What the RPAA is
The Retail Payment Activities Act (RPAA) is the federal law that brought payment service providers (PSPs) under supervision by the Bank of Canada. It has two start dates that matter. Registration opened on November 1, 2024, and the core obligations (operational risk management, incident response, safeguarding of end-user funds and reporting to the Bank) have applied since September 8, 2025.
The RPAA is not an anti-money laundering law. Money laundering and terrorist financing stay with FINTRAC under the PCMLTFA. The Bank of Canada looks at something different: whether your payment operations are resilient, and whether your customers' money is protected if something goes wrong, including your own insolvency.
This guide covers who has to register, what the application involves, the obligations that apply once you are registered, what the penalties are, and how the RPAA sits next to FINTRAC MSB registration. If you are at the application stage, our page on RPAA registration with the Bank of Canada covers the filing itself.
Who has to register
You are in scope if you perform one or more payment functions for end users as a service or business activity. The Act lists five:
- providing or maintaining an account held on behalf of end users;
- holding funds on behalf of an end user;
- initiating an electronic funds transfer at the request of an end user;
- authorizing or transmitting an electronic funds transfer;
- clearing or settling electronic funds transfers.
Wallets, payment apps, payment facilitators, remittance platforms and many API-based payment businesses perform at least one of these.
There is no volume threshold
A PSP in scope has to register whatever its size, and the Bank of Canada says so in terms: registration applies whether or not the business generates revenue. There is no minimum annual volume below which the Act stops applying.
Foreign PSPs are covered too
The Act reaches a PSP with a place of business in Canada, and also one without a Canadian presence that performs retail payment activities for end users in Canada and directs those activities at individuals or entities here. A foreign PSP has to name an agent or mandatary in Canada in its application.
Who is excluded
The main exclusions are:
- banks and authorized foreign banks under the Bank Act;
- provincially regulated credit unions, caisses populaires, insurance companies, trust companies and loan companies;
- payment functions performed within a designated payment system, such as those overseen under the Payment Clearing and Settlement Act;
- agents and mandataries of a registered PSP acting within the scope of that authority;
- certain internal transactions and securities-related settlement.
Whether an exclusion fits your model depends on how money actually moves through it, so map your flows against the payment functions before you decide you are out of scope.
How registration works
Register before you start
The transition period ended on September 8, 2025. From then on, a business that plans to perform retail payment activities has to be registered with the Bank of Canada before it performs any. Failing to register is classed as a very serious violation.
The application and the fee
Applications go to the Bank of Canada with a flat, non-refundable fee of $2,500. The application describes your retail payment activities, how you safeguard end-user funds, your operational risk and incident response arrangements, and the people who own and control the business.
Review, and the national security review
The Bank reviews the application and can ask for more information. Separately, the Minister of Finance can put an application through a national security review, which can run for 180 days and can be extended. Plan the launch of a new payment product in months, not weeks, and file early.
What you have to do once registered
An operational risk and incident response framework
You need a written framework for identifying and managing operational risk and for responding to incidents, built to the Bank's guideline on operational risk and incident response. The Retail Payment Activities Regulations spell out what it has to contain:
- objectives for uninterrupted service and for the integrity and confidentiality of your activities and data, with measurable reliability targets;
- the people, skills, training and budget behind the framework, and who is responsible for what;
- an inventory of your systems, data and business processes, classified by how sensitive and critical they are;
- identified risks and matching controls, covering at least business continuity and resilience, cyber security, fraud and third parties, with continuous monitoring for incidents;
- an incident response plan that requires immediate investigation, containment and remediation, and sets out manual or alternate measures for when your primary systems are down;
- an assessment of each third-party service provider at least once a year, and before a contract is signed, renewed or substantially changed.
The framework is reviewed at least once a year and before any material change to your operations, tested under a written methodology, and approved by your senior officer and, if you have one, your board. Outsourcing does not move the obligation: if a processor, cloud host or banking partner fails, the Bank expects your framework to have anticipated it.
Safeguarding end-user funds
What counts as holding funds depends on whether the money is waiting with you or already on its way, and the Bank's case scenarios treat three common models differently:
- Immediate transfer. Funds received with an instruction to transfer them immediately are not held, even if processing takes a few days. On the receiving side, though, funds that have arrived and wait for the recipient to collect them are held until they are withdrawn.
- Scheduled or future-dated transfer. Funds are held from the moment you receive them until you begin processing the transfer on its date. The instruction already exists, but the money is not in transit until processing starts.
- E-wallet or stored balance. Funds are held from the moment you receive them until you receive an instruction to transfer them all to another person.
If you run more than one of these models, map each flow separately: the same platform can hold funds in one and not in another.
If you hold end-user funds, you have to protect them from your own creditors. The accepted approaches are holding the funds in trust, or holding them in a segregated account backed by insurance or a guarantee from an approved provider. Either way you need documented procedures to pay end users out as soon as feasible if you become insolvent. Commingling customer money with operating money is exactly what this rule exists to stop.
Notices, and the clocks they run on
Much of the enforcement risk after registration comes from notices filed late or not at all. Each one has its own clock:
| Event | When the Bank must hear from you |
|---|---|
| Incident with a material impact | Without delay, and no later than 48 hours after you determine it is material. Affected end users, PSPs and clearing houses are notified too, and a final notice follows once the root cause and impact are known. |
| Significant change, or a new retail payment activity | At least 5 business days before the change, with your assessment of its effect on operational risk and safeguarding |
| Change to registration information | Most items, including your name, contact details, agents, third-party service providers and where you operate: within 30 days after the change. Certain business structure, affiliate and personal information items: as soon as feasible after you become aware. Some personal and financial information items: 30 or 60 days before the change takes effect. |
| Acquisition of control and certain other organizational changes | The PSP being acquired files a new application and must be re-registered by the Bank before the change takes effect. Filing alone is not enough: closing first means operating without valid registration. |
| Annual report | By March 31, covering the previous calendar year |
The annual report is filed through PSP Connect and runs to between 50 and 95 questions depending on your activities. It asks, in detail, whether the framework you registered with is the one you actually run. The change-of-control rule matters for anyone buying or investing in a PSP: the Bank has to complete re-registration before closing, so the deal timetable has to allow for its review. We cover the deal side in our guide to buying and selling MSBs in Canada.
What the RPAA does not impose
There are no capital requirements under the RPAA, no quarterly financial statements and no consumer-disclosure rules of the kind found in banking law. Articles that describe the Act as a prudential capital regime are describing something else.
Penalties
The Bank of Canada enforces the RPAA with administrative monetary penalties of up to $1 million for a serious violation and up to $10 million for a very serious one. Operating without registration, failing to maintain the operational risk framework and failing to safeguard end-user funds all sit in the very serious category. Late reports and notices can draw a penalty for each day they stay outstanding.
Violations are now published by name
On June 12, 2026 the Bank announced it would publish notices of violation once the period for representations has passed. A published notice appears in the Bank's enforcement decisions and on the PSP's entry in the public registry, and stays public for five years. The first decisions, published over the summer of 2026, all concerned businesses that performed retail payment activities before they were registered, and each carried a $0 penalty. That is not a grace period: the violation is still on the record, where banking partners and acquirers will find it.
What is changing next
The Budget 2025 Implementation Act, which received Royal Assent on March 26, 2026, amends the RPAA to add the transmission or maintenance of an end user's encrypted or tokenized payment instrument, or of an end user's private key, to the list of payment functions. Those amendments are not yet in force and need an order in council to commence. The same Act created the Stablecoin Act, which puts stablecoin issuers under Bank of Canada supervision once its regulations are in place. If your product touches tokenized card credentials, wallets or keys, watch both.
RPAA and FINTRAC MSB registration
The two regimes answer different questions and do not replace each other. FINTRAC registration under the PCMLTFA is about money laundering and terrorist financing: client identification, reporting, record keeping and a compliance program. RPAA registration with the Bank of Canada is about operational resilience and protecting end-user funds.
Many payment businesses need both. A remittance app that holds customer balances is an MSB for FINTRAC and a PSP for the Bank. A platform that offers foreign exchange or virtual currency alongside fiat wallets is usually in the same position. You register separately, report separately, and run two sets of obligations that overlap only at the edges, such as ownership information and governance. For the FINTRAC side, see our guides to MSB registration, building an AML program and the two-year effectiveness review.
Work out your RPAA status before you launch
Because there is no threshold and registration has to come first, the time to decide whether you are a PSP is before your first payment, not after a partner or the Bank asks.
Frequently asked questions
Is there a transaction volume threshold for the RPAA?
No. Scope depends on what you do, not how much of it. A business that performs a payment function for end users in Canada is in scope at any volume, whether or not it generates revenue, unless an exclusion applies.
Does MSB registration with FINTRAC cover the RPAA?
No. FINTRAC registration covers anti-money-laundering obligations under the PCMLTFA; the RPAA covers operational risk and end-user funds with the Bank of Canada. Many payment businesses need both, and one does not exempt you from the other.
How quickly do I have to report an incident?
Without delay, and no later than 48 hours after you determine that the incident has a material impact. You also notify affected end users and other affected PSPs and clearing houses, and file a final notice once the root cause and impact are known.
Do funds in transit count as holding end-user funds?
Not if they arrive with an instruction to transfer them immediately, even when processing takes a few days. Funds for a scheduled transfer are held until you begin processing it on its date, and e-wallet balances are held until you receive an instruction to transfer them all. Held funds must be safeguarded in trust or in a segregated account backed by insurance or a guarantee.
What happens if we operated before registering?
It is a very serious violation. The first published decisions for it carried $0 penalties, but they stay public for five years and appear on the PSP's registry entry. Apply now, with a complete file.
When is the RPAA annual report due?
By March 31 each year, covering the previous calendar year, filed through PSP Connect. It runs to between 50 and 95 questions depending on your activities.
The short version
If you perform a payment function for end users in Canada, from here or from abroad, you almost certainly need to be registered with the Bank of Canada before you start, whatever your volume. Once registered, the work is an operational risk and incident framework, real safeguarding of customer funds, advance notice of significant changes and an annual report by March 31. If you also move money or deal in virtual currency, FINTRAC MSB registration sits alongside it.
Planning a payment service business in Canada?
RPAA compliance is complex, but navigable with the right guidance. We've helped payment companies, fintech startups, and digital wallet operators successfully navigate RPAA registration, MSB compliance, and dual regulatory frameworks.
Whether you're launching a payment product, unsure whether you are in scope, or preparing your application, start with a free consultation. We'll assess your specific business model, identify all applicable regulatory requirements, and give you a clear implementation roadmap.
Book your free consultation