If a business with a place of business in Canada performs fiat retail payment activities, it must register with the Bank of Canada under the Retail Payment Activities Act before starting operations. A foreign business must also register if it performs retail payment activities for end users in Canada and directs those activities in Canada. The Bank records successful applicants as registered PSPs; it does not issue a payment license. FINTRAC registration is separate. Since September 8, 2025, registered PSPs have been subject to operational risk, incident response, safeguarding and reporting requirements.
What Is the Retail Payment Activities Act?
The RPAA created a supervisory regime under which the Bank of Canada oversees payment service providers. Parliament approved the Act in 2021. Registration opened on November 1, 2024, and the operational risk, safeguarding and reporting provisions took effect on September 8, 2025. A PSP operating under the full regime must implement the applicable frameworks and comply with the Bank's reporting calendar.
For a business registering now, no transitional relief applies. The regime is fully operational.
Who Must Register Under the RPAA
The RPAA applies to any individual or entity that performs one or more of five payment functions in relation to an electronic funds transfer in Canadian or foreign fiat currency (digital currencies are excluded from the definition). The five functions, set out in section 2 of the Act, are:
- Providing or maintaining an account held on behalf of one or more end users.
- Holding funds on behalf of an end user until they are withdrawn or transferred.
- Initiating an electronic funds transfer at the request of an end user.
- Authorizing an electronic funds transfer, or transmitting, receiving or facilitating an instruction in relation to one.
- Providing clearing or settlement services.
Performing any one of these functions is enough to bring a business within scope, provided the function is not incidental to another service or business activity.
Foreign PSPs must register even if they have no Canadian incorporation, no Canadian office and no FINTRAC registration. Under section 5 of the RPAA, a provider without a place of business in Canada is in scope when it performs retail payment activities for an end user in Canada and directs those activities to individuals or entities in Canada. Canadian marketing, Canadian-dollar pricing and onboarding designed for users physically located in Canada are relevant indicators. Under paragraph 29(1)(o), a foreign applicant must name an agent or mandatary in Canada authorized to accept RPAA notices and orders on its behalf.
The Act also contains activity-based exclusions, including specified securities transactions, internal transactions between affiliated entities, closed-loop payment instruments and payment functions performed only incidentally to another service. Section 9 excludes banks, authorized foreign banks, regulated credit unions and caisses populaires, insurance companies, specified trust companies and loan companies that accept deposits transferable by order. Fintechs, payment processors, remittance businesses, wallet providers and platforms holding customer balances must test their own activities against these exclusions.
RPAA and FINTRAC: Two Separate Registrations
FINTRAC supervises money services businesses under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), which covers AML and counter-terrorist financing. The Bank of Canada supervises PSPs under the RPAA for operational risk and the protection of end-user funds. A business can fall under both regimes, and Canadian MSB registration does not satisfy the RPAA. Each regime requires a separate scope assessment, application and compliance framework. The MSB registration vs PSP registration comparison explains the differences in scope and cost.
How to Register with the Bank of Canada
Registration takes place through PSP Connect, the Bank of Canada's online portal. Subsection 29(1) of the RPAA sets the application contents, while subsection 24(1) of the Retail Payment Activities Regulations requires electronic submission through the Bank's system. The application includes corporate and ownership information, payment functions, transaction volumes, end-user funds, material third-party providers, agents or mandataries, and descriptions of the frameworks already implemented or planned.
Review begins only after the registration fee is paid. Once the assessment is complete, the Bank sends the applicant a written registration or refusal decision through the portal.
The original 15-day application window for companies already performing retail payment activities closed on November 15, 2024. Since September 8, 2025, a new entrant must receive a registration decision from the Bank before performing any retail payment activity. Section 23 makes operating without registration a contravention of the Act.
The Bank maintains a public registry of registered PSPs and separately publishes a list of entities whose applications have been refused.
RPAA Registration Costs
The registration application fee is CAD 2,578.28 for applications submitted in 2026. It is non-refundable, exempt from Canadian sales tax and the same for domestic and foreign applicants. The fee was CAD 2,500 when registration opened on November 1, 2024, and it is indexed every calendar year under subsection 25(1) of the RPAR using the year-over-year change in the September all-items consumer price index. The Bank of Canada publishes a Fee Bulletin each December 1 announcing the amount that takes effect the following January 1.
The RPAA also requires the Bank of Canada to recover its supervisory costs through annual assessment fees. The proposed formula was pre-published in Canada Gazette Part I in February 2023 but remains unfinalized. In its FAQ updated on August 14, 2026, the Bank states that charging will begin after the cost-recovery formula and regulations are finalized. PSPs cannot yet calculate this future expense from a final statutory formula.
The government fee covers the application only. The implementation budget also includes the operational risk and incident response framework, the safeguarding framework where the PSP holds end-user funds, system and control testing, the independent safeguarding review required at least once every three years, annual reporting and legal advice. Where an express trust is used, the Bank expects a written legal opinion during its supervisory assessment. For an implementation scope and cost estimate, contact Equilex and see RPAA registration with Equilex.
Operational Risk and Safeguarding Frameworks
The applicable frameworks must operate in practice. The Bank of Canada assesses their implementation, maintenance and effectiveness rather than the existence of policy documents alone.
Operational risk management and incident response. Under section 17 of the RPAA and sections 5–12 of the RPAR, the PSP must identify, assess and mitigate risks to its retail payment activities. The framework covers information systems and cyber controls, material third-party providers, incident detection and response, business continuity, testing and remediation. A senior officer must approve the framework and approve it again after each material change.
Safeguarding of end-user funds. Section 20 of the RPAA requires a PSP that holds end-user funds to protect them against the PSP's insolvency. The PSP can hold the funds in trust in an account used only for that purpose or protect them with qualifying insurance or a guarantee in an amount at least equal to the funds held. The insurer or guarantor cannot be affiliated with the PSP. Deposit insurance on the PSP's bank account does not protect end users against the PSP's insolvency and does not satisfy this requirement. The framework must explain how funds will be identified, reconciled and returned during insolvency.
RPAA Annual Reporting: What the Report Contains and When It Is Due
The annual report is filed through PSP Connect under section 21 of the RPAA and section 18 of the RPAR. It is due by March 31 and covers the previous calendar year, except for financial metrics based on the PSP's latest financial year-end. For the first cycle, PSPs registered before March 9, 2026 filed by March 31, while PSPs registered from March 9 through March 30 received an extension to April 28. The next standard deadline is March 31, 2027.
The report is a series of structured questions covering the PSP's operational risk management and incident response (the framework's effectiveness, incidents that occurred during the year, changes to the framework), the safeguarding of end-user funds (how funds are protected, changes to the arrangement, the results of any independent review), registration information (confirmation and updates to corporate details, ownership, payment functions, third-party providers, agents), financial metrics (based on the PSP's most recent financial year-end), and retail payment activity metrics (volumes, values, interconnectedness measures).
Section 61 of the RPAA prohibits providing false or misleading information to the Bank. The prohibition applies to the annual report as well as the registration process and other regulatory submissions. Answers must describe the PSP's actual controls, incidents and metrics rather than planned measures presented as completed work.
Penalties for Non-Compliance with the RPAA
The Bank of Canada uses a range of enforcement tools: warning letters, compliance agreements under section 71 of the RPAA, and notices of violation (NOVs) that can carry administrative monetary penalties (AMPs). Under the AMP schedule in the RPAR, violations are classified as serious or very serious. The maximum penalty is CAD 1 million per serious violation and CAD 10 million per very serious violation.
Operating without registration is treated as a very serious violation. A series of serious violations arising from the same provision can be reclassified as a single very serious violation. If a PSP enters into a compliance agreement offered alongside a notice of violation, the AMP is reduced by half, but failure to meet the agreement's terms makes the remaining half payable plus an additional prescribed penalty.
The Bank announced in June 2026 that it would publish notices of violation. Its first published decisions appeared in August 2026 and concerned PSPs that had performed retail payment activities without registration, a very serious violation of section 23. The published cases carried CAD 0 penalties. The Bank keeps enforcement decisions online for five years, and prior compliance history can affect a later AMP assessment.
The Bank can also revoke a PSP's registration under the RPAA if the PSP ceases to perform retail payment activities, has committed or is deemed to have committed a violation, or no longer meets the registration criteria. A revoked PSP appears on the Bank's public list of refusals and revocations.
A PSP that also qualifies as an MSB must maintain separate controls and reporting processes for the RPAA and FINTRAC regimes. The separate Canada AML compliance update explains the changes introduced through Bill C-12.
What Happens After Registration
Registration begins the ongoing compliance cycle. The obligations continue while the PSP remains registered.
Annual reporting is due every March 31, as described above.
If an incident has a material impact on an end user, another PSP or a qualifying clearing house, the PSP must notify the Bank and the affected parties without delay.
Changes to the core registration information listed in section 59 of the RPAA must be reported within 30 days. Other prescribed changes are subject to different deadlines, including notice as soon as feasible or 30 or 60 days in advance, depending on the information affected. A significant change in the way the PSP performs a retail payment activity, or the performance of a new activity, requires notice at least five business days before it takes effect.
Acquisitions of control and prescribed changes trigger a re-registration requirement. Under subsection 24(1) of the RPAA, if an individual or entity plans to acquire control of a registered PSP, the PSP must submit a new application for registration that accounts for the planned acquisition and be registered again before the acquisition takes place. The same applies to prescribed changes under subsection 24(2).
Supervisory assessments examine compliance with the operational risk, incident response and safeguarding requirements. The Bank can require corrective action and, where necessary, order a special audit at the PSP's expense. During an assessment of an express-trust arrangement, the Bank requests a written legal opinion addressing the validity of the trust.
For businesses already registered with FINTRAC as a Canadian MSB, RPAA reporting, incident notices and change notifications create a separate compliance calendar alongside the FINTRAC obligations.
FAQ
Do foreign companies need to register under the RPAA?
Yes. A foreign provider is in scope if it performs retail payment activities for end users physically located in Canada and directs those activities at Canada. Canadian incorporation and a Canadian office are not required. The application must identify an agent or mandatary in Canada authorized to accept RPAA notices and orders for the applicant.
Is RPAA registration the same as FINTRAC registration?
No. FINTRAC covers AML under the PCMLTFA, while the Bank of Canada covers operational reliability and end-user fund protection under the RPAA. The two regimes have separate registrations, obligations and penalties. A payment or remittance business that performs activities within both statutory definitions must complete both registrations.
How much does RPAA registration cost?
The government application fee is CAD 2,578.28 for applications submitted in 2026. It is flat, non-refundable and exempt from Canadian sales tax. Annual assessment fees will begin after the Bank of Canada finalizes the cost-recovery formula and implementing regulations. Framework development, independent reviews, legal advice and annual reporting create additional implementation and operating costs.
When is the RPAA annual report due?
The standard deadline is March 31 for information covering the previous calendar year, except for financial metrics based on the PSP's most recent financial year-end. The report is filed through PSP Connect and addresses operational risk, safeguarding, incidents, registration information and payment activity metrics. Special transition rules applied to some PSPs in 2026.
Can a PSP register after starting operations?
No. Since September 8, 2025, a new entrant must receive a registration decision from the Bank of Canada before performing retail payment activities. Submitting an application does not authorize a new applicant to operate while the Bank reviews it. The special continuation rule applies only to eligible PSPs that filed during the transition period.
