What the RPAA is
The Retail Payment Activities Act (RPAA) is the federal law that brought payment service providers (PSPs), such as payment processors, digital wallets and money transfer apps, under supervision by the Bank of Canada. It focuses on operational risk, incident response and safeguarding the funds PSPs hold for their users.
Who has to register
A PSP is covered when it performs one or more payment functions for end users, as a service or business activity:
- providing or maintaining an account held for end users;
- holding funds on behalf of end users;
- initiating an electronic funds transfer at an end user's request;
- authorizing an electronic funds transfer, or transmitting, receiving or facilitating an instruction for one;
- providing clearing or settlement services.
That covers PSPs with a place of business in Canada, and PSPs outside Canada that perform retail payment activities for end users in Canada. Some institutions, such as banks, are excluded, and some activities fall outside the Act.
What registration costs
The Bank of Canada charges every applicant a one-time, non-refundable application fee. It was set at CA$2,500 from November 1, 2024 and is adjusted every calendar year in line with inflation. Registered PSPs also pay the Bank annual assessment fees to cover the cost of supervision. Our fee to prepare and support your registration is a fixed US$3,500.
How the Bank reviews applications
The Bank shares applications with the Department of Finance for national security screening, and with FINTRAC. The Bank must refuse or revoke a registration if the Minister of Finance directs it to for national security reasons. Registration decisions are published as screenings are completed.
What's required after registration
Since September 8, 2025, PSPs must have:
- a risk management and incident response framework, covering identification, protection, detection, response and recovery, with defined roles, adequate resources, periodic testing, and the risks from third parties, agents and mandataries;
- if they hold end-user funds, safeguarding: a trust account, or a segregated account with insurance or a guarantee, plus a written framework for users' access to funds and for insolvency.
PSPs must also notify the Bank without delay of incidents with a material impact, give notice at least five business days before a significant change or new activity, and file an annual report no later than March 31 of the following year. Our RPAA compliance program covers these.
RPAA and FINTRAC
The two regimes sit side by side. The RPAA covers operational risk and safeguarding under the Bank of Canada; FINTRAC covers money laundering and terrorist financing. A payment business that also remits or transmits funds usually needs to register with FINTRAC as an MSB too.
Sources: Bank of Canada, Retail payments supervision; Supervisory framework; Registration; Registration application fee. Checked 11 October 2026. General information, not legal advice.