAC) |
|---|---|---|
| Legal basis | Retail Payment Activities Act and Retail Payment Activities Regulations | Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) |
| Focus | Operational risk, incident response, safeguarding of end-user funds | AML and counter-terrorist financing, sanctions, reporting suspicious and large transactions |
| Who is caught | Anyone performing one of the five payment functions as a non-incidental business | Money transfer, foreign exchange, money orders, virtual currency dealing, crowdfunding platforms and other listed services |
| Fee | CAD 2,500 application fee, annual assessment fees still being finalised | No registration fee |
| Renewal | Registration stays in force; notices required for changes | Renewal every two years |
| Main documents | Risk management and incident response framework, safeguarding-of-funds framework, annual report | Compliance program, risk assessment, KYC procedures, STR and other reports |
The two regimes are linked in practice. The RPAA application asks for your FINTRAC registration status, and the Bank shares information with FINTRAC. If you have not yet registered as a money services business, start with our guide on MSB registration in Canada, because a PSP that moves funds without the FINTRAC side in place will struggle to explain its model to the Bank.
The registration process and timeline
Existing PSPs had a fixed window from 1 to 15 November 2024 to apply and keep operating during the transition period, which ran until 7 September 2025. Close to 1,500 PSPs had applied when supervision began. Anyone starting now applies through the Bank's PSP Connect portal and has to wait for a registration decision before performing any retail payment activity.
Scope analysis
Map your product against the five payment functions, the exclusions and the incidental test. Document the conclusion.
Application
File in PSP Connect with the CAD 2,500 non-refundable fee. The Bank shares the file with the Department of Finance.
National security review
The Minister of Finance has 60 days to decide whether to review, plus 60 more if extra information is requested. A review itself runs 180 days and can be extended.
Decision and registry
The Bank registers or refuses the application. Registered PSPs appear on the public PSP registry with their payment functions and agents.
The application asks for more than corporate details. Expect to provide:
- legal name, trade names, address and whether the business runs from a dwelling house;
- organizational structure, affiliated entities, directors, officers and people who control the PSP;
- a description of each retail payment activity and estimates of end users and volumes;
- how you safeguard end-user funds and a summary of your risk management framework;
- third-party service providers you rely on, and your agents and mandataries;
- FINTRAC registration status, provincial registrations and, for foreign PSPs, the Canadian agent for notices.
Plan for at least two to three months from filing to decision, and much longer if your ownership chain is complex or includes investors from higher-risk jurisdictions. A change in control later requires a new application before the acquisition closes, so build that into any fundraising timeline.
Operational risk and incident response framework
Section 17 of the Act requires a written risk management and incident response framework. The regulations describe what it must contain, and the requirements are proportionate: a PSP whose failure would hit many end users or other PSPs is expected to do more.
Objectives and targets
Keep services running without reduction, deterioration or breakdown, and protect the confidentiality, integrity and availability of systems and data. Set measurable reliability targets, such as availability per service.
Identify and protect
Identify operational risks across cyber security, fraud, business continuity, third parties and other categories, then apply controls that bring them within your risk tolerance.
Detect and respond
Continuous monitoring to detect incidents and anomalies early, an incident response plan with escalation paths, immediate investigation and root cause analysis, and recovery procedures.
Third parties and agents
Assess third-party service providers and agents at least once a year and before contract changes, allocate responsibilities for data in the contract, and keep oversight of how they perform.
Governance matters as much as content. A senior officer must be responsible for the framework, which is reviewed and approved at least once a year by that officer and the board. You must test the framework with a method that fits your size and importance, and an independent reviewer with no prior involvement must assess it at least once every three years.
Outsourcing does not move responsibility. If your ledger, card processor or cloud provider fails, the Bank will still look at your framework, your assessments of that provider and your contingency plan.
Safeguarding end-user funds
If you hold end-user funds "at rest", meaning available for a future transfer or withdrawal, section 20 of the Act requires you to protect them in one of two ways, or a mix of both:
Trust account
Hold the funds in trust in a trust account not used for any other purpose. The PSP should not pay its own expenses from it.
Segregated account plus insurance or guarantee
Hold the funds in a dedicated account and buy insurance or a guarantee for at least the amount held, from an unaffiliated, prudentially regulated institution.
Holding money in an account at a deposit-insured institution is not enough on its own. No right of set-off may apply to the safeguarding account. The Bank expects a direct relationship with the account provider and is sceptical of arrangements where another PSP sits in between.
On top of the account itself, you need a written safeguarding-of-funds framework, approved annually by the senior officer and the board, that covers:
- a ledger showing the name and contact details of each end user and the amount held for each at the end of every day;
- placing funds into the safeguarding account promptly, and at the latest on the business day after receipt where processing constraints cannot be avoided;
- measures to detect and investigate any shortfall, which must be recorded and reported in the annual report;
- a liquidity approach if you hold part of the funds in secure and liquid assets other than cash;
- procedures to return funds to end users if the PSP becomes insolvent, including a final reconciliation;
- a legal and operational risk analysis of the arrangement, and an independent review at least once every three years.
The regulations do not use the words "daily reconciliation", but an end-of-day ledger per client and a duty to find shortfalls leave little room for anything less in a business with real volumes.
Reporting obligations after registration
Registration is the start of an ongoing reporting relationship. All filings go through PSP Connect.
| Report | Trigger | Deadline |
|---|---|---|
| Annual report | Every registered PSP. Covers the risk framework, incidents, third-party assessments, safeguarding arrangements, testing and activity metrics for the calendar year. | By 31 March of the following year. |
| Incident notice | An incident with a material impact on end users, other PSPs or a clearing house. | Without delay, and no later than 48 hours after deciding it is material. Interim and final notices follow. |
| Notice to affected users | The same material incidents, sent to affected end users, PSPs or clearing houses. | Without delay, generally within the same 48 hours. |
| Significant change notice | A change that could materially affect operational risk or safeguarding, or a new retail payment activity. | At least five business days before the change. |
| Changes to registration information | Address, agents, business structure, directors, affiliates and similar details. | Mostly within 30 days; some as soon as feasible or in advance. |
| New application | Acquisition of control or another prescribed change. | Before the change takes effect. |
Records that show compliance must be kept for five years. The Bank can impose administrative monetary penalties of up to CAD 10 million per violation, and in 2026 it issued a compliance order and began publishing notices of violation, so the supervisory phase is now active.
Payments Canada membership and the Real-Time Rail
RPAA registration has a practical upside. Amendments to the Canadian Payments Act came into force on 29 September 2025 and made PSPs supervised by the Bank of Canada eligible for Payments Canada membership. Before that, a fintech had to reach Canadian clearing indirectly, through a member such as a bank or credit union.
Registration first
Only PSPs registered under the RPAA can apply, with proof of registration.
Quarterly decisions
Payments Canada's board reviews membership applications quarterly. Membership alone does not give access to a payment system.
Real-Time Rail
Members can apply to participate in the Real-Time Rail, which Payments Canada plans to launch in Q4 2026.
Each system has its own technical, operational and security requirements. A PSP that wants direct access should treat its RPAA frameworks as the foundation and expect Payments Canada to test the same things in more depth: availability, incident handling, settlement and liquidity.
What your technology has to support
Most RPAA requirements end up as system requirements. When the Bank asks for evidence, it will be data from your platform, not a policy PDF.
Per-client ledger
End-of-day balance for every end user, with name and contact details, separate from the company's own money.
Safeguarding reconciliation
Daily comparison of client liabilities against the trust or safeguarding account, with shortfalls flagged and logged.
Incident log
Timestamps for detection, materiality decision and notices, so the 48-hour clock can be proven.
Audit trail
Who changed what and when, kept for five years in a form the Bank can read.
Third-party register
Providers and agents, their roles, assessment dates and findings, linked to the services they support.
KYC and AML
Onboarding, screening, transaction monitoring and reports for the FINTRAC side of the business.
A core banking platform such as Crassula can provide the multi-currency ledger with per-client balances, client onboarding, transaction history and back-office audit logs that these processes rely on. Your trust or safeguarding accounts, insurance, incident procedures and governance stay your responsibility. If you want to see how this maps to your product, request a demo.
RPAA vs FINTRAC MSB vs UK EMI safeguarding
Teams that already hold a UK e-money licence often ask how far their existing controls carry over to Canada. The short answer: further on safeguarding than on AML.
| Dimension | RPAA (Canada) | FINTRAC MSB (Canada) | UK EMI |
|---|---|---|---|
| Regulator | Bank of Canada | FINTRAC | FCA |
| Client fund protection | Trust account, or segregated account with insurance or guarantee | No safeguarding regime | Segregation in a safeguarding account, or insurance or a comparable guarantee |
| Timing of placement | Promptly, at the latest the next business day | Not applicable | By the end of the business day after receipt |
| Reconciliation and returns | End-of-day ledger per client, shortfalls in the annual report | Not applicable | Daily reconciliation and a monthly safeguarding return under CASS 15 since 7 May 2026 |
| Independent check | Independent review at least every three years | Effectiveness review of the AML program every two years | Annual safeguarding audit for most firms |
| Capital requirement | None prescribed | None prescribed | Initial capital of EUR 350,000 equivalent plus own funds |
For the UK side in detail, see our UK EMI licence guide and the CASS 15 safeguarding guide.
FAQ
Usually yes. FINTRAC registration covers anti-money laundering duties, while the RPAA covers operational risk and the safeguarding of client funds. A money transfer business or e-wallet that performs one of the five payment functions needs both, and the RPAA application asks for your FINTRAC registration status. See our MSB in Canada guide for the FINTRAC side.
The Minister of Finance has 60 days to decide whether to run a national security review, extendable by another 60 days if more information is needed. If a review takes place, it lasts 180 days and can be extended. A straightforward application can be decided in a few months, a complex ownership structure can take well over half a year. You cannot start retail payment activities before you are registered.
The application fee is CAD 2,500 and is non-refundable. The Bank of Canada will also charge annual assessment fees to recover supervision costs, made up of a base amount and a variable part tied to activity, but as of October 2026 the formula is still being finalised. The larger cost is building and running the frameworks, insurance or trust arrangements and independent reviews.
Any registered PSP that holds end-user funds at rest, meaning money that stays with the PSP until the user transfers or withdraws it. Pure gateways that never hold balances do not safeguard, but they still need the risk management and incident response framework.
Mostly not. The Bank of Canada has said a pure crypto exchange performs no retail payment activity, and a crypto-to-fiat exchange is generally outside the Act because its payment functions are incidental or excluded. A company issuing crypto-backed prepaid cards is in scope for the card. Fiat-backed stablecoins could be brought in if they are prescribed by regulation, and the federal stablecoin framework is expected to come into force in 2027.
Yes, if they have no place of business in Canada but perform retail payment activities for end users in Canada and direct those activities at Canadians. A foreign PSP must also name an agent or mandatary in Canada to receive notices from the Bank.
An incident with a material impact must be reported without delay and no later than 48 hours after the PSP determines it is material. Affected end users and PSPs must also be told. The PSP then files interim and final notices through PSP Connect once the root cause and impact are known.
Yes. Since 29 September 2025 PSPs supervised under the RPAA are eligible for Payments Canada membership. The board reviews applications quarterly, and members then apply separately to join individual systems such as the Real-Time Rail, planned to launch in Q4 2026.
