Canada

Canada RPAA Registration: Bank of Canada PSP Requirements, Cost and Timeline

Bank of Canada RPAA registration for payment service providers: who must register, the C$2,500 fee, safeguarding duties and the report due 31 March 2027.

Five payment functionsBank of CanadaSafeguarding duty
Discuss your RPAA registrationView requirements

Key dates for 2026 and 2027

8 September 2025PassedRegistration with the Bank of Canada became a condition of performing retail payment activities in Canada for new payment service providers.
17 February 2026PassedThe Bank of Canada ordered XTM Inc. to stop retail payment activities over concerns that client funds had not been safeguarded, its first such order.
26 March 2026PassedBill C-15 received Royal Assent, enacting the Stablecoin Act and bringing payment functions in prescribed stablecoins towards the RPAA.
31 March 2026PassedFirst RPAA annual reports, covering calendar year 2025, were due from every registered payment service provider.
12 June 2026PassedThe Bank of Canada announced it would publish notices of violation against payment service providers and record them on the public registry.
31 March 2027UpcomingSecond RPAA annual report due through PSP Connect, covering calendar year 2026, from every registered payment service provider.
2027UpcomingThe Stablecoin Act framework is expected to come into force once the Department of Finance finalises its regulations.

Written and reviewed by the Regulatory Counsel team. Last reviewed: 20 October 2026.

The short answer

The Retail Payment Activities Act requires a payment service provider that performs retail payment activities to register with the Bank of Canada before performing them. Since 8 September 2025, registration has been a condition of operating. Applications are made through the Bank of Canada's PSP Connect portal.

A payment service provider is captured if it performs one or more of five payment functions as a service or business activity: providing or maintaining an account, holding funds on behalf of an end user, initiating an electronic funds transfer, authorising an electronic funds transfer or transmitting a transfer instruction, and providing clearing or settlement services. Foreign providers can be captured where they direct retail payment activities at end users in Canada.

Registered PSPs must maintain an operational risk and incident response framework, notify material incidents without delay, safeguard end-user funds where they hold them, file an annual report by 31 March each year and notify significant changes. The next annual report, covering 2026, is due by 31 March 2027. The registration fee is a flat, non-refundable C$2,500; annual assessment fees have not yet started. This is a distinct regime from FINTRAC registration and many payment firms require both.

Key facts at a glance

RegulatorBank of Canada, under the Retail Payment Activities Act
Permission typeRegistration as a payment service provider. Supervision of operational risk and end-user fund safeguarding, not a prudential licence
Who needs itPSPs performing one or more of the five payment functions as a service or business activity in relation to electronic funds transfers in Canadian or foreign currency
Local entity required?No. Foreign PSPs directing retail payment activities at end users in Canada can be captured and must register
Local management required?No. The Bank of Canada has confirmed a senior officer need not live in Canada, but the framework must be genuinely implemented
Capital or net worthNone. The RPAA imposes safeguarding and operational risk duties rather than capital requirements
Government feeFlat registration application fee of C$2,500, non-refundable. Annual assessment fees not yet charged as at October 2026
Review periodsThe regulations provide for a decision on whether to review an application, an available extension, and a defined period in which any review is conducted
RenewalNone. Registration does not expire. Annual report due by 31 March each year; next due 31 March 2027
Territorial scopeRetail payment activities performed for end users in Canada

Speak to a licensing expert

Tell us the business, the markets and your timing. Every enquiry is answered the same business day, with a written proposal: the licence, the requirements, the cost and the timeline.

Your enquiry

Every enquiry is answered the same business day, with a written proposal.

What is the Canada RPAA Registration (Bank of Canada PSP)?

The Retail Payment Activities Act brought payment service providers in Canada under federal supervision by the Bank of Canada for the first time. The regime is deliberately narrow in purpose: it targets operational reliability and the protection of end-user funds, rather than solvency, conduct or anti-money laundering supervision, which sit elsewhere.

Registration is mandatory before a PSP performs retail payment activities. The Bank of Canada maintains a public register of registered PSPs, and the register is increasingly used by banks, platforms and enterprise counterparties as a due diligence check.

The regime applies to domestic and foreign providers alike. A payment service provider with no Canadian establishment can be captured where it directs retail payment activities at end users in Canada, which mirrors the approach taken in the FINTRAC foreign MSB regime but operates entirely separately from it.

Who needs Canada RPAA Registration (Bank of Canada PSP)?

Any payment service provider that performs one or more of the five payment functions as a service or business activity in relation to an electronic funds transfer, where the activity is performed for an end user in Canada.

  • - Payment processors and payment facilitators serving Canadian merchants
  • - Digital wallet and account providers holding balances for Canadian end users
  • - Remittance and cross-border payment platforms serving Canadian senders or recipients
  • - Payroll, disbursement and marketplace payout providers moving funds for Canadian users
  • - Card programme managers and issuing or acquiring intermediaries performing a captured function
  • - Foreign PSPs directing retail payment activities at end users in Canada without a Canadian establishment

The most common misconception is that a firm already registered with FINTRAC has satisfied its Canadian obligations. FINTRAC registration is anti-money laundering supervision under separate legislation, administered by a different authority. A firm that transfers funds for Canadian customers and holds end-user funds will frequently require FINTRAC registration and Bank of Canada registration at the same time, with distinct applications, distinct obligations and only one fee. The second misconception is that the absence of a Canadian entity puts a firm outside the Act. The statutory test looks at whether retail payment activities are directed at end users in Canada, not at where the provider is incorporated.

The five payment functions

The Act defines a payment service provider by reference to the performance of payment functions. Performing any one of them as a service or business activity, in relation to an electronic funds transfer, brings the provider within scope unless an exclusion applies.

  • - Providing or maintaining an account that is held on behalf of one or more end users
  • - Holding funds on behalf of an end user until they are withdrawn by the end user or transferred to another individual or entity
  • - Initiating an electronic funds transfer at the request of an end user
  • - Authorising an electronic funds transfer or transmitting, receiving or facilitating an instruction in relation to an electronic funds transfer
  • - Providing clearing or settlement services

The foreign PSP test

A provider outside Canada is captured where it performs retail payment activities and directs those activities at individuals or entities in Canada. The assessment is practical rather than formal: Canadian marketing, Canadian dollar functionality, Canadian customer onboarding and a Canadian customer base all support a finding that activities are directed at Canada.

Firms that already run a Canadian go-to-market strategy should assume they are in scope and structure the registration accordingly, rather than relying on the absence of an office.

Exclusions from the regime

The Act and regulations exclude certain activities and entities, including activities already supervised under other federal frameworks and certain internal or incidental functions. Exclusions are specific and should be assessed against the actual flow of funds and contractual arrangements rather than assumed from a business description.

Where a firm relies on an exclusion, that analysis should be documented at the time. Bank of Canada supervision is evidence-driven, and an undocumented perimeter conclusion is difficult to defend later.

RPAA is not FINTRAC

FINTRAC registration under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act addresses money laundering and terrorist financing risk. RPAA registration with the Bank of Canada addresses operational risk and the safeguarding of end-user funds.

The two regimes use different definitions, different triggers, different portals and different reporting cycles. A money transferring business will normally be an MSB for FINTRAC purposes and a PSP for RPAA purposes, and neither registration substitutes for the other.

Operational risk and incident management

  • - A documented risk management and incident response framework that identifies operational risks and the controls that mitigate them
  • - Objectives and controls addressing the reliability, availability and integrity of retail payment activities
  • - Testing of the framework and an independent review at least once every three years, as the annual report form asks PSPs to confirm
  • - Notification to the Bank of Canada, and to affected end users and connected providers, of an incident that has a material impact, without delay
  • - Records evidencing the framework, the testing performed and the incidents managed

Safeguarding end-user funds

A PSP that holds end-user funds must safeguard them. The regulations require the funds to be held in a manner that protects them from the PSP's other obligations and ensures they are available to end users without delay, including where the PSP becomes insolvent.

This is supported by a safeguarding framework covering the accounts used, the reconciliation performed, the arrangements with the account provider or insurer, and independent review. Firms familiar with the UK safeguarding regime will recognise the architecture, though the Canadian requirements must be met on their own terms. Federal or provincial deposit insurance on its own does not meet the requirement, because it protects against the failure of the bank, not the failure of the PSP.

The registration process

  • - Confirm the perimeter analysis: which payment functions are performed, for which end users, and whether any exclusion applies
  • - Build the operational risk and incident response framework and, where funds are held, the safeguarding framework, before applying
  • - Create a PSP Connect account and prepare the required information about the business, its activities, its ownership and its arrangements with third parties
  • - Submit the application and pay the flat registration fee of C$2,500, which is non-refundable
  • - Respond to Bank of Canada questions, including any review of the application, within the periods provided by the regulations
  • - On registration, appear on the public register and begin the annual reporting and significant change notification cycle

Ongoing obligations after registration

  • - Maintain, test and review the risk management and incident response framework
  • - Maintain safeguarding arrangements and the associated reconciliation and review where end-user funds are held
  • - Notify the Bank of Canada of incidents with a material impact without delay
  • - File the annual report through PSP Connect by 31 March each year, covering the previous calendar year
  • - Notify significant changes to the business, its activities, its ownership or its arrangements within the prescribed period
  • - Give the Bank at least 30 days' notice before any cancellation or termination of a safeguarding insurance policy or guarantee
  • - Pay annual assessment fees once the Bank's cost recovery regulations are finalised. As at October 2026 the Bank has not started charging them

What changed in 2026 and what is due next

2026 is the first full year of live supervision. The Bank of Canada has moved from processing registrations to enforcing them: it has received the first annual reports, issued its first order to stop a PSP operating, and started publishing notices of violation. The next fixed deadline for every registered PSP is the annual report due by 31 March 2027, covering calendar year 2026.

A notice of violation is a formal finding that a PSP broke a rule, which can carry a money penalty. Published notices are posted in the Bank's enforcement decisions and noted on the PSP's entry in the public registry, so counterparties and banks can see them.

  • - Before December 2026: confirm the safeguarding method still matches how money actually moves, including a written legal opinion where an express trust is used
  • - By 31 December 2026: record the book value of safeguarded assets at year end, which the annual report asks for
  • - January to March 2027: assemble 2026 incident counts, significant changes, monthly transaction counts and values by currency, end-user numbers and financial statements
  • - By 31 March 2027: file the annual report in PSP Connect and keep the evidence behind every answer
DateWhat happened or happensWhat it means for a PSP
8 September 2025Registration became a condition of operatingNew PSPs must be registered before performing any retail payment activity
17 February 2026The Bank issued a temporary order requiring XTM Inc. to stop retail payment activities, citing concerns that client funds were not safeguarded. A revised order followed on 27 February 2026Safeguarding is being supervised in practice, not only on paper
26 March 2026Bill C-15 received Royal Assent, enacting the Stablecoin ActPSPs performing payment functions in a fiat-backed stablecoin will come under the RPAA once that stablecoin is prescribed by regulation
31 March 2026First annual reports due, covering 2025Missing or late reports are reporting violations
12 June 2026The Bank announced it would publish notices of violationEnforcement findings become public and appear on the registry entry
31 March 2027Second annual report due, covering 2026Data on incidents, safeguarding, transaction volumes and finances must be ready
2027Stablecoin framework expected to come into forcePayment firms handling stablecoins should map the new perimeter before then

Late annual reports and late notifications attract penalties of C$500 a day for up to 30 days, then C$15,000 to C$1,000,000 if the failure continues beyond 30 days. Other violations carry up to C$1 million (serious) or C$10 million (very serious) each.

Bank of Canada RPAA registration vs FINTRAC MSB registration

Two federal regimes, two registers, two sets of obligations. Most payment firms serving Canadian end users need to assess both.

Point of differenceBank of Canada RPAA PSPFINTRAC MSB / FMSB
Supervisory purposeOperational risk and end-user fund safeguardingMoney laundering and terrorist financing
LegislationRetail Payment Activities ActProceeds of Crime (Money Laundering) and Terrorist Financing Act
TriggerPerforming one of five payment functions in a retail payment activityOffering listed MSB services such as money transferring or dealing in virtual currency
FeeFlat C$2,500 application fee; annual assessment fees not yet chargedNone
Key dutiesRisk framework, incident notification, safeguarding, annual report by 31 MarchCompliance programme, reporting, record keeping, client identification
Foreign providersCaptured where retail payment activities are directed at end users in CanadaForeign MSB registration where services are directed at Canada, with a representative for service in Canada
RenewalNone; registration does not expireEvery two years
Public registerYes, the Bank of Canada publishes registered PSPs and a list of refused or revoked applicantsYes, FINTRAC publishes registered, expired, ceased and revoked MSBs

Key requirements

Perimeter and payment functions

Identify which of the five payment functions the business performs, for which end users, and whether any statutory exclusion applies. The analysis should be documented and reviewed when the product changes.

Operational risk framework

A documented risk management and incident response framework covering identification of operational risks, mitigating controls, objectives for reliability and integrity, testing, independent review at least every three years, and material incident notification to the Bank of Canada without delay.

Safeguarding of end-user funds

Where end-user funds are held, arrangements that protect those funds from the provider's other obligations, make them available to end users without delay including on insolvency, and are supported by reconciliation, documented arrangements with the account provider or insurer and independent review.

Registration information

Detailed information about the provider, its retail payment activities, ownership and control, third-party arrangements, and the contact points required by the regulations, submitted through PSP Connect.

Reporting

An annual report to the Bank of Canada by 31 March each year covering the previous calendar year, notification of significant changes, and incident notifications. Registered PSPs appear on a public register.

Fees

A flat, non-refundable registration application fee of C$2,500. The Act provides for annual assessment fees, which the Bank will begin charging once its cost recovery regulations are finalised.

What does RPAA registration cost?

  • - Registration fee: a flat application fee of C$2,500, the same for every applicant and not refunded if the application is refused
  • - Annual assessment: the Act provides for annual assessment fees to fund supervision. As at October 2026 the Bank of Canada has not started charging them and will do so once the cost recovery regulations are finalised
  • - Capital: none. The RPAA does not impose capital or net worth requirements
  • - Framework build: the operational risk and incident response framework, safeguarding arrangements, reconciliation process and independent review are the substantive cost of the regime
  • - Third-party costs: safeguarding account or insurance arrangements, a legal opinion where an express trust is used, independent review of the frameworks, and resilience and incident tooling
  • - Professional fees: a fixed fee set out in a written proposal. Scope depends on which payment functions are performed, whether end-user funds are held, and whether parallel FINTRAC registration is required

The application process

1

Perimeter and structuring analysis

Regulatory Counsel maps the flow of funds against the five payment functions, tests whether activities are directed at end users in Canada, assesses exclusions, and confirms whether parallel FINTRAC registration is required.

2

Framework build

We prepare the operational risk and incident response framework and, where end-user funds are held, the safeguarding framework, reconciliation process and account arrangements. This precedes the application because the Bank of Canada expects the framework to exist.

3

PSP Connect preparation and submission

We assemble the registration information, prepare the submission through PSP Connect and manage the fee payment.

4

Review and response

We manage Bank of Canada correspondence, including any review of the application, within the periods provided by the regulations.

5

Registration and go-live

On registration, we implement the annual reporting cycle, significant change notification process and incident escalation path, and align them with the firm's FINTRAC obligations where both apply.

Framework build typically drives the critical path. The regulations set out a period in which the Bank of Canada decides whether to review an application, an available extension to that period, and a defined period in which any review is conducted, so a registration subject to review takes materially longer than one that is not.

How long does RPAA registration take?

Registration must be in place before the provider performs retail payment activities, so timing is a gating item for Canadian launch rather than a parallel workstream.

The Retail Payment Activities Regulations set out the framework: the Bank of Canada has a defined period in which to decide whether to review an application, that period can be extended once by a further defined period, and where a review is conducted it must be completed within the longer review period prescribed by the regulations. A straightforward application that is not selected for review completes considerably faster than one that is.

In planning terms, the controllable element is the framework. Applications supported by a genuine, documented operational risk framework and, where relevant, an implemented safeguarding arrangement, present far fewer questions than those where the framework is drafted in response to the Bank of Canada's enquiries.

Why applications fail, and how we prevent it

Perimeter misjudged

A firm concludes it performs no payment function because it does not touch funds, while it authorises or transmits transfer instructions on behalf of end users. The correct analysis is function by function against the flow of funds.

Framework drafted retrospectively

Where the operational risk or safeguarding framework is produced only after the Bank of Canada asks, the application takes longer and the supervisory relationship begins badly.

Safeguarding without reconciliation

Holding end-user funds in a separate account, without documented reconciliation, account arrangements and review, does not meet the safeguarding requirement.

Dual registration overlooked

Firms register with the Bank of Canada and continue to transfer funds for Canadian customers without FINTRAC registration, or the reverse.

Annual reporting missed

The annual report and significant change notifications are continuing statutory duties, not administrative courtesies, and missing them is a supervisory issue.

Practitioner observations on RPAA registration

  • - Assuming FINTRAC registration is enough. The two regimes are separate and a firm can be fully compliant with one while unregistered under the other
  • - Applying before the framework exists. The Bank of Canada expects the operational risk framework to be real, and an application ahead of the framework invites review
  • - Under-scoping the payment functions. Firms describe themselves as a technology provider while authorising or transmitting transfer instructions, which is a captured function
  • - Treating safeguarding as a bank account. The requirement is that funds are protected from the provider's other obligations and available to end users without delay, which needs reconciliation and evidence
  • - Missing the incident notification duty. Material incidents must be notified without delay, which requires an escalation path defined before an incident occurs
  • - Treating the annual report as a form-filling exercise. It asks for dated evidence of framework approvals, independent reviews, safeguarding shortfalls and monthly transaction data, which must exist before March

How we help

Perimeter and structuring

We map the flow of funds against the five payment functions, test the foreign PSP position and confirm whether FINTRAC registration is required in parallel.

Framework and application

We build the operational risk, incident response and safeguarding frameworks, then prepare and submit the PSP Connect registration.

Ongoing supervision

We implement annual reporting, significant change notification, incident escalation and independent review so the registration remains in good standing.

Canadian payments market entry usually involves two regulators rather than one. We run the Bank of Canada registration and the FINTRAC registration as a single project, so the perimeter analysis, the compliance framework and the safeguarding arrangements are consistent across both, and neither obligation is discovered late.

Discuss your RPAA registrationView all services

Related licences

Canada MSB Registration

FINTRAC registration for money transferring, foreign exchange and virtual currency services.

Learn more

UK Authorised Payment Institution

The UK equivalent permission for firms operating on both sides of the Atlantic.

Learn more

US Money Transmitter Licence

State-by-state licensing for firms extending into the United States.

Learn more

Guides

Further reading on the Canada RPAA Registration (Bank of Canada PSP)

Frequently asked questions

A payment service provider that performs one or more of the five payment functions as a service or business activity in relation to an electronic funds transfer for an end user in Canada. The functions are providing or maintaining an account, holding funds, initiating a transfer, authorising or transmitting a transfer instruction, and providing clearing or settlement services.

Yes, where they perform retail payment activities and direct those activities at individuals or entities in Canada. A Canadian entity or office is not required, and incorporation outside Canada does not remove the obligation.

No. They are separate regimes under separate legislation with separate regulators, definitions and reporting cycles. Firms that transfer funds for Canadian customers and hold end-user funds commonly require both registrations at the same time.

The Bank of Canada charges a flat registration application fee of C$2,500, the same for every applicant and not refundable if the application is refused. The Act also provides for annual assessment fees to recover supervision costs, but as at October 2026 the Bank has not started charging them and will do so once the cost recovery regulations are finalised.

No. Since 8 September 2025 a PSP must be registered before it performs retail payment activities. Only firms that applied before 8 September 2025 may continue until they receive a decision. Operating without registration is treated by the Bank as a very serious violation.

A PSP holding end-user funds must hold them so that they are protected from the provider's other obligations and available to end users without delay, including on insolvency. The arrangement must be supported by reconciliation, documented account or insurance arrangements and independent review. Deposit insurance alone does not meet the requirement.

Incidents with a material impact on end users, other PSPs or clearing and settlement systems must be notified without delay, alongside notification to affected parties. This requires a defined escalation path and materiality assessment established before an incident occurs.

The regulations provide a period for the Bank of Canada to decide whether to review an application, an available extension, and a longer period in which any review is conducted. Applications supported by a completed operational risk framework and, where relevant, implemented safeguarding, move faster than those that are not.

An annual report to the Bank of Canada through PSP Connect by 31 March each year, notification of significant changes to the business or its arrangements, and incident notifications. Annual assessment fees will be added once the Bank's cost recovery regulations are finalised.

No. Registration reflects that the provider is subject to the regime and has met the registration requirements. It is not a prudential licence, an endorsement of the business model or a substitute for provincial or anti-money laundering obligations.

By 31 March 2027. It covers calendar year 2026, except financial figures, which use the PSP's most recent financial year end. The form is released in PSP Connect ahead of the deadline and has six sections: operational risk, safeguarding, significant changes and incidents, transaction metrics, financial information and record keeping.

Late annual reports and late notifications are penalised at C$500 for each day, for up to 30 days. If the failure continues beyond 30 days the penalty is C$15,000 to C$1,000,000. False or misleading information in the report is a separate violation.

No. Registration does not expire and there is no renewal. It can be revoked, for example if the PSP stops performing retail payment activities or commits a violation, and refused and revoked firms are listed publicly by the Bank of Canada.

Yes. On 17 February 2026 it ordered XTM Inc. to stop retail payment activities over concerns that client funds had not been safeguarded, and revised that order on 27 February 2026. In June 2026 it announced that it would publish notices of violation, with each one also noted on the PSP's registry entry.

Primary sources

The requirements, fees and timeframes on this page are taken from the following primary regulatory and legislative sources. Rules change, and firms should confirm the current position before relying on any figure.

Last reviewed by the Regulatory Counsel team on 20 October 2026.