RPAA Registration in Canada — Bank of Canada PSP Registration and Ongoing Compliance
Reviewed by Oksana Krasilnikova, Head of AML Compliance
Last reviewed:
Business that performs fiat retail payment activities for end users in Canada must be registered with the Bank of Canada under the Retail Payment Activities Act — including providers with no office in Canada that direct their services at Canadian users. Since 8 September 2025 the registration has to be in place before the activity starts, not alongside it. Equilex prepares and files the application, builds the operational risk, incident response and safeguarding frameworks the Act requires, and runs the annual cycle afterwards. Registration package from €4,500; ongoing compliance from €1,500 per month.
Registration package
From €4,500
Ongoing compliance
From €1,500 per month
At a glance
| Item | Detail |
|---|---|
| Regulator | Bank of Canada — retail payments supervision |
| Legislation | Retail Payment Activities Act (RPAA) (opens in a new tab) and the Retail Payment Activities Regulations |
| Who registers | Registration with the Bank of Canada is required where an individual or entity operates as a payment service provider, performs non-incidental retail payment activities involving electronic funds transfers in Canadian or foreign currencies (excluding digital currencies), and either has a place of business in Canada or serves and directs its services to Canadian end users from outside Canada. |
| Government fee | CAD 2,500, flat and non-refundable |
| Key date | Since 8 September 2025, registration must be granted before retail payment activities begin |
| Recurring deadline | Annual report to the Bank of Canada by 31 March |
| Maximum penalty | Up to CAD 10 million per very serious violation |
| Equilex fee | Registration package from €4,500 · ongoing compliance from €1,500 per month |
| Separate from | FINTRAC MSB registration — a different regulator, a different regime. Both regulations (MSB and RPAA) under different regulators (FINTRAC and Bank of Canada) may apply |
What the RPAA covers
A retail payment activity is a payment function performed in relation to an electronic funds transfer in Canadian or foreign currency. Digital currencies are outside the definition. If your business performs any one of the five payment functions below, in relation to such transfers, you are within scope.
| # | Payment function |
|---|---|
| 1 | Providing or maintaining an account held on behalf of one or more end users |
| 2 | Holding funds on behalf of an end user until they are withdrawn or transferred |
| 3 | Initiating an electronic funds transfer at the request of an end user |
| 4 | Authorising an electronic funds transfer, or transmitting, receiving or facilitating an instruction in relation to one |
| 5 | Providing clearing or settlement services |
Banks, authorised foreign banks and certain provincially regulated entities are excluded. Most fintechs, payment processors, remittance businesses, wallet providers and platforms holding customer balances are not.
The rule most foreign providers miss
Registration does not depend on having a Canadian entity or a Canadian office. A payment service provider with no place of business in Canada must register if it performs retail payment activities for end users in Canada and directs its services at Canadian individuals or businesses.
In practice that catches a great many platforms that consider themselves entirely outside Canada: a Canadian-language landing page, pricing in Canadian dollars, Canadian onboarding flows or marketing aimed at Canadian customers all point towards directing activities at Canada. If Canadian users can sign up and move money, the question is live.
The Bank of Canada sets out the scope of retail payments supervision (opens in a new tab) in full.
The transition window has closed
| Period | Position |
|---|---|
| 1 November 2024 – 7 September 2025 | Transition window. A provider already operating could continue while its application was under review, provided the application was submitted inside the window. |
| From 8 September 2025 | No transition relief. Registration must be granted before any retail payment activity is performed. Operating while unregistered is a contravention in itself. |
This is the single most common failure the Bank of Canada is currently acting on, and it catches providers who assumed the deadline only applied to businesses that were already trading.
What enforcement looks like so far
The Bank of Canada began publishing Notices of Violation in June 2026. The first published enforcement decisions, released in August 2026, all concerned the same thing: performing retail payment activities without being registered, contrary to section 23 of the Act. Equals Money PLC is among the named providers.
Every one of those first decisions carried a zero-dollar penalty, because the providers moved to register and mitigated the harm. That is not leniency, and reading it as such is a mistake. The Notices of Violation remain publicly visible for five years, they sit in front of every bank and partner performing due diligence on you, and they count against you in the calculation of any future penalty.
Penalty maximums
| Category | Maximum per violation |
|---|---|
| Serious violation | CAD 1 million |
| Very serious violation | CAD 10 million |
| Reporting and notification contraventions | CAD 500 per day for the first 30 days, then CAD 15,000 to CAD 1 million if it continues |
| Reduction | The penalty may be halved where the provider enters into a compliance agreement |
Note that the registry itself is public. The Bank publishes both the PSP registry and list of applicants (opens in a new tab) showing legal name, head office location, website and application date — so the fact that you have applied, and when, is visible to anyone who looks.
The Bank publishes its compliance and enforcement decisions (opens in a new tab) as they are issued.
RPAA and FINTRAC are not the same thing
Many businesses fall under both regimes and assume that satisfying one covers the other. It does not. They are separate statutes, separate regulators, separate registrations and separate deadlines. A clean FINTRAC file tells the Bank of Canada nothing.
| FINTRAC — MSB registration | Bank of Canada — RPAA registration | |
|---|---|---|
| Statute | PCMLTFA | Retail Payment Activities Act |
| Purpose | Anti-money-laundering and counter-terrorist financing | Operational reliability and protection of end-user funds |
| Core requirement | Five-part compliance programme, named compliance officer | Operational risk and incident response framework, safeguarding of end-user funds |
| Reporting | STR, LCTR, EFTR, LVCTR, TPR — transaction driven | Annual report and incident notifications — calendar driven |
| Recurring deadline | Registration renewal and effectiveness review every two years | Annual report by 31 March |
| Maximum penalty | Set under the PCMLTFA, raised by 2026 amendments | CAD 10 million per very serious violation |
| Applies to | Money services businesses and foreign MSBs | Payment service providers, including foreign PSPs directing services at Canada |
Equilex covers both — Canadian MSB Compliance Officer.
What the registration involves
| Stage | What happens | Typical duration |
|---|---|---|
| Applicability assessment | We establish whether your model performs a payment function in relation to retail payment activities, and whether an exclusion applies. The answer is documented, so you have a defensible record either way. | 3–5 days |
| Application preparation | Corporate details, ownership, payment functions performed, volumes, third-party relationships, and the required declarations. | 1–2 weeks |
| Framework build | Operational risk management and incident response framework, safeguarding policy and safeguarding risk assessment, governance and escalation structure. | 2–3 weeks |
| Submission and review | Filing with the Bank of Canada with the CAD 2,500 fee, and handling any requests for further information. | Bank of Canada timeline |
| Steady state | Annual reporting, incident notifications, framework maintenance and change management. | Ongoing |
The Bank of Canada decides on applications submitted after 8 September 2025 "as soon as feasible". It does not publish a fixed service standard, so we do not promise one either.
Ongoing obligations after registration
Registration is the entry ticket, not the finish line. A registered PSP carries continuing duties, and the annual report is where the Bank of Canada finds out whether they were met.
| Obligation | What it means in practice |
|---|---|
| Operational risk management and incident response framework | Documented, current, and capable of being evidenced. It does not have to sit in one document, but it does have to exist. |
| Safeguarding of end-user funds | Where you hold end-user funds: a trust arrangement supported by valid express trust documentation, or insurance or a guarantee from an approved provider, with funds segregated from operating accounts. Deposit insurance alone does not satisfy the requirement. |
| Safeguarding risk assessment | Assessment of the risks to safeguarded funds and the controls applied to them. |
| Incident notification | Notification to the Bank of Canada, and to affected parties, when an incident with material impact occurs. |
| Annual report | Filed by 31 March, covering operational risk management, safeguarding, incidents and retail payment activity metrics for the previous year. |
| Business continuity and operational resilience | Tested arrangements for continuing to operate through disruption. |
| Third-party and service provider risk | Oversight of the providers you depend on to deliver the payment functions. |
| Notification of changes | Changes to registered information reported to the Bank of Canada. |
What is included in our service
Registration
- Applicability assessment with a documented conclusion
- Preparation, review and filing of the registration application
- Handling of requests for additional information during review
- Coordination of the CAD 2,500 government fee
Frameworks and documentation
- Operational risk management framework and operational risk assessment
- Incident response policy, incident report template and incident register
- Safeguarding of end-user funds policy and safeguarding risk assessment
- Business continuity and operational resilience arrangements
- Third-party and service provider risk procedures
- Governance structure, roles, responsibilities and internal escalation
Ongoing
- Annual report preparation and filing by 31 March
- Incident assessment and notification support
- Framework maintenance and regulatory change management
- Notification of changes to registered information
- Support with Bank of Canada inquiries, examinations and remediation
- Answering the compliance questionnaires your banking and payment partners send
Who this is for
- Fintechs and platforms that hold customer balances or initiate transfers for Canadian users
- Payment processors and gateways serving Canadian merchants
- Remittance businesses already registered with FINTRAC as MSBs, who did not realise a second registration applies
- Foreign providers with no Canadian entity whose product is nonetheless available to Canadian customers
- Providers who missed the transition window and are now operating unregistered
- Registered PSPs who have the registration but never built the frameworks behind it, with the annual report approaching
Pricing
| Service | Price |
|---|---|
| RPAA applicability assessment | From €600, credited against the registration package |
| RPAA registration package — application plus the required frameworks | From €4,500 |
| Ongoing PSP compliance | From €1,500 per month |
| Annual report preparation and filing | From €1,200 |
| Frameworks only, for an already registered PSP | From €2,900 |
| Incident response and Bank of Canada inquiry support | Quoted per case |
| Bank of Canada government fee | CAD 2,500, paid to the regulator, not included |
Multi-entity discounts apply, and the RPAA package is discounted where Equilex also handles the FINTRAC side. Full price list on request.
Why Equilex
- Both Canadian regimes under one roof — FINTRAC registration and AML programme, and RPAA registration and PSP compliance with the Bank of Canada.
- We register Canadian entities, conduct comprehensive due diligence checks, and assist with mergers and acquisitions, ensuring that all corporate and regulatory matters are handled under one roof.
- Lawyers and compliance specialists in-house; the frameworks you receive are drafted for your model, not downloaded.
- Licensing and compliance work across 19 jurisdictions, including Canadian MSB, US MSB, MiCA CASP, Hong Kong MSO and EU payment institutions.
- Offices in Hong Kong and Warsaw, serving clients across the EU, North America and Asia.
Related: register a Canadian MSB and ongoing compliance support.
Frequently asked questions
The Retail Payment Activities Act is the Canadian statute that brings payment service providers under the supervision of the Bank of Canada. It requires registration and imposes duties around operational risk, incident response and the safeguarding of end-user funds.
Possibly yes. A provider with no place of business in Canada must register if it performs retail payment activities for end users in Canada and directs its services at Canadian individuals or businesses. Having no Canadian entity is not by itself an exemption.
No. FINTRAC and the Bank of Canada are separate regulators applying separate statutes. An MSB registration addresses anti-money-laundering obligations; it says nothing about the RPAA, which covers operational reliability and the protection of end-user funds.
Operating while unregistered contravenes section 23 of the Act and is treated as a very serious violation. The Bank of Canada is actively monitoring it. In the first published decisions the penalties were set at zero because the providers moved quickly to register, but the Notices of Violation are public for five years and count against any future penalty. The practical answer is to apply, and to do it before the regulator finds you.
The Bank of Canada charges a flat, non-refundable fee of CAD 2,500. Equilex charges from €4,500 for the registration package, which includes the applicability assessment, the application and the operational risk, incident response and safeguarding frameworks the Act requires.
The Bank of Canada decides "as soon as feasible" and does not publish a fixed service standard. Our side of the work — assessment, application and frameworks — typically takes four to six weeks.
If you hold end-user funds, they must be protected through a trust arrangement with valid express trust documentation, or through insurance or a guarantee from an approved provider, and kept segregated from your operating accounts. The Bank of Canada has stated that deposit insurance alone is not sufficient.
By 31 March each year, covering the previous calendar year. It addresses operational risk management, safeguarding, incidents and retail payment activity metrics.
Yes. The Bank of Canada publishes a list of applicants showing legal name, head office location, website and application date, alongside the registry of registered providers.
Yes. We provide the FINTRAC-side compliance officer function and the RPAA-side ongoing compliance support, on one calendar and one documentation standard.
Next step
Send a short description of your payment flows — who holds the funds, who initiates the transfer, and whether Canadian users can sign up. We will tell you whether the RPAA applies, and if it does, return a scoped quote. The applicability assessment is credited against the package if you proceed.
Ready to get started?
Discuss your license and timeline with our team. We'll get back to you within 24 hours.
Latest on payments and fintech
All articlesPayment & Fintech Licensing
Payment Licensing Guide: What a Payment License Is and Which One You Need
September 1, 2026 · 8 min read
Payment & Fintech Licensing
SRO License in Switzerland: Requirements, Costs and Process for Crypto Businesses
August 17, 2026 · 8 min read
Payment & Fintech Licensing
EMI License in Malta: Requirements, Costs and MFSA Application in 2026
August 12, 2026 · 8 min read