Estonia
Latvia
Lithuania
Finland
Sweden
Norway
Poland
Czech Republic
Switzerland
Malta
Cyprus
Canada
Who must register under the RPAA
In short: if your business moves or holds money for other people in Canada, and it is not a bank, you probably need RPAA registration. The Bank of Canada applies a four-part test, and you register only if all four answers are yes:
- A payment service provider: you perform at least one payment function as a service or business activity that is not incidental to another business.
- A retail payment activity: the function relates to an electronic funds transfer in Canadian or foreign currency.
- In scope geographically: you have a place of business in Canada, or you serve end users in Canada and direct your services at Canada.
- Not excluded: banks, some other regulated entities and certain activities fall outside the Act (see below).
The five payment functions
- Providing or maintaining an account held on behalf of end users
- Holding funds on behalf of an end user
- Initiating an electronic funds transfer at an end user’s request
- Authorising a transfer, or transmitting, receiving or facilitating a transfer instruction
- Providing clearing or settlement services
The one founders most often miss is holding funds. A wallet balance, a prepaid account or a merchant payout that waits a few days can all mean you hold end‑user funds.
What the RPAA supervises, and what it does not
The Retail Payment Activities Act gave Canada its first federal supervision of payment companies that are not banks, and the Bank of Canada runs it. Registration opened on 1 November 2024, and the operating duties took effect on 8 September 2025.
It is a registration, not a licence. The Bank does not approve your business model or your pricing. It looks at two things: whether you manage operational risk (outages, cyber incidents, failing suppliers) and whether the money you hold for clients is protected if something goes wrong.
Anti-money laundering is not part of it. That stays with FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, which is where most of the confusion we see starts.
Already a FINTRAC MSB? Why you may need both
This is the question Canada MSB clients ask us most. The two regimes look at the same business from different sides:
- FINTRAC (MSB): who your clients are and where the money comes from. Compliance officer, KYC, transaction reporting, record keeping.
- Bank of Canada (RPAA): whether your operations are safe and client money is protected. Risk framework, incident response, safeguarding, annual report.
A remittance company, a payment gateway or an e-wallet with Canadian clients usually needs both. They are also linked: the RPAA application asks for your FINTRAC registration, the Bank shares applications with FINTRAC, and a missing FINTRAC registration or a FINTRAC penalty in the past five years is a ground for refusal. We plan the two together, with one set of policies that answers both regulators.
Foreign payment companies and the "directed at Canada" test
Being incorporated abroad does not take you out of the Act. A foreign provider is in scope if it serves end users in Canada and directs its services at Canada. The Bank looks at signs such as marketing aimed at Canada or a .ca domain, prices in Canadian dollars, customer support for Canadian users, Canadian agents, or a high share of Canadian end users.
A foreign provider must register even if it is already registered with FINTRAC as a foreign MSB, and it names an agent in Canada to receive the Bank’s notices.
What is excluded, including crypto
- Excluded entities: banks and authorised foreign banks, certain credit unions, insurers, trust and loan companies, Payments Canada and the Bank of Canada.
- Closed-loop instruments: a payment instrument usable only with the merchant that issued it, such as a store gift card.
- Securities and financial contracts: eligible financial contracts and prescribed securities‑related transactions.
- Designated systems: functions performed inside a system designated under the Payment Clearing and Settlement Act, such as Lynx.
- Transfers between affiliates, where no other provider performs a payment function for the transfer.
- Agents of a registered provider acting within their mandate, if the provider lists them in its application.
Crypto needs care. In the Bank’s published case scenarios, an exchange that deals only in crypto, or one whose fiat balances are only incidental to trading, does not need to register. A crypto-backed prepaid card marketed as a payment product does. The test is whether there is a fiat transfer and whether the payment function is incidental, not whether you hold the customer’s crypto. Crypto dealing needs FINTRAC MSB registration either way.
How RPAA registration works
Applications are filed online in the Bank’s PSP Connect portal, with a one-time, non-refundable application fee (set at CAD 2,500 in the Regulations and indexed to inflation). The application describes:
- Your corporate structure, owners and place of business
- The retail payment activities you perform and your number of end users
- Your risk management and incident response framework, and how you safeguard funds
- Your third-party service providers and agents
- Your FINTRAC registration and, for a foreign provider, your agent in Canada
Regulatory processing time
- The Act sets no fixed approval deadline: the Bank registers "as soon as feasible". If it asks for more information, you have 30 days to provide it.
- Every application can go to the Minister of Finance for a national security review. The Minister has 60 days to decide whether to review (extendable by 60), and a review runs 180 days, with possible extensions.
- A new applicant cannot start operating until it is registered.
On our own Canada projects we plan around 3 to 6 months for RPAA registration, run in parallel with the FINTRAC MSB work. Buying a registered company is not a shortcut: an acquisition of control needs a new application before the change.
Ongoing duties after registration
- Risk management and incident response: a framework approved by a senior officer and the board, reviewed at least once a year, with an independent review every three years.
- Safeguarding: end-user funds held in a trust account, or in a separate account with insurance or a guarantee at least equal to the funds, plus a daily ledger of each end user’s balance.
- Incidents: notify the Bank and affected users and providers without delay when an incident has a material impact.
- Changes: notify the Bank at least five business days before a significant change or a new activity.
- Annual report: filed by 31 March of the following year.
- Records and fees: records kept for five years, and annual assessment fees to the Bank.
Penalties are administrative but heavy: up to CAD 1 million for a serious violation and CAD 10 million for a very serious one, and a late report costs CAD 500 a day. The Bank publishes the violation, the provider’s name and the amount.
How MAXCORP helps with RPAA registration
MAXCORP prepares RPAA registrations for payment companies entering Canada, usually together with their FINTRAC MSB registration. We check first whether the Act applies to you at all. If it does, we write the risk management, incident response and safeguarding frameworks, file the application in PSP Connect and answer the Bank’s questions until you are registered.
RPAA is an add-on to our Canada MSB registration, and we can also form the Canadian company both registrations are made in. Once you are registered, our Compliance Officer in Canada can cover the RPAA side as well: safeguarding oversight, incident reports and the annual report to the Bank.
Official sources (7)
- Retail Payment Activities Act (S.C. 2021, c. 23, s. 177)
- Retail Payment Activities Regulations (SOR/2023‑229)
- Bank of Canada: criteria for registering payment service providers
- Bank of Canada: retail payments supervisory framework
- Bank of Canada: frequently asked questions about retail payments supervision
- Bank of Canada: case scenarios for services backed by cryptocurrencies
- Bank of Canada: retail payments supervision key milestones
General information only, not legal or tax advice. Rules change; ask us about your case.