Canada’s RPAA registration explained: what the Bank of Canada expects from payment service providers

Canada’s Retail Payment Activities Act (RPAA) introduces mandatory registration with the Bank of Canada for payment service providers. Here’s what it covers, who’s in scope, and why it matters in practice.

If MSB registration in Canada is about fighting financial crime, RPAA is about something else entirely: protecting users of payment services and making the system more resilient.

Since the Retail Payment Activities Act (RPAA) came into force, many fintechs have discovered that being “compliant in Canada” can mean more than just FINTRAC. Even businesses that never touch cash, FX, or crypto trading may still need to register - this time with the Bank of Canada.

This article is a high-level, founder-friendly overview of what RPAA registration is, who it applies to, and how it fits alongside MSB obligations.

What RPAA is (in plain English)

The Retail Payment Activities Act is Canada’s framework for supervising payment service providers (PSPs). The full text of the law is published here:

https://laws-lois.justice.gc.ca/eng/acts/R-4.5/

Unlike FINTRAC’s AML regime, RPAA is not about suspicious transactions or reporting crime. It’s about:

• safeguarding customer funds
• operational resilience
• governance and risk management
• transparency toward users

Under RPAA, the Bank of Canada becomes the supervisor of certain non-bank payment providers - a role it didn’t traditionally play.

The key idea is simple:If your business moves, holds, or enables retail payments for end users in Canada, the Bank of Canada wants visibility and baseline controls.

Who is considered a Payment Service Provider (PSP)?

You may fall under RPAA if you perform one or more of these activities as a business:

• holding end-user funds (even temporarily)
• enabling electronic funds transfers
• providing payment initiation or processing services
• operating wallets or stored-value accounts
• facilitating payments between users and merchants

Importantly, RPAA focuses on function, not branding.

You don’t need to call yourself a “payments company” to be in scope. Marketplaces, fintech apps, wallets, and embedded payment platforms often discover they qualify unintentionally.

RPAA vs MSB: why this is not “one or the other”

This is where many teams get confused.

MSB (FINTRAC) focuses on AML/CFT obligationshttps://fintrac-canafe.canada.ca/msb-esm/intro-eng

RPAA (Bank of Canada) focuses on payments stability, governance, and consumer protectionhttps://www.bankofcanada.ca/payments/retail-payments-supervision/

They solve different problems, and in some cases, you may need both.

Examples:

• A crypto on-ramp may need MSB registration (crypto dealing) and RPAA registration (holding user funds).
• A payment processor with no FX or crypto exposure may skip MSB but still fall under RPAA.

RPAA does not replace MSB, and MSB does not automatically cover RPAA.

What RPAA registration actually involves

RPAA is not a licence in the classic sense. It’s a mandatory registration and supervision regime.

At a high level, the Bank of Canada expects registered PSPs to demonstrate:

1. Governance and accountabilityClear ownership, decision-making structure, and named responsible persons.

2. Operational risk managementYou must identify and manage risks related to:

• outages
• cyber incidents
• third-party dependencies
• internal process failures

3. Safeguarding of end-user fundsIf you hold user funds, you need clear segregation, protection mechanisms, and transparency on how funds are stored and accessed.

4. Reporting and recordkeepingRegistered PSPs must provide information to the Bank of Canada and notify it of certain incidents.

This is where RPAA starts to feel closer to prudential-style supervision than startup-friendly compliance.

When RPAA applies (and when it doesn’t)

RPAA generally applies when:

• services are provided to end users in Canada
• activities are retail in nature
• the provider is not already a federally regulated bank

Some entities are excluded (for example, traditional banks or certain provincially regulated institutions), but most fintechs do not fall into those exemptions.

Also worth noting:Being based outside Canada does not automatically exempt you if you actively provide payment services to Canadian users.

Why RPAA matters for your roadmap

Even if RPAA registration feels “future-you’s problem,” it influences real decisions today:

• Product design: how long you hold funds, where balances sit, and who controls movement
• Banking & partnerships: Canadian banks increasingly ask RPAA questions during onboarding
• Fundraising & exits: regulatory clarity matters to investors, especially for payments-heavy models

Ignoring RPAA doesn’t make it go away - it usually just makes later conversations harder.

A simple founder checklist

Before you dismiss RPAA, ask yourself:

• Do we ever hold user funds, even briefly?
• Are we enabling payments between users or to merchants?
• Would a user reasonably think of us as “handling their money”?
• Could a bank or partner see us as a payment intermediary?

If you answer “yes” more than once, RPAA should be on your radar.

The official Bank of Canada overview of the regime is here:

https://www.bankofcanada.ca/core-functions/financial-system/payments/retail-payments-supervision/