RPAA registration · Bank of Canada
RPAA registration with the Bank of Canada
Under the Retail Payment Activities Act you have to be registered before you perform a single retail payment activity, and the Bank has to approve you first.
We run the whole application, and the framework it rests on.
Why payment businesses struggle with the RPAA
New regulatory layer
The RPAA is separate from FINTRAC. Many PSPs assumed their MSB registration was sufficient. It's not. The Bank of Canada now requires its own registration for payment activities.
Registration comes first
The one-time window for businesses already operating closed on November 15, 2024, and supervision started September 8, 2025. Today a new PSP has to be registered before it performs any retail payment activity, which puts the application on your critical path to launch.
Complex requirements
Risk management frameworks, fund safeguarding policies, incident response procedures: the RPAA demands documentation most payment businesses haven't built.
Does the RPAA apply to your business?
The Bank of Canada requires registration when four things are true at once. Miss any one of them and you are out of scope; meet all four and registration is not optional.
- You perform at least one of the five payment functions, and not merely as something incidental to another service you provide.
- That function relates to an electronic funds transfer made in fiat currency or in a prescribed unit.
- You have a place of business in Canada, or you direct retail payment activities at individuals or entities in Canada while providing services to them.
- No exclusion applies to you.
The five payment functions
Providing or maintaining an account for an end user. Holding funds on behalf of an end user. Initiating an electronic funds transfer at an end user's request. Authorizing an electronic funds transfer, or transmitting, receiving or facilitating an instruction related to one. Providing clearing or settlement services.
One is enough. This is where most businesses misjudge their position: a platform that never touches a payment rail directly can still be performing a payment function by holding funds or passing instructions.
Who is excluded
Some entities are out by what they are, including banks and certain regulated financial institutions. Others are out by what the activity is, including merchant-issued instruments, transactions in securities, and payments made through a designated payment system. The exclusions are narrower than most applicants assume, and an exclusion that nearly fits is not an exclusion.
RPAA registration is not MSB registration
Being registered with FINTRAC as a money services business neither exempts you from the RPAA nor satisfies it. Different statutes, different regulators, different obligations: FINTRAC supervises anti-money laundering, the Bank of Canada supervises operational risk and the safeguarding of end-user funds. A large number of payment businesses owe both, and the two applications ask for different things.
What the application actually involves
Applications are filed through the Bank's PSP Connect portal and carry a registration application fee of $2,500 as of November 1, 2024. The Bank evaluates an application only once that fee has been received in full, so a fee left unpaid is simply a file that nobody is looking at.
The form itself is the smaller half of the work. You have to name your affiliated entities and the third-party service providers your payment activities depend on, and you have to describe a risk management and incident response framework that actually exists. If you hold end-user funds, safeguarding arrangements have to be in place and described. Writing that framework is the part that takes the time, and it is the part the Bank reads closely.
Applications also go through a national security review coordinated by the Department of Finance. Approval is not immediate and not a formality, which is the practical reason the application belongs at the start of your launch plan rather than near the end of it.
What you get
- RPAA applicability assessment for your specific payment activities
- Risk management framework development
- Safeguarding of end-user funds policies
- Incident response and notification procedures
- Complete registration application preparation
- Bank of Canada correspondence and follow-up
What changes once you are registered
Registration is the entry ticket, not the finish line. Your name goes on the Bank's public PSP registry, and a set of continuing obligations starts running.
- The annual report, due March 31 each year and covering the previous calendar year. Depending on the scope of your activities it runs to between 50 and 95 questions, across operational risk and incident management, safeguarding of end-user funds, significant change and incident reporting, ubiquity and interconnectedness, financial information and record keeping.
- Significant change notices. Material changes to your operations have to be reported to the Bank rather than mentioned at the next annual report.
- Incident reporting. Incidents that have a material impact on end users or other PSPs trigger their own notification duties.
- Keeping the framework true. The risk management and safeguarding arrangements you described have to keep describing what you really do.
The annual report is where a thin application catches up with you. It asks, in detail, whether the framework you filed is the framework you run, and it is answered against records the Bank can ask to see.
For the full set of ongoing obligations, including the 48-hour incident rule and the Bank's published violations, see our guide to what payment service providers need to know about the RPAA.
How it works
Assessment: we determine whether the RPAA applies to your business and which requirements you must meet.
Framework development: risk management, fund safeguarding, incident response, and all supporting documentation.
Registration filed: complete application submitted to the Bank of Canada with ongoing correspondence support.
FAQ
The Retail Payment Activities Act is the framework under which the Bank of Canada supervises payment service providers. It covers operational risk, incident response and the safeguarding of end-user funds, and it is entirely separate from FINTRAC's anti-money-laundering regime. Supervision began on September 8, 2025.
It applies if you perform at least one of the five payment functions as more than an incidental service, the function involves an electronic funds transfer in fiat currency or a prescribed unit, you have a place of business in Canada or direct retail payment activities at people in Canada, and no exclusion covers you. Payment processors, fintechs, platforms that hold end-user funds and crypto businesses with payment functions routinely qualify.
PSP Connect is the Bank of Canada's online portal for registration and for the filings that follow it, including the annual report and significant change notices. It is where your application is submitted and where your file lives afterwards.
The Bank charges a registration application fee of $2,500, in effect since November 1, 2024. The Bank evaluates an application only once the fee has been received in full. The larger cost is usually not the fee but building the risk management, incident response and safeguarding framework the application has to describe.
Many payment businesses do. FINTRAC registration covers your anti-money-laundering obligations under the PCMLTFA; RPAA registration covers operational risk and end-user funds with the Bank of Canada. Neither one satisfies or exempts you from the other, and the two applications ask for different things.
No. Registration has to be in place before you perform any retail payment activity, so the application belongs at the start of your launch plan. Timing depends on the completeness of your filing and on a national security review coordinated by the Department of Finance, which is not a formality. Build the framework first and the review has far less to come back to you about.
The one-time window for businesses already in operation closed on November 15, 2024, so there is no queue left to join quietly. You apply now, and you do it with a complete file rather than a placeholder, because an application that arrives late and thin invites exactly the scrutiny you want to avoid. Operating unregistered exposes you to administrative monetary penalties and to public disclosure of the violation.
Every registered PSP files an annual report through PSP Connect by March 31, covering the previous calendar year. It runs to between 50 and 95 questions depending on the scope of your activities, across operational risk and incident management, safeguarding, significant change and incident reporting, ubiquity and interconnectedness, financial information and record keeping. It tests whether the framework you registered with is the one you actually run.
Get In Touch
Need to register under the RPAA?
Free 30-minute consultation. No obligations.
The map is embedded from Google Maps and loads only after you accept analytics & embedded-content cookies.
Toronto, Ontario, M5B 1Y4, Canada