Who has to register under the RPAA
The RPAA applies to payment service providers that perform one or more payment functions for end users, as a service or business activity:
- providing or maintaining an account held for end users;
- holding funds on behalf of end users;
- initiating an electronic funds transfer at an end user's request;
- authorizing an electronic funds transfer, or transmitting, receiving or facilitating an instruction for one;
- providing clearing or settlement services.
It covers PSPs with a place of business in Canada, and PSPs outside Canada that perform retail payment activities for end users in Canada. Some institutions, such as banks, are excluded, and some activities fall outside the Act, so the first step is confirming that it applies to you.
What it costs
Our fee for preparing and supporting your registration is a fixed US$3,500. Separately, the Bank of Canada charges every applicant a one-time, non-refundable registration application fee. It was set at CA$2,500 from November 1, 2024 and is adjusted each calendar year in line with inflation, so we confirm the current amount when you apply. Once registered, PSPs also pay the Bank annual assessment fees to cover the cost of supervision.
How registration works
- Assessment. Which of your activities are retail payment activities, and whether you need FINTRAC registration as well.
- Preparation. Your business, ownership, payment activities, agents, mandataries and third-party providers, gathered and checked.
- Application. Submitted to the Bank of Canada, with the application fee.
- Review. The Bank shares applications with the Department of Finance for national security screening and with FINTRAC. We help you answer questions along the way.
- Decision. The Bank publishes registration decisions as screenings are completed.
In our experience, the whole process generally takes about 2 to 8 months.
What the Bank expects once you're registered
Since September 8, 2025, registered PSPs must have a risk management and incident response framework and, if they hold end-user funds, a safeguarding framework. They must also:
- notify the Bank without delay of incidents with a material impact on end users, other PSPs or certain clearing and settlement systems;
- give the Bank notice at least five business days before a significant change or new activity;
- file an annual report no later than March 31 of the following year.
Our RPAA compliance program covers these frameworks for a fixed US$3,500.
RPAA and FINTRAC: do you need both?
Often, yes. Many payment businesses that register with the Bank of Canada also provide money services, such as remitting or transmitting funds, that require FINTRAC registration as an MSB. The two regimes cover different things: the RPAA deals with operational risk and safeguarding funds, and FINTRAC with money laundering and terrorist financing. We can handle both registrations together.
Sources: Bank of Canada, Retail payments supervision; Supervisory framework; Registration; Registration application fee. Checked 11 October 2026. General information, not legal advice.